[AHM] Add Polkadot call filtering

integration-tests/ahm/Cargo.toml

@@ -20,6 +20,8 @@ grandpa = { workspace = true }
 log = { workspace = true, default-features = true }
 pallet-rc-migrator = { workspace = true, default-features = true }
 pallet-ah-migrator = { workspace = true, default-features = true }
+pallet-indices = { workspace = true, default-features = true }
+pallet-message-queue = { workspace = true, default-features = true }
 parachains-common = { workspace = true, default-features = true }
 polkadot-parachain-primitives = { workspace = true, default-features = true }
 polkadot-primitives = { workspace = true, default-features = true }

pallets/rc-migrator/src/lib.rs

@@ -46,7 +46,7 @@ use frame_support::{
 	traits::{
 		fungible::{Inspect, InspectFreeze, Mutate, MutateFreeze, MutateHold},
 		tokens::{Fortitude, Precision, Preservation},
-		Defensive, LockableCurrency, ReservableCurrency,
+		Contains, Defensive, LockableCurrency, ReservableCurrency,
 	},
 	weights::WeightMeter,
 };
@@ -96,7 +96,19 @@ impl<T: Config> From<OutOfWeightError> for Error<T> {
 	}
 }
 
-#[derive(Encode, Decode, Clone, PartialEq, Eq, Default, RuntimeDebug, TypeInfo, MaxEncodedLen)]
+#[derive(
+	Encode,
+	Decode,
+	Clone,
+	PartialEq,
+	Eq,
+	Default,
+	RuntimeDebug,
+	TypeInfo,
+	MaxEncodedLen,
+	PartialOrd,
+	Ord,
+)]
 pub enum MigrationStage<AccountId> {
 	/// The migration has not yet started but will start in the next block.
 	#[default]
@@ -196,6 +208,12 @@ pub mod pallet {
 		type AhWeightInfo: AhWeightInfo;
 		/// The existential deposit on the Asset Hub.
 		type AhExistentialDeposit: Get<<Self as pallet_balances::Config>::Balance>;
+		/// Contains all calls that are allowed during the migration.
+		///
+		/// The calls in here will be available again after the migration.
+		type RcIntraMigrationCalls: Contains<<Self as frame_system::Config>::RuntimeCall>;
+		/// Contains all calls that are allowed after the migration finished.
+		type RcPostMigrationCalls: Contains<<Self as frame_system::Config>::RuntimeCall>;
 	}
 
 	#[pallet::error]
@@ -250,16 +268,6 @@ pub mod pallet {
 	#[pallet::pallet]
 	pub struct Pallet<T>(_);
 
-	#[pallet::call]
-	impl<T: Config> Pallet<T> {
-		/// TODO
-		#[pallet::call_index(0)]
-		#[pallet::weight({1})]
-		pub fn do_something(_origin: OriginFor<T>) -> DispatchResultWithPostInfo {
-			Ok(().into())
-		}
-	}
-
 	#[pallet::hooks]
 	impl<T: Config> Hooks<BlockNumberFor<T>> for Pallet<T> {
 		fn on_initialize(_: BlockNumberFor<T>) -> Weight {
@@ -593,3 +601,25 @@ pub mod pallet {
 		}
 	}
 }
+
+impl<T: Config> Contains<<T as frame_system::Config>::RuntimeCall> for Pallet<T> {
+	fn contains(call: &<T as frame_system::Config>::RuntimeCall) -> bool {
+		let stage = RcMigrationStage::<T>::get();
+		let is_finished = stage >= MigrationStage::MigrationDone;
+		let is_ongoing = stage > MigrationStage::Pending && !is_finished;
+
+		// We have to return whether the call is allowed:
+		const ALLOWED: bool = true;
+		const FORBIDDEN: bool = false;
+
+		if is_finished && !T::RcIntraMigrationCalls::contains(call) {
+			return FORBIDDEN;
+		}
+
+		if is_ongoing && !T::RcPostMigrationCalls::contains(call) {
+			return FORBIDDEN;
+		}
+
+		ALLOWED
+	}
+}

relay/polkadot/src/ah_migration/mod.rs

@@ -0,0 +1,19 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// This file is part of Polkadot.
+
+// Polkadot is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Polkadot is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Polkadot.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Asset Hub Migration.
+
+pub mod phase1;

