PostgreSQL Source Code  git master
postmaster.c
Go to the documentation of this file.
1 /*-------------------------------------------------------------------------
2  *
3  * postmaster.c
4  * This program acts as a clearing house for requests to the
5  * POSTGRES system. Frontend programs send a startup message
6  * to the Postmaster and the postmaster uses the info in the
7  * message to setup a backend process.
8  *
9  * The postmaster also manages system-wide operations such as
10  * startup and shutdown. The postmaster itself doesn't do those
11  * operations, mind you --- it just forks off a subprocess to do them
12  * at the right times. It also takes care of resetting the system
13  * if a backend crashes.
14  *
15  * The postmaster process creates the shared memory and semaphore
16  * pools during startup, but as a rule does not touch them itself.
17  * In particular, it is not a member of the PGPROC array of backends
18  * and so it cannot participate in lock-manager operations. Keeping
19  * the postmaster away from shared memory operations makes it simpler
20  * and more reliable. The postmaster is almost always able to recover
21  * from crashes of individual backends by resetting shared memory;
22  * if it did much with shared memory then it would be prone to crashing
23  * along with the backends.
24  *
25  * When a request message is received, we now fork() immediately.
26  * The child process performs authentication of the request, and
27  * then becomes a backend if successful. This allows the auth code
28  * to be written in a simple single-threaded style (as opposed to the
29  * crufty "poor man's multitasking" code that used to be needed).
30  * More importantly, it ensures that blockages in non-multithreaded
31  * libraries like SSL or PAM cannot cause denial of service to other
32  * clients.
33  *
34  *
35  * Portions Copyright (c) 1996-2020, PostgreSQL Global Development Group
36  * Portions Copyright (c) 1994, Regents of the University of California
37  *
38  *
39  * IDENTIFICATION
40  * src/backend/postmaster/postmaster.c
41  *
42  * NOTES
43  *
44  * Initialization:
45  * The Postmaster sets up shared memory data structures
46  * for the backends.
47  *
48  * Synchronization:
49  * The Postmaster shares memory with the backends but should avoid
50  * touching shared memory, so as not to become stuck if a crashing
51  * backend screws up locks or shared memory. Likewise, the Postmaster
52  * should never block on messages from frontend clients.
53  *
54  * Garbage Collection:
55  * The Postmaster cleans up after backends if they have an emergency
56  * exit and/or core dump.
57  *
58  * Error Reporting:
59  * Use write_stderr() only for reporting "interactive" errors
60  * (essentially, bogus arguments on the command line). Once the
61  * postmaster is launched, use ereport().
62  *
63  *-------------------------------------------------------------------------
64  */
65 
66 #include "postgres.h"
67 
68 #include <unistd.h>
69 #include <signal.h>
70 #include <time.h>
71 #include <sys/wait.h>
72 #include <ctype.h>
73 #include <sys/stat.h>
74 #include <sys/socket.h>
75 #include <fcntl.h>
76 #include <sys/param.h>
77 #include <netdb.h>
78 #include <limits.h>
79 
80 #ifdef HAVE_SYS_SELECT_H
81 #include <sys/select.h>
82 #endif
83 
84 #ifdef USE_BONJOUR
85 #include <dns_sd.h>
86 #endif
87 
88 #ifdef USE_SYSTEMD
89 #include <systemd/sd-daemon.h>
90 #endif
91 
92 #ifdef HAVE_PTHREAD_IS_THREADED_NP
93 #include <pthread.h>
94 #endif
95 
96 #include "access/transam.h"
97 #include "access/xlog.h"
98 #include "bootstrap/bootstrap.h"
99 #include "catalog/pg_control.h"
100 #include "common/file_perm.h"
101 #include "common/ip.h"
102 #include "common/string.h"
103 #include "lib/ilist.h"
104 #include "libpq/auth.h"
