Where validation becomes chain state

5751        strprintf("%s (%.2f MB)",
5752                  snapshot_loaded ? "saving snapshot chainstate" : "flushing coins cache",
5753                  coins_cache.DynamicMemoryUsage() / (1000 * 1000)),
5754        BCLog::LogFlags::ALL);
5755
5756    coins_cache.Flush();
5757}
5758
5759struct StopHashingException : public std::exception
5760{
5761    const char* what() const noexcept override
5762    {
5763        return "ComputeUTXOStats interrupted.";
5764    }
5765};
5766
5767static void SnapshotUTXOHashBreakpoint(const util::SignalInterrupt& interrupt)
5768{
5769    if (interrupt) throw StopHashingException();
5770}
5771
5772util::Result<void> ChainstateManager::PopulateAndValidateSnapshot(
5773    Chainstate& snapshot_chainstate,
5774    AutoFile& coins_file,
5775    const SnapshotMetadata& metadata)
5776{
5777    // It's okay to release cs_main before we're done using `coins_cache` because we know
5778    // that nothing else will be referencing the newly created snapshot_chainstate yet.
5779    CCoinsViewCache& coins_cache = *WITH_LOCK(::cs_main, return &snapshot_chainstate.CoinsTip());
5780
5781    uint256 base_blockhash = metadata.m_base_blockhash;
5782
5783    CBlockIndex* snapshot_start_block = WITH_LOCK(::cs_main, return m_blockman.LookupBlockIndex(base_blockhash));
5784
5785    if (!snapshot_start_block) {
5786        // Needed for ComputeUTXOStats to determine the
5787        // height and to avoid a crash when base_blockhash.IsNull()
5788        return util::Error{Untranslated(strprintf("Did not find snapshot start blockheader %s",
5789                  base_blockhash.ToString()))};
5790    }
5791
5792    int base_height = snapshot_start_block->nHeight;
5793    const auto& maybe_au_data = GetParams().AssumeutxoForHeight(base_height);
5794
5795    if (!maybe_au_data) {
5796        return util::Error{Untranslated(strprintf("Assumeutxo height in snapshot metadata not recognized "
5797                  "(%d) - refusing to load snapshot", base_height))};
5798    }
5799
5800    const AssumeutxoData& au_data = *maybe_au_data;
5801
5802    // This work comparison is a duplicate check with the one performed later in
5803    // ActivateSnapshot(), but is done so that we avoid doing the long work of staging
5804    // a snapshot that isn't actually usable.
5805    if (WITH_LOCK(::cs_main, return !CBlockIndexWorkComparator()(ActiveTip(), snapshot_start_block))) {
5806        return util::Error{Untranslated("Work does not exceed active chainstate")};
5807    }
5808
5809    const uint64_t coins_count = metadata.m_coins_count;
5810    uint64_t coins_left = metadata.m_coins_count;
5811
5812    LogInfo("[snapshot] loading %d coins from snapshot %s", coins_left, base_blockhash.ToString());
5813    int64_t coins_processed{0};
5814
5815    while (coins_left > 0) {
5816        try {
5817            Txid txid;
5818            coins_file >> txid;
5819            size_t coins_per_txid{0};
5820            coins_per_txid = ReadCompactSize(coins_file);
5821
5822            if (coins_per_txid > coins_left) {
5823                return util::Error{Untranslated("Mismatch in coins count in snapshot metadata and actual snapshot data")};
5824            }
5825
5826            for (size_t i = 0; i < coins_per_txid; i++) {
5827                COutPoint outpoint;
5828                Coin coin;
5829                outpoint.n = static_cast<uint32_t>(ReadCompactSize(coins_file));
5830                outpoint.hash = txid;
5831                coins_file >> coin;
5832                if (coin.nHeight > base_height ||
5833                    outpoint.n >= std::numeric_limits<decltype(outpoint.n)>::max() // Avoid integer wrap-around in coinstats.cpp:ApplyHash
5834                ) {
5835                    return util::Error{Untranslated(strprintf("Bad snapshot data after deserializing %d coins",
5836                              coins_count - coins_left))};
5837                }
5838                if (!MoneyRange(coin.out.nValue)) {
5839                    return util::Error{Untranslated(strprintf("Bad snapshot data after deserializing %d coins - bad tx out value",
5840                              coins_count - coins_left))};
5841                }
5842                coins_cache.EmplaceCoinInternalDANGER(outpoint, std::move(coin));
5843
5844                --coins_left;
5845                ++coins_processed;
5846
5847                if (coins_processed % 1000000 == 0) {
5848                    LogInfo("[snapshot] %d coins loaded (%.2f%%, %.2f MB)",
5849                        coins_processed,
5850                        static_cast<float>(coins_processed) * 100 / static_cast<float>(coins_count),
5851                        coins_cache.DynamicMemoryUsage() / (1000 * 1000));
5852                }
5853
5854                // Batch write and flush (if we need to) every so often.