relay/polkadot/src/ah_migration/phase1.rs

@@ -0,0 +1,131 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// This file is part of Polkadot.
+
+// Polkadot is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Polkadot is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Polkadot.  If not, see <http://www.gnu.org/licenses/>.
+
+//! First phase of the Asset Hub Migration.
+
+use crate::*;
+
+/// Contains all calls that are enabled during the migration.
+pub struct CallsEnabledDuringMigration;
+impl Contains<<Runtime as frame_system::Config>::RuntimeCall> for CallsEnabledDuringMigration {
+	fn contains(call: &<Runtime as frame_system::Config>::RuntimeCall) -> bool {
+		let (during, _after) = call_allowed_status(call);
+		during
+	}
+}
+
+/// Contains all calls that are enabled after the migration.
+pub struct CallsEnabledAfterMigration;
+impl Contains<<Runtime as frame_system::Config>::RuntimeCall> for CallsEnabledAfterMigration {
+	fn contains(call: &<Runtime as frame_system::Config>::RuntimeCall) -> bool {
+		let (_during, after) = call_allowed_status(call);
+		after
+	}
+}
+
+/// Return whether a call should be enabled during and/or after the migration.
+///
+/// Time line of the migration looks like this:
+///
+/// --------|-----------|--------->
+///       Start        End
+///
+/// We now define 2 periods:
+///
+/// 1. During the migration: [Start, End]
+/// 2. After the migration: (End, ∞)
+///
+/// Visually:
+///
+///         |-----1-----|
+///                      |---2---->
+/// --------|-----------|--------->
+///       Start        End
+///
+/// This call returns a 2-tuple to indicate whether a call is enabled during these periods.
+pub fn call_allowed_status(call: &<Runtime as frame_system::Config>::RuntimeCall) -> (bool, bool) {
+	use RuntimeCall::*;
+	const ON: bool = true;
+	const OFF: bool = false;
+
+	match call {
+		System(..) => (ON, ON),
+		Scheduler(..) => (OFF, OFF),
+		Preimage(..) => (OFF, OFF),
+		Babe(..) => (ON, ON), // TODO double check
+		Timestamp(..) => (OFF, OFF),
+		Indices(..) => (OFF, OFF),
+		Balances(..) => (OFF, ON),
+		// TransactionPayment has no calls
+		// Authorship has no calls
+		Staking(..) => (OFF, OFF),
+		// Offences has no calls
+		// Historical has no calls
+		Session(..) => (OFF, OFF),
+		Grandpa(..) => (ON, ON), // TODO double check
+		// AuthorityDiscovery has no calls
+		Treasury(..) => (OFF, OFF),
+		ConvictionVoting(..) => (OFF, OFF),
+		Referenda(..) => (OFF, OFF),
+		// Origins has no calls
+		Whitelist(..) => (OFF, OFF),
+		Claims(..) => (OFF, OFF),
+		Vesting(..) => (OFF, OFF),
+		Utility(..) => (OFF, ON), // batching etc
+		Proxy(..) => (OFF, ON),
+		Multisig(..) => (OFF, ON),
+		Bounties(..) => (OFF, OFF),
+		ChildBounties(..) => (OFF, OFF),
+		ElectionProviderMultiPhase(..) => (OFF, OFF),
+		VoterList(..) => (OFF, OFF),
+		NominationPools(..) => (OFF, OFF),
+		FastUnstake(..) => (OFF, OFF),
+		// DelegatedStaking has on calls
+		// ParachainsOrigin has no calls
+		Configuration(..) => (ON, ON), /* TODO allow this to be called by fellow origin during the migration https://github.com/polkadot-fellows/runtimes/pull/559#discussion_r1928794490 */
+		ParasShared(..) => (OFF, OFF), /* Has no calls but a call enum https://github.com/paritytech/polkadot-sdk/blob/ee803b74056fac5101c06ec5998586fa6eaac470/polkadot/runtime/parachains/src/shared.rs#L185-L186 */
+		ParaInclusion(..) => (OFF, OFF), /* Has no calls but a call enum https://github.com/paritytech/polkadot-sdk/blob/74ec1ee226ace087748f38dfeffc869cd5534ac8/polkadot/runtime/parachains/src/inclusion/mod.rs#L352-L353 */
+		ParaInherent(..) => (ON, ON),    // only inherents
+		// ParaScheduler has no calls
+		Paras(..) => (ON, ON),
+		Initializer(..) => (ON, ON),
+		// Dmp has no calls and deprecated
+		Hrmp(..) => (OFF, OFF),
+		// ParaSessionInfo has no calls
+		ParasDisputes(..) => (OFF, ON), // TODO check with security
+		ParasSlashing(..) => (OFF, ON), // TODO check with security
+		OnDemand(..) => (OFF, ON),
+		// CoretimeAssignmentProvider has no calls
+		Registrar(..) => (OFF, ON),
+		Slots(..) => (OFF, OFF),
+		Auctions(..) => (OFF, OFF),
+		Crowdloan(
+			crowdloan::Call::<Runtime>::dissolve { .. } |
+			crowdloan::Call::<Runtime>::refund { .. } |
+			crowdloan::Call::<Runtime>::dissolve { .. },
+		) => (OFF, ON),
+		Crowdloan(..) => (OFF, OFF),
+		Coretime(coretime::Call::<Runtime>::request_revenue_at { .. }) => (OFF, ON),
+		Coretime(..) => (ON, ON),
+		StateTrieMigration(..) => (OFF, OFF), // Deprecated
+		XcmPallet(..) => (OFF, ON), /* TODO allow para origins and root to call this during the migration, see https://github.com/polkadot-fellows/runtimes/pull/559#discussion_r1928789463 */
+		MessageQueue(..) => (ON, ON), // TODO think about this
+		AssetRate(..) => (OFF, OFF),
+		Beefy(..) => (OFF, ON), /* TODO @claravanstaden @bkontur
+		                         * RcMigrator has no calls currently
+		                         * Exhaustive match. Compiler ensures that we did not miss any. */
+	}
+}