105 #include "libpq/libpq.h"
106 #include "libpq/pqformat.h"
107 #include "libpq/pqsignal.h"
108 #include "miscadmin.h"
109 #include "pg_getopt.h"
110 #include "pgstat.h"
111 #include "port/pg_bswap.h"
112 #include "postmaster/autovacuum.h"
113 #include "postmaster/bgworker_internals.h"
114 #include "postmaster/fork_process.h"
115 #include "postmaster/pgarch.h"
116 #include "postmaster/postmaster.h"
117 #include "postmaster/syslogger.h"
118 #include "replication/logicallauncher.h"
119 #include "replication/walsender.h"
120 #include "storage/fd.h"
121 #include "storage/ipc.h"
122 #include "storage/pg_shmem.h"
123 #include "storage/pmsignal.h"
124 #include "storage/proc.h"
125 #include "tcop/tcopprot.h"
126 #include "utils/builtins.h"
127 #include "utils/datetime.h"
128 #include "utils/memutils.h"
129 #include "utils/pidfile.h"
130 #include "utils/ps_status.h"
131 #include "utils/timeout.h"
132 #include "utils/timestamp.h"
133 #include "utils/varlena.h"
134 
135 #ifdef EXEC_BACKEND
136 #include "storage/spin.h"
137 #endif
138 
139 
140 /*
141  * Possible types of a backend. Beyond being the possible bkend_type values in
142  * struct bkend, these are OR-able request flag bits for SignalSomeChildren()
143  * and CountChildren().
144  */
145 #define BACKEND_TYPE_NORMAL 0x0001 /* normal backend */
146 #define BACKEND_TYPE_AUTOVAC 0x0002 /* autovacuum worker process */
147 #define BACKEND_TYPE_WALSND 0x0004 /* walsender process */
148 #define BACKEND_TYPE_BGWORKER 0x0008 /* bgworker process */
149 #define BACKEND_TYPE_ALL 0x000F /* OR of all the above */
150 
151 #define BACKEND_TYPE_WORKER (BACKEND_TYPE_AUTOVAC | BACKEND_TYPE_BGWORKER)
152 
153 /*
154  * List of active backends (or child processes anyway; we don't actually
155  * know whether a given child has become a backend or is still in the
156  * authorization phase). This is used mainly to keep track of how many
157  * children we have and send them appropriate signals when necessary.
158  *
159  * "Special" children such as the startup, bgwriter and autovacuum launcher
160  * tasks are not in this list. Autovacuum worker and walsender are in it.
161  * Also, "dead_end" children are in it: these are children launched just for
162  * the purpose of sending a friendly rejection message to a would-be client.
163  * We must track them because they are attached to shared memory, but we know
164  * they will never become live backends. dead_end children are not assigned a
165  * PMChildSlot.
166  *
167  * Background workers are in this list, too.
168  */
169 typedef struct bkend
170 {
171  pid_t pid; /* process id of backend */
172  int32 cancel_key; /* cancel key for cancels for this backend */
173  int child_slot; /* PMChildSlot for this backend, if any */
174 
175  /*
176  * Flavor of backend or auxiliary process. Note that BACKEND_TYPE_WALSND
177  * backends initially announce themselves as BACKEND_TYPE_NORMAL, so if
178  * bkend_type is normal, you should check for a recent transition.
179  */
180  int bkend_type;
181  bool dead_end; /* is it going to send an error and quit? */
182  bool bgworker_notify; /* gets bgworker start/stop notifications */
183  dlist_node elem; /* list link in BackendList */
184 } Backend;
185 
186 static dlist_head BackendList = DLIST_STATIC_INIT(BackendList);
187 
188 #ifdef EXEC_BACKEND
189 static Backend *ShmemBackendArray;
190 #endif
191 
192 BackgroundWorker *MyBgworkerEntry = NULL;
193 
194 
195 
196 /* The socket number we are listening for connections on */
197 int PostPortNumber;
198 
199 /* The directory names for Unix socket(s) */
200 char *Unix_socket_directories;
201 
202 /* The TCP listen address(es) */
203 char *ListenAddresses;
204 
205 /*
206  * ReservedBackends is the number of backends reserved for superuser use.