5855                //
5856                // If our average Coin size is roughly 41 bytes, checking every 120,000 coins
5857                // means <5MB of memory imprecision.
5858                if (coins_processed % 120000 == 0) {
5859                    if (m_interrupt) {
5860                        return util::Error{Untranslated("Aborting after an interrupt was requested")};
5861                    }
5862
5863                    const auto snapshot_cache_state = WITH_LOCK(::cs_main,
5864                        return snapshot_chainstate.GetCoinsCacheSizeState());
5865
5866                    if (snapshot_cache_state >= CoinsCacheSizeState::CRITICAL) {
5867                        // This is a hack - we don't know what the actual best block is, but that
5868                        // doesn't matter for the purposes of flushing the cache here. We'll set this
5869                        // to its correct value (`base_blockhash`) below after the coins are loaded.
5870                        coins_cache.SetBestBlock(GetRandHash());
5871
5872                        // No need to acquire cs_main since this chainstate isn't being used yet.
5873                        FlushSnapshotToDisk(coins_cache, /*snapshot_loaded=*/false);
5874                    }
5875                }
5876            }
5877        } catch (const std::ios_base::failure&) {
5878            return util::Error{Untranslated(strprintf("Bad snapshot format or truncated snapshot after deserializing %d coins",
5879                      coins_processed))};
5880        }
5881    }
5882
5883    // Important that we set this. This and the coins_cache accesses above are
5884    // sort of a layer violation, but either we reach into the innards of
5885    // CCoinsViewCache here or we have to invert some of the Chainstate to
5886    // embed them in a snapshot-activation-specific CCoinsViewCache bulk load
5887    // method.
5888    coins_cache.SetBestBlock(base_blockhash);
5889
5890    bool out_of_coins{false};
5891    try {
5892        std::byte left_over_byte;
5893        coins_file >> left_over_byte;
5894    } catch (const std::ios_base::failure&) {
5895        // We expect an exception since we should be out of coins.
5896        out_of_coins = true;
5897    }
5898    if (!out_of_coins) {
5899        return util::Error{Untranslated(strprintf("Bad snapshot - coins left over after deserializing %d coins",
5900            coins_count))};
5901    }
5902
5903    LogInfo("[snapshot] loaded %d (%.2f MB) coins from snapshot %s",
5904        coins_count,
5905        coins_cache.DynamicMemoryUsage() / (1000 * 1000),
5906        base_blockhash.ToString());
5907
5908    // No need to acquire cs_main since this chainstate isn't being used yet.
5909    FlushSnapshotToDisk(coins_cache, /*snapshot_loaded=*/true);
5910
5911    assert(coins_cache.GetBestBlock() == base_blockhash);
5912
5913    // As above, okay to immediately release cs_main here since no other context knows
5914    // about the snapshot_chainstate.
5915    const CCoinsViewDB& snapshot_coinsdb = WITH_LOCK(::cs_main, return snapshot_chainstate.CoinsDB());
5916
5917    std::optional<CCoinsStats> maybe_stats;
5918
5919    try {
5920        maybe_stats = ComputeUTXOStats(
5921            CoinStatsHashType::HASH_SERIALIZED, snapshot_coinsdb, m_blockman, [&interrupt = m_interrupt] { SnapshotUTXOHashBreakpoint(interrupt); });
5922    } catch (StopHashingException const&) {
5923        return util::Error{Untranslated("Aborting after an interrupt was requested")};
5924    }
5925    if (!maybe_stats.has_value()) {
5926        return util::Error{Untranslated("Failed to generate coins stats")};
5927    }
5928
5929    // Assert that the deserialized chainstate contents match the expected assumeutxo value.
