slots: incrementally backoff claiming slots if finality lags behind

bin/node/cli/src/service.rs

@@ -238,6 +238,12 @@ pub fn new_full_base(
 		let can_author_with =
 			sp_consensus::CanAuthorWithNativeVersion::new(client.executor().clone());
 
+		let backoff_authoring_blocks = Some(sc_consensus_babe::BackoffAuthoringBlocksParam {
+			max_interval: 100,
+			unfinalized_slack: 5,
+			authoring_bias: 2,
+		});
+
 		let babe_config = sc_consensus_babe::BabeParams {
 			keystore: keystore.clone(),
 			client: client.clone(),
@@ -247,6 +253,7 @@ pub fn new_full_base(
 			sync_oracle: network.clone(),
 			inherent_data_providers: inherent_data_providers.clone(),
 			force_authoring,
+			backoff_authoring_blocks,
 			babe_link,
 			can_author_with,
 		};

client/consensus/babe/src/lib.rs

@@ -86,7 +86,10 @@ use sp_core::{crypto::Public, traits::BareCryptoStore};
 use sp_application_crypto::AppKey;
 use sp_runtime::{
 	generic::{BlockId, OpaqueDigestItemId}, Justification,
-	traits::{Block as BlockT, Header, DigestItemFor, Zero},
+	traits::{
+		Block as BlockT, Header, DigestItemFor, Zero,
+		UniqueSaturatedInto, Saturating,
+	},
 };
 use sp_api::{ProvideRuntimeApi, NumberFor};
 use sc_keystore::KeyStorePtr;
@@ -114,6 +117,7 @@ use log::{debug, info, log, trace, warn};
 use prometheus_endpoint::Registry;
 use sc_consensus_slots::{
 	SlotWorker, SlotInfo, SlotCompatible, StorageChanges, CheckedHeader, check_equivocation,
+	SignedDuration,
 };
 use sc_consensus_epochs::{
 	descendent_query, SharedEpochChanges, EpochChangesFor, Epoch as EpochT, ViableEpochDescriptor,
@@ -353,13 +357,33 @@ pub struct BabeParams<B: BlockT, C, E, I, SO, SC, CAW> {
 	/// Force authoring of blocks even if we are offline
 	pub force_authoring: bool,
 
+	/// Parameters that control BABE's functionality for backing off block production if finality
+	/// starts to lag behind.
+	pub backoff_authoring_blocks: Option<BackoffAuthoringBlocksParam>,
+
 	/// The source of timestamps for relative slots
 	pub babe_link: BabeLink<B>,
 
 	/// Checks if the current native implementation can author with a runtime at a given block.
 	pub can_author_with: CAW,
 }
 
+/// Parameters used by BABE to decide how backoff authoring blocks if the number of unfinalized
+/// blocks grows too large.
+#[derive(Clone)]
+pub struct BackoffAuthoringBlocksParam {
+	/// The max interval to backoff when authoring blocks, regardless of delay in finality.
+	pub max_interval: u32,
+	/// The number of unfinalized blocks allowed before the BABE starts to consider to backoff
+	/// authoring blocks. Note that due to the `authoring_bias` BABE might still wait longer until it
+	/// decides to decline to author a block.
+	pub unfinalized_slack: u32,
+	/// How aggressively BABE should start to decline authoring locks. A small value for
+	/// `authoring_bias` means BABE will quickly start to backoff block authorship as the length of
+	/// the unfinalized blocks grows.
+	pub authoring_bias: u32,
+}
+
 /// Start the babe worker.
 pub fn start_babe<B, C, SC, E, I, SO, CAW, Error>(BabeParams {
 	keystore,
@@ -370,6 +394,7 @@ pub fn start_babe<B, C, SC, E, I, SO, CAW, Error>(BabeParams {
 	sync_oracle,
 	inherent_data_providers,
 	force_authoring,
+	backoff_authoring_blocks,
 	babe_link,
 	can_author_with,
 }: BabeParams<B, C, E, I, SO, SC, CAW>) -> Result<
@@ -398,6 +423,7 @@ pub fn start_babe<B, C, SC, E, I, SO, CAW, Error>(BabeParams {
 		env,
 		sync_oracle: sync_oracle.clone(),
 		force_authoring,
+		backoff_authoring_blocks,
 		keystore,
 		epoch_changes: babe_link.epoch_changes.clone(),
 		slot_notification_sinks: slot_notification_sinks.clone(),
@@ -468,6 +494,7 @@ struct BabeSlotWorker<B: BlockT, C, E, I, SO> {
 	env: E,
 	sync_oracle: SO,
 	force_authoring: bool,
+	backoff_authoring_blocks: Option<BackoffAuthoringBlocksParam>,
 	keystore: KeyStorePtr,
 	epoch_changes: SharedEpochChanges<B, Epoch>,
 	slot_notification_sinks: SlotNotificationSinks<B>,
@@ -683,10 +710,59 @@ impl<B, C, E, I, Error, SO> SlotWorker<B> for BabeSlotWorker<B, C, E, I, SO> whe
 	type OnSlot = Pin<Box<dyn Future<Output = Result<(), sp_consensus::Error>> + Send>>;
 