207  * This number is taken out of the pool size given by MaxConnections so
208  * number of backend slots available to non-superusers is
209  * (MaxConnections - ReservedBackends). Note what this really means is
210  * "if there are <= ReservedBackends connections available, only superusers
211  * can make new connections" --- pre-existing superuser connections don't
212  * count against the limit.
213  */
214 int ReservedBackends;
215 
216 /* The socket(s) we're listening to. */
217 #define MAXLISTEN 64
218 static pgsocket ListenSocket[MAXLISTEN];
219 
220 /*
221  * Set by the -o option
222  */
223 static char ExtraOptions[MAXPGPATH];
224 
225 /*
226  * These globals control the behavior of the postmaster in case some
227  * backend dumps core. Normally, it kills all peers of the dead backend
228  * and reinitializes shared memory. By specifying -s or -n, we can have
229  * the postmaster stop (rather than kill) peers and not reinitialize
230  * shared data structures. (Reinit is currently dead code, though.)
231  */
232 static bool Reinit = true;
233 static int SendStop = false;
234 
235 /* still more option variables */
236 bool EnableSSL = false;
237 
238 int PreAuthDelay = 0;
239 int AuthenticationTimeout = 60;
240 
241 bool log_hostname; /* for ps display and logging */
242 bool Log_connections = false;
243 bool Db_user_namespace = false;
244 
245 bool enable_bonjour = false;
246 char *bonjour_name;
247 bool restart_after_crash = true;
248 
249 /* PIDs of special child processes; 0 when not running */
250 static pid_t StartupPID = 0,
251  BgWriterPID = 0,
252  CheckpointerPID = 0,
253  WalWriterPID = 0,
254  WalReceiverPID = 0,
255  AutoVacPID = 0,
256  PgArchPID = 0,
257  PgStatPID = 0,
258  SysLoggerPID = 0;
259 
260 /* Startup process's status */
261 typedef enum
262 {
263  STARTUP_NOT_RUNNING,
264  STARTUP_RUNNING,
265  STARTUP_SIGNALED, /* we sent it a SIGQUIT or SIGKILL */
266  STARTUP_CRASHED
267 } StartupStatusEnum;
268 
269 static StartupStatusEnum StartupStatus = STARTUP_NOT_RUNNING;
270 
271 /* Startup/shutdown state */
272 #define NoShutdown 0
273 #define SmartShutdown 1
274 #define FastShutdown 2
275 #define ImmediateShutdown 3
276 
277 static int Shutdown = NoShutdown;
278 
279 static bool FatalError = false; /* T if recovering from backend crash */
280 
281 /*
282  * We use a simple state machine to control startup, shutdown, and
283  * crash recovery (which is rather like shutdown followed by startup).
284  *
285  * After doing all the postmaster initialization work, we enter PM_STARTUP
286  * state and the startup process is launched. The startup process begins by
287  * reading the control file and other preliminary initialization steps.
288  * In a normal startup, or after crash recovery, the startup process exits
289  * with exit code 0 and we switch to PM_RUN state. However, archive recovery
290  * is handled specially since it takes much longer and we would like to support
291  * hot standby during archive recovery.
292  *
293  * When the startup process is ready to start archive recovery, it signals the
294  * postmaster, and we switch to PM_RECOVERY state. The background writer and
295  * checkpointer are launched, while the startup process continues applying WAL.
296  * If Hot Standby is enabled, then, after reaching a consistent point in WAL
297  * redo, startup process signals us again, and we switch to PM_HOT_STANDBY
298  * state and begin accepting connections to perform read-only queries. When
299  * archive recovery is finished, the startup process exits with exit code 0
300  * and we switch to PM_RUN state.
301  *
302  * Normal child backends can only be launched when we are in PM_RUN or
303  * PM_HOT_STANDBY state. (We also allow launch of normal
304  * child backends in PM_WAIT_BACKUP state, but only for superusers.)
