Where validation becomes chain state

3501    AssertLockNotHeld(::cs_main);
3502    {
3503        LOCK(cs_main);
3504        if (pindex->nChainWork < m_chain.Tip()->nChainWork) {
3505            // Nothing to do, this block is not at the tip.
3506            return true;
3507        }
3508        if (m_chain.Tip()->nChainWork > m_chainman.nLastPreciousChainwork) {
3509            // The chain has been extended since the last call, reset the counter.
3510            m_chainman.nBlockReverseSequenceId = -1;
3511        }
3512        m_chainman.nLastPreciousChainwork = m_chain.Tip()->nChainWork;
3513        setBlockIndexCandidates.erase(pindex);
3514        pindex->nSequenceId = m_chainman.nBlockReverseSequenceId;
3515        if (m_chainman.nBlockReverseSequenceId > std::numeric_limits<int32_t>::min()) {
3516            // We can't keep reducing the counter if somebody really wants to
3517            // call preciousblock 2**31-1 times on the same set of tips...
3518            m_chainman.nBlockReverseSequenceId--;
3519        }
3520        if (pindex->IsValid(BLOCK_VALID_TRANSACTIONS) && pindex->HaveNumChainTxs()) {
3521            setBlockIndexCandidates.insert(pindex);
3522            PruneBlockIndexCandidates();
3523        }
3524    }
3525
3526    return ActivateBestChain(state, std::shared_ptr<const CBlock>());
3527}
3528
3529bool Chainstate::InvalidateBlock(BlockValidationState& state, CBlockIndex* const pindex)
3530{
3531    AssertLockNotHeld(m_chainstate_mutex);
3532    AssertLockNotHeld(::cs_main);
3533
3534    // Genesis block can't be invalidated
3535    assert(pindex);
3536    if (pindex->nHeight == 0) return false;
3537
3538    // We do not allow ActivateBestChain() to run while InvalidateBlock() is
3539    // running, as that could cause the tip to change while we disconnect
3540    // blocks.
3541    LOCK(m_chainstate_mutex);
3542
3543    // We'll be acquiring and releasing cs_main below, to allow the validation
3544    // callbacks to run. However, we should keep the block index in a
3545    // consistent state as we disconnect blocks -- in particular we need to
3546    // add equal-work blocks to setBlockIndexCandidates as we disconnect.
3547    // To avoid walking the block index repeatedly in search of candidates,
3548    // build a map once so that we can look up candidate blocks by chain
3549    // work as we go.
3550    std::multimap<const arith_uint256, CBlockIndex*> highpow_outofchain_headers;
3551
3552    {
3553        LOCK(cs_main);
3554        for (auto& entry : m_blockman.m_block_index) {
3555            CBlockIndex& candidate = entry.second;
3556            // We don't need to put anything in our active chain into the
3557            // multimap, because those candidates will be found and considered
3558            // as we disconnect.
3559            // Instead, consider only non-active-chain blocks that score
3560            // at least as good with CBlockIndexWorkComparator as the new tip.
3561            if (!m_chain.Contains(candidate) &&
3562                !CBlockIndexWorkComparator()(&candidate, pindex->pprev) &&
3563                !(candidate.nStatus & BLOCK_FAILED_VALID)) {
3564                highpow_outofchain_headers.insert({candidate.nChainWork, &candidate});
3565            }
3566        }
3567    }
3568
3569    CBlockIndex* to_mark_failed = pindex;
3570    bool pindex_was_in_chain = false;
3571    int disconnected = 0;
3572
3573    // Disconnect (descendants of) pindex, and mark them invalid.
3574    while (true) {
3575        if (m_chainman.m_interrupt) break;
3576
3577        // Make sure the queue of validation callbacks doesn't grow unboundedly.
3578        if (m_chainman.m_options.signals) LimitValidationInterfaceQueue(*m_chainman.m_options.signals);
3579
3580        LOCK(cs_main);
3581        // Lock for as long as disconnectpool is in scope to make sure MaybeUpdateMempoolForReorg is
3582        // called after DisconnectTip without unlocking in between
3583        LOCK(MempoolMutex());
3584        if (!m_chain.Contains(*pindex)) break;
3585        pindex_was_in_chain = true;
3586        CBlockIndex* const disconnected_tip{m_chain.Tip()};
3587
3588        // ActivateBestChain considers blocks already in m_chain
3589        // unconditionally valid already, so force disconnect away from it.