relay/polkadot/src/lib.rs

@@ -50,6 +50,7 @@ use runtime_parachains::{
 	shared as parachains_shared,
 };
 
+use ah_migration::phase1 as ahm_phase1;
 use authority_discovery_primitives::AuthorityId as AuthorityDiscoveryId;
 use beefy_primitives::{
 	ecdsa_crypto::{AuthorityId as BeefyId, Signature as BeefySignature},
@@ -67,7 +68,7 @@ use frame_support::{
 	traits::{
 		fungible::HoldConsideration,
 		tokens::{imbalance::ResolveTo, UnityOrOuterConversion},
-		ConstU32, ConstU8, EitherOf, EitherOfDiverse, Everything, FromContains, Get,
+		ConstU32, ConstU8, Contains, EitherOf, EitherOfDiverse, Everything, FromContains, Get,
 		InstanceFilter, KeyOwnerProofSystem, LinearStoragePrice, OnRuntimeUpgrade, PrivilegeCmp,
 		ProcessMessage, ProcessMessageError, WithdrawReasons,
 	},
@@ -138,6 +139,7 @@ mod bag_thresholds;
 // Genesis preset configurations.
 pub mod genesis_config_presets;
 // Governance configurations.
+pub mod ah_migration;
 pub mod governance;
 use governance::{
 	pallet_custom_origins, AuctionAdmin, FellowshipAdmin, GeneralAdmin, LeaseAdmin, StakingAdmin,
@@ -190,7 +192,7 @@ parameter_types! {
 }
 
 impl frame_system::Config for Runtime {
-	type BaseCallFilter = Everything;
+	type BaseCallFilter = RcMigrator;
 	type BlockWeights = BlockWeights;
 	type BlockLength = BlockLength;
 	type RuntimeOrigin = RuntimeOrigin;
@@ -1576,6 +1578,8 @@ impl pallet_rc_migrator::Config for Runtime {
 	type AhExistentialDeposit = AhExistentialDeposit;
 	type RcWeightInfo = ();
 	type AhWeightInfo = ();
+	type RcPostMigrationCalls = ahm_phase1::CallsEnabledDuringMigration;
+	type RcIntraMigrationCalls = ahm_phase1::CallsEnabledAfterMigration;
 }
 
 construct_runtime! {