305  * In other states we handle connection requests by launching "dead_end"
306  * child processes, which will simply send the client an error message and
307  * quit. (We track these in the BackendList so that we can know when they
308  * are all gone; this is important because they're still connected to shared
309  * memory, and would interfere with an attempt to destroy the shmem segment,
310  * possibly leading to SHMALL failure when we try to make a new one.)
311  * In PM_WAIT_DEAD_END state we are waiting for all the dead_end children
312  * to drain out of the system, and therefore stop accepting connection
313  * requests at all until the last existing child has quit (which hopefully
314  * will not be very long).
315  *
316  * Notice that this state variable does not distinguish *why* we entered
317  * states later than PM_RUN --- Shutdown and FatalError must be consulted
318  * to find that out. FatalError is never true in PM_RECOVERY_* or PM_RUN
319  * states, nor in PM_SHUTDOWN states (because we don't enter those states
320  * when trying to recover from a crash). It can be true in PM_STARTUP state,
321  * because we don't clear it until we've successfully started WAL redo.
322  */
323 typedef enum
324 {
325  PM_INIT, /* postmaster starting */
326  PM_STARTUP, /* waiting for startup subprocess */
327  PM_RECOVERY, /* in archive recovery mode */
328  PM_HOT_STANDBY, /* in hot standby mode */
329  PM_RUN, /* normal "database is alive" state */
330  PM_WAIT_BACKUP, /* waiting for online backup mode to end */
331  PM_WAIT_READONLY, /* waiting for read only backends to exit */
332  PM_WAIT_BACKENDS, /* waiting for live backends to exit */
333  PM_SHUTDOWN, /* waiting for checkpointer to do shutdown
334  * ckpt */
335  PM_SHUTDOWN_2, /* waiting for archiver and walsenders to
336  * finish */
337  PM_WAIT_DEAD_END, /* waiting for dead_end children to exit */
338  PM_NO_CHILDREN /* all important children have exited */
339 } PMState;
340 
341 static PMState pmState = PM_INIT;
342 
343 /* Start time of SIGKILL timeout during immediate shutdown or child crash */
344 /* Zero means timeout is not running */
345 static time_t AbortStartTime = 0;
346 
347 /* Length of said timeout */
348 #define SIGKILL_CHILDREN_AFTER_SECS 5
349 
350 static bool ReachedNormalRunning = false; /* T if we've reached PM_RUN */
351 
352 bool ClientAuthInProgress = false; /* T during new-client
353  * authentication */
354 
355 bool redirection_done = false; /* stderr redirected for syslogger? */
356 
357 /* received START_AUTOVAC_LAUNCHER signal */
358 static volatile sig_atomic_t start_autovac_launcher = false;
359 
360 /* the launcher needs to be signalled to communicate some condition */
361 static volatile bool avlauncher_needs_signal = false;
362 
363 /* received START_WALRECEIVER signal */
364 static volatile sig_atomic_t WalReceiverRequested = false;
365 
366 /* set when there's a worker that needs to be started up */
367 static volatile bool StartWorkerNeeded = true;
368 static volatile bool HaveCrashedWorker = false;
369 
370 #ifdef USE_SSL
371 /* Set when and if SSL has been initialized properly */
372 static bool LoadedSSL = false;
373 #endif
374 
375 #ifdef USE_BONJOUR
376 static DNSServiceRef bonjour_sdref = NULL;
377 #endif
378 
379 /*
380  * postmaster.c - function prototypes
381  */
382 static void CloseServerPorts(int status, Datum arg);