3590        DisconnectedBlockTransactions disconnectpool{MAX_DISCONNECTED_TX_POOL_BYTES};
3591        bool ret = DisconnectTip(state, &disconnectpool);
3592        // DisconnectTip will add transactions to disconnectpool.
3593        // Adjust the mempool to be consistent with the new tip, adding
3594        // transactions back to the mempool if disconnecting was successful,
3595        // and we're not doing a very deep invalidation (in which case
3596        // keeping the mempool up to date is probably futile anyway).
3597        MaybeUpdateMempoolForReorg(disconnectpool, /* fAddToMempool = */ (++disconnected <= 10) && ret);
3598        if (!ret) return false;
3599        CBlockIndex* new_tip{m_chain.Tip()};
3600        assert(disconnected_tip->pprev == new_tip);
3601
3602        // We immediately mark the disconnected blocks as invalid.
3603        // This prevents a case where pruned nodes may fail to invalidateblock
3604        // and be left unable to start as they have no tip candidates (as there
3605        // are no blocks that meet the "have data and are not invalid per
3606        // nStatus" criteria for inclusion in setBlockIndexCandidates).
3607        disconnected_tip->nStatus |= BLOCK_FAILED_VALID;
3608        m_blockman.m_dirty_blockindex.insert(disconnected_tip);
3609        setBlockIndexCandidates.erase(disconnected_tip);
3610        setBlockIndexCandidates.insert(new_tip);
3611
3612        // Mark out-of-chain descendants of the invalidated block as invalid
3613        // Add any equal or more work headers that are not invalidated to setBlockIndexCandidates
3614        // Recalculate m_best_header if it became invalid.
3615        auto candidate_it = highpow_outofchain_headers.lower_bound(new_tip->nChainWork);
3616
3617        const bool best_header_needs_update{m_chainman.m_best_header->GetAncestor(disconnected_tip->nHeight) == disconnected_tip};
3618        if (best_header_needs_update) {
3619            // new_tip is definitely still valid at this point, but there may be better ones
3620            m_chainman.m_best_header = new_tip;
3621        }
3622
3623        while (candidate_it != highpow_outofchain_headers.end()) {
3624            CBlockIndex* candidate{candidate_it->second};
3625            if (candidate->GetAncestor(disconnected_tip->nHeight) == disconnected_tip) {
3626                // Children of failed blocks are marked as BLOCK_FAILED_VALID.
3627                candidate->nStatus |= BLOCK_FAILED_VALID;
3628                m_blockman.m_dirty_blockindex.insert(candidate);
3629                // If invalidated, the block is irrelevant for setBlockIndexCandidates
3630                // and for m_best_header and can be removed from the cache.
3631                candidate_it = highpow_outofchain_headers.erase(candidate_it);
3632                continue;
3633            }
3634            if (!CBlockIndexWorkComparator()(candidate, new_tip) &&
3635                candidate->IsValid(BLOCK_VALID_TRANSACTIONS) &&
3636                candidate->HaveNumChainTxs()) {
3637                setBlockIndexCandidates.insert(candidate);
3638                // Do not remove candidate from the highpow_outofchain_headers cache, because it might be a descendant of the block being invalidated
3639                // which needs to be marked failed later.
3640            }
3641            if (best_header_needs_update &&
3642                m_chainman.m_best_header->nChainWork < candidate->nChainWork) {
3643                m_chainman.m_best_header = candidate;
3644            }
3645            ++candidate_it;
3646        }
3647
3648        // Track the last disconnected block to call InvalidChainFound on it.
3649        to_mark_failed = disconnected_tip;
3650    }
3651
3652    m_chainman.CheckBlockIndex();
3653
3654    {
3655        LOCK(cs_main);
3656        if (m_chain.Contains(*to_mark_failed)) {
3657            // If the to-be-marked invalid block is in the active chain, something is interfering and we can't proceed.
3658            return false;
3659        }
3660
3661        // Mark pindex as invalid if it never was in the main chain
3662        if (!pindex_was_in_chain && !(pindex->nStatus & BLOCK_FAILED_VALID)) {
3663            pindex->nStatus |= BLOCK_FAILED_VALID;
3664            m_blockman.m_dirty_blockindex.insert(pindex);
3665            setBlockIndexCandidates.erase(pindex);
3666        }
3667
3668        // If any new blocks somehow arrived while we were disconnecting
3669        // (above), then the pre-calculation of what should go into
3670        // setBlockIndexCandidates may have missed entries. This would
3671        // technically be an inconsistency in the block index, but if we clean
3672        // it up here, this should be an essentially unobservable error.
3673        // Loop back over all block index entries and add any missing entries
3674        // to setBlockIndexCandidates.
3675        for (auto& [_, block_index] : m_blockman.m_block_index) {
3676            if (block_index.IsValid(BLOCK_VALID_TRANSACTIONS) && block_index.HaveNumChainTxs() && !setBlockIndexCandidates.value_comp()(&block_index, m_chain.Tip())) {
3677                setBlockIndexCandidates.insert(&block_index);
3678            }
3679        }
3680
3681        InvalidChainFound(to_mark_failed);
3682    }
3683
3684    // Only notify about a new block tip if the active chain was modified.
3685    if (pindex_was_in_chain) {
3686        // Ignoring return value for now, this could be changed to bubble up
3687        // kernel::Interrupted value to the caller so the caller could
3688        // distinguish between completed and interrupted operations. It might
3689        // also make sense for the blockTip notification to have an enum
3690        // parameter indicating the source of the tip change so hooks can
3691        // distinguish user-initiated invalidateblock changes from other
3692        // changes.
3693        (void)m_chainman.GetNotifications().blockTip(
3694            /*state=*/GetSynchronizationState(m_chainman.IsInitialBlockDownload(), m_chainman.m_blockman.m_blockfiles_indexed),
3695            /*index=*/*to_mark_failed->pprev,
3696            /*verification_progress=*/WITH_LOCK(m_chainman.GetMutex(), return m_chainman.GuessVerificationProgress(to_mark_failed->pprev)));
3697
3698        // Fire ActiveTipChange now for the current chain tip to make sure clients are notified.
3699        // ActivateBestChain may call this as well, but not necessarily.
3700        if (m_chainman.m_options.signals) {
3701            m_chainman.m_options.signals->ActiveTipChange(*Assert(m_chain.Tip()), m_chainman.IsInitialBlockDownload());
3702        }
3703    }
3704    return true;
3705}
3706
3707void Chainstate::SetBlockFailureFlags(CBlockIndex* invalid_block)
3708{
3709    AssertLockHeld(cs_main);
3710
3711    for (auto& [_, block_index] : m_blockman.m_block_index) {
3712        if (invalid_block != &block_index && block_index.GetAncestor(invalid_block->nHeight) == invalid_block) {
3713            block_index.nStatus |= BLOCK_FAILED_VALID;
3714            m_blockman.m_dirty_blockindex.insert(&block_index);
3715        }
3716    }
3717}
3718
3719void Chainstate::ResetBlockFailureFlags(CBlockIndex *pindex) {
3720    AssertLockHeld(cs_main);
3721
3722    int nHeight = pindex->nHeight;
3723
3724    // Remove the invalidity flag from this block and all its descendants and ancestors.
3725    for (auto& [_, block_index] : m_blockman.m_block_index) {
3726        if ((block_index.nStatus & BLOCK_FAILED_VALID) && (block_index.GetAncestor(nHeight) == pindex || pindex->GetAncestor(block_index.nHeight) == &block_index)) {
3727            block_index.nStatus &= ~BLOCK_FAILED_VALID;
3728            m_blockman.m_dirty_blockindex.insert(&block_index);
3729            if (block_index.IsValid(BLOCK_VALID_TRANSACTIONS) && block_index.HaveNumChainTxs() && setBlockIndexCandidates.value_comp()(m_chain.Tip(), &block_index)) {
3730                setBlockIndexCandidates.insert(&block_index);
3731            }
3732            if (&block_index == m_chainman.m_best_invalid) {
3733                // Reset invalid block marker if it was pointing to one of those.
3734                m_chainman.m_best_invalid = nullptr;
3735            }
3736        }
3737    }
3738}
3739
3740void Chainstate::TryAddBlockIndexCandidate(CBlockIndex* pindex)
3741{
3742    AssertLockHeld(cs_main);
3743
3744    // Do not continue building a chainstate that is based on an invalid
3745    // snapshot. This is a belt-and-suspenders type of check because if an
3746    // invalid snapshot is loaded, the node will shut down to force a manual
3747    // intervention. But it is good to handle this case correctly regardless.
3748    if (m_assumeutxo == Assumeutxo::INVALID) {
3749        return;
3750    }