 	fn on_slot(&mut self, chain_head: B::Header, slot_info: SlotInfo) -> Self::OnSlot {
+		if let Some(ref backoff_param) = self.backoff_authoring_blocks {
+			if let Ok(chain_head_slot) = find_pre_digest::<B>(&chain_head)
+				.map(|digest| digest.slot_number())
+			{
+				if should_backoff_authoring_blocks::<B>(
+					*chain_head.number(),
+					chain_head_slot,
+					self.client.info().finalized_number,
+					SignedDuration::default().slot_now(slot_info.duration),
+					backoff_param,
+				) {
+					return Box::pin(future::ready(Ok(())))
+				}
+			}
+		}
+
 		<Self as sc_consensus_slots::SimpleSlotWorker<B>>::on_slot(self, chain_head, slot_info)
 	}
 }
 
+// The criterion for backing off block authoring when finality is lagging
+fn should_backoff_authoring_blocks<B>(
+	chain_head_number: NumberFor<B>,
+	chain_head_slot: u64,
+	finalized_number: NumberFor<B>,
+	slot_now: u64,
+	param: &BackoffAuthoringBlocksParam,
+) -> bool
+where
+	B: BlockT,
+{
+	let BackoffAuthoringBlocksParam {
+		max_interval,
+		unfinalized_slack,
+		authoring_bias
+	} = param.clone();
+
+	let unfinalized_block_length = chain_head_number - finalized_number;
+	let interval = unfinalized_block_length.saturating_sub(unfinalized_slack.into())
+		/ authoring_bias.into();
+	let interval = interval.min(max_interval.into());
+
+	// We're doing arithmetic between block and slot numbers.
+	let interval = interval.unique_saturated_into();
+
+	if u128::from(slot_now) <= u128::from(chain_head_slot) + interval {
+		info!(target: "babe", "Backing off authoring blocks due to too many unfinalized blocks");
+		true
+	} else {
+		false
+	}
+}
+
 /// Extract the BABE pre digest from the given header. Pre-runtime digests are
 /// mandatory, the function will return `Err` if none is found.
 fn find_pre_digest<B: BlockT>(header: &B::Header) -> Result<PreDigest, Error<B>>
@@ -1518,3 +1594,76 @@ pub mod test_helpers {
 		).map(|(digest, _)| digest)
 	}
 }
+
+#[cfg(test)]
+mod test {
+	use crate::{should_backoff_authoring_blocks, BackoffAuthoringBlocksParam};
+	use substrate_test_runtime_client::runtime::Block;
+
+	struct HeadState {
+		head_number: u64,
+		head_slot: u64,
+		slot_now: u64,
+	}
+
+	impl HeadState {
+		fn author_block(&mut self) {
+			self.head_number += 1;
+			self.head_slot += 1;
+			self.slot_now += 1;
+		}
+
+		fn dont_author_block(&mut self) {
+			self.slot_now += 1;
+		}
+	}
+
+	#[test]
+	fn should_backoff_authoring_when_finality_lags() {
+		let finalized_number = 2u32.into();
+		let param = BackoffAuthoringBlocksParam {
+			max_interval: 100,
+			unfinalized_slack: 5,
+			authoring_bias: 2,
+		};
+
+		let mut head_state = HeadState {
+			head_number: 3,
+			head_slot: 10,
+			slot_now: 11
+		};
+
+		let should_backoff = |head_state: &HeadState| -> bool {
+			should_backoff_authoring_blocks::<Block>(
+				head_state.head_number,
+				head_state.head_slot,
+				finalized_number,
+				head_state.slot_now,
+				&param,
+			)
+		};
+
+		while head_state.slot_now < 17 {
+			assert!(!should_backoff(&head_state));
+			head_state.author_block();
+		}
+
+		// Once the unfinalized head of the chain grows too long we start backing off block
+		// production
+		assert_eq!(head_state.head_number, 9);
+		assert_eq!(head_state.head_slot, 16);
+		assert_eq!(head_state.slot_now, 17);
+		assert!(should_backoff(&head_state));
+		head_state.dont_author_block();
+
+		// But we don't stop entirely
+		while head_state.slot_now < 20 {
+			assert!(!should_backoff(&head_state));
+			head_state.author_block();
+		}
+
+		// Back off again
+		assert!(should_backoff(&head_state));
+	}
+}
+

client/consensus/babe/src/tests.rs

@@ -427,6 +427,7 @@ fn run_one_test(
 			sync_oracle: DummyOracle,
 			inherent_data_providers: data.inherent_data_providers.clone(),
 			force_authoring: false,
+			backoff_authoring_blocks: None,
 			babe_link: data.link.clone(),
 			keystore,
 			can_author_with: sp_consensus::AlwaysCanAuthor,