383 static void unlink_external_pid_file(int status, Datum arg);
384 static void getInstallationPaths(const char *argv0);
385 static void checkControlFile(void);
386 static Port *ConnCreate(int serverFd);
387 static void ConnFree(Port *port);
388 static void reset_shared(void);
389 static void SIGHUP_handler(SIGNAL_ARGS);
390 static void pmdie(SIGNAL_ARGS);
391 static void reaper(SIGNAL_ARGS);
392 static void sigusr1_handler(SIGNAL_ARGS);
393 static void startup_die(SIGNAL_ARGS);
394 static void dummy_handler(SIGNAL_ARGS);
395 static void StartupPacketTimeoutHandler(void);
396 static void CleanupBackend(int pid, int exitstatus);
397 static bool CleanupBackgroundWorker(int pid, int exitstatus);
398 static void HandleChildCrash(int pid, int exitstatus, const char *procname);
399 static void LogChildExit(int lev, const char *procname,
400  int pid, int exitstatus);
401 static void PostmasterStateMachine(void);
402 static void BackendInitialize(Port *port);
403 static void BackendRun(Port *port) pg_attribute_noreturn();
404 static void ExitPostmaster(int status) pg_attribute_noreturn();
405 static int ServerLoop(void);
406 static int BackendStartup(Port *port);
407 static int ProcessStartupPacket(Port *port, bool secure_done);
408 static void SendNegotiateProtocolVersion(List *unrecognized_protocol_options);
409 static void processCancelRequest(Port *port, void *pkt);
410 static int initMasks(fd_set *rmask);
411 static void report_fork_failure_to_client(Port *port, int errnum);
412 static CAC_state canAcceptConnections(int backend_type);
413 static bool RandomCancelKey(int32 *cancel_key);
414 static void signal_child(pid_t pid, int signal);
415 static bool SignalSomeChildren(int signal, int targets);
416 static void TerminateChildren(int signal);
417 
418 #define SignalChildren(sig) SignalSomeChildren(sig, BACKEND_TYPE_ALL)
419 
420 static int CountChildren(int target);
421 static bool assign_backendlist_entry(RegisteredBgWorker *rw);
422 static void maybe_start_bgworkers(void);
423 static bool CreateOptsFile(int argc, char *argv[], char *fullprogname);
424 static pid_t StartChildProcess(AuxProcType type);
425 static void StartAutovacuumWorker(void);
426 static void MaybeStartWalReceiver(void);
427 static void InitPostmasterDeathWatchHandle(void);
428 
429 /*
430  * Archiver is allowed to start up at the current postmaster state?
431  *
432  * If WAL archiving is enabled always, we are allowed to start archiver
433  * even during recovery.
434  */
435 #define PgArchStartupAllowed() \
436  ((XLogArchivingActive() && pmState == PM_RUN) || \
437  (XLogArchivingAlways() && \
438  (pmState == PM_RECOVERY || pmState == PM_HOT_STANDBY)))
439 
440 #ifdef EXEC_BACKEND
441 
442 #ifdef WIN32
443 #define WNOHANG 0 /* ignored, so any integer value will do */
444 
445 static pid_t waitpid(pid_t pid, int *exitstatus, int options);
446 static void WINAPI pgwin32_deadchild_callback(PVOID lpParameter, BOOLEAN TimerOrWaitFired);
447 
448 static HANDLE win32ChildQueue;
449 
450 typedef struct
451 {
452  HANDLE waitHandle;
453  HANDLE procHandle;
454  DWORD procId;
455 } win32_deadchild_waitinfo;
456 #endif /* WIN32 */
457 
458 static pid_t backend_forkexec(Port *port);
459 static pid_t internal_forkexec(int argc, char *argv[], Port *port);
460 
461 /* Type for a socket that can be inherited to a client process */
462 #ifdef WIN32
463 typedef struct
464 {