5930    if (AssumeutxoHash{maybe_stats->hashSerialized} != au_data.hash_serialized) {
5931        return util::Error{Untranslated(strprintf("Bad snapshot content hash: expected %s, got %s",
5932            au_data.hash_serialized.ToString(), maybe_stats->hashSerialized.ToString()))};
5933    }
5934
5935    snapshot_chainstate.m_chain.SetTip(*snapshot_start_block);
5936
5937    // The remainder of this function requires modifying data protected by cs_main.
5938    LOCK(::cs_main);
5939
5940    // Fake various pieces of CBlockIndex state:
5941    CBlockIndex* index = nullptr;
5942
5943    // Don't make any modifications to the genesis block since it shouldn't be
5944    // necessary, and since the genesis block doesn't have normal flags like
5945    // BLOCK_VALID_SCRIPTS set.
5946    constexpr int AFTER_GENESIS_START{1};
5947
5948    for (int i = AFTER_GENESIS_START; i <= snapshot_chainstate.m_chain.Height(); ++i) {
5949        index = snapshot_chainstate.m_chain[i];
5950
5951        // Fake BLOCK_OPT_WITNESS so that Chainstate::NeedsRedownload()
5952        // won't ask for -reindex on startup.
5953        if (DeploymentActiveAt(*index, *this, Consensus::DEPLOYMENT_SEGWIT)) {
5954            index->nStatus |= BLOCK_OPT_WITNESS;
5955        }
5956
5957        m_blockman.m_dirty_blockindex.insert(index);
5958        // Changes to the block index will be flushed to disk after this call
5959        // returns in `ActivateSnapshot()`, when `MaybeRebalanceCaches()` is
5960        // called, since we've added a snapshot chainstate and therefore will
5961        // have to downsize the IBD chainstate, which will result in a call to
5962        // `FlushStateToDisk(FORCE_FLUSH)`.
5963    }
5964
5965    assert(index);
5966    assert(index == snapshot_start_block);
5967    index->m_chain_tx_count = au_data.m_chain_tx_count;
5968
5969    LogInfo("[snapshot] validated snapshot (%.2f MB)",
5970        coins_cache.DynamicMemoryUsage() / (1000 * 1000));
5971    return {};
5972}
5973
5974// Currently, this function holds cs_main for its duration, which could be for
5975// multiple minutes due to the ComputeUTXOStats call. Holding cs_main used to be
5976// necessary (before d43a1f1a2fa3) to avoid advancing validated_cs farther than
5977// its target block. Now it should be possible to avoid this, but simply
5978// releasing cs_main here would not be possible because this function is invoked
5979// by ConnectTip within ActivateBestChain.
5980//
5981// Eventually (TODO) it would be better to call this function outside of
5982// ActivateBestChain, on a separate thread that should not require cs_main to
5983// hash, because the UTXO set is only hashed after the historical chainstate
5984// reaches its target block and is no longer changing.
5985SnapshotCompletionResult ChainstateManager::MaybeValidateSnapshot(Chainstate& validated_cs, Chainstate& unvalidated_cs)
5986{
5987    AssertLockHeld(cs_main);
5988
5989    // If the snapshot does not need to be validated...
5990    if (unvalidated_cs.m_assumeutxo != Assumeutxo::UNVALIDATED ||
5991            // Or if either chainstate is unusable...
5992            !unvalidated_cs.m_from_snapshot_blockhash ||
5993            validated_cs.m_assumeutxo != Assumeutxo::VALIDATED ||
5994            !validated_cs.m_chain.Tip() ||
5995            // Or the validated chainstate is not targeting the snapshot block...
5996            !validated_cs.TargetBlockHash() ||
5997            *validated_cs.TargetBlockHash() != *unvalidated_cs.m_from_snapshot_blockhash ||
5998            // Or the validated chainstate has not reached the snapshot block yet...
5999            !validated_cs.ReachedTarget()) {
6000       // Then the snapshot cannot be validated and there is nothing to do.