465  SOCKET origsocket; /* Original socket value, or PGINVALID_SOCKET
466  * if not a socket */
467  WSAPROTOCOL_INFO wsainfo;
468 } InheritableSocket;
469 #else
470 typedef int InheritableSocket;
471 #endif
472 
473 /*
474  * Structure contains all variables passed to exec:ed backends
475  */
476 typedef struct
477 {
478  Port port;
479  InheritableSocket portsocket;
480  char DataDir[MAXPGPATH];
481  pgsocket ListenSocket[MAXLISTEN];
482  int32 MyCancelKey;
483  int MyPMChildSlot;
484 #ifndef WIN32
485  unsigned long UsedShmemSegID;
486 #else
487  void *ShmemProtectiveRegion;
488  HANDLE UsedShmemSegID;
489 #endif
490  void *UsedShmemSegAddr;
491  slock_t *ShmemLock;
492  VariableCache ShmemVariableCache;
493  Backend *ShmemBackendArray;
494 #ifndef HAVE_SPINLOCKS
495  PGSemaphore *SpinlockSemaArray;
496 #endif
497  int NamedLWLockTrancheRequests;
498  NamedLWLockTranche *NamedLWLockTrancheArray;
499  LWLockPadded *MainLWLockArray;
500  slock_t *ProcStructLock;
501  PROC_HDR *ProcGlobal;
502  PGPROC *AuxiliaryProcs;
503  PGPROC *PreparedXactProcs;
504  PMSignalData *PMSignalState;
505  InheritableSocket pgStatSock;
506  pid_t PostmasterPid;
507  TimestampTz PgStartTime;
508  TimestampTz PgReloadTime;
509  pg_time_t first_syslogger_file_time;
510  bool redirection_done;
511  bool IsBinaryUpgrade;
512  int max_safe_fds;
513  int MaxBackends;
514 #ifdef WIN32
515  HANDLE PostmasterHandle;
516  HANDLE initial_signal_pipe;
517  HANDLE syslogPipe[2];
518 #else
519  int postmaster_alive_fds[2];
520  int syslogPipe[2];
521 #endif
522  char my_exec_path[MAXPGPATH];
523  char pkglib_path[MAXPGPATH];
524  char ExtraOptions[MAXPGPATH];
525 } BackendParameters;
526 
527 static void read_backend_variables(char *id, Port *port);
528 static void restore_backend_variables(BackendParameters *param, Port *port);
529 
530 #ifndef WIN32
531 static bool save_backend_variables(BackendParameters *param, Port *port);
532 #else
533 static bool save_backend_variables(BackendParameters *param, Port *port,
534  HANDLE childProcess, pid_t childPid);
535 #endif
536 
537 static void ShmemBackendArrayAdd(Backend *bn);
538 static void ShmemBackendArrayRemove(Backend *bn);
539 #endif /* EXEC_BACKEND */
540 
541 #define StartupDataBase() StartChildProcess(StartupProcess)
542 #define StartBackgroundWriter() StartChildProcess(BgWriterProcess)
543 #define StartCheckpointer() StartChildProcess(CheckpointerProcess)
544 #define StartWalWriter() StartChildProcess(WalWriterProcess)
545 #define StartWalReceiver() StartChildProcess(WalReceiverProcess)
546 
547 /* Macros to check exit status of a child process */
548 #define EXIT_STATUS_0(st) ((st) == 0)
549 #define EXIT_STATUS_1(st) (WIFEXITED(st) && WEXITSTATUS(st) == 1)
550 #define EXIT_STATUS_3(st) (WIFEXITED(st) && WEXITSTATUS(st) == 3)
551 
552 #ifndef WIN32
553 /*
554  * File descriptors for pipe used to monitor if postmaster is alive.
555  * First is POSTMASTER_FD_WATCH, second is POSTMASTER_FD_OWN.
556  */
557 int postmaster_alive_fds[2] = {-1, -1};
558 #else
559 /* Process handle of postmaster used for the same purpose on Windows */
560 HANDLE PostmasterHandle;
561 #endif
562 
563 /*
564  * Postmaster main entry point
565  */
566 void
567 PostmasterMain(int argc, char *argv[])
568 {
569  int opt;
570  int status;
571  char *userDoption = NULL;
572  bool listen_addr_saved = false;
573  int i;
574  char *output_config_variable = NULL;
575 
576  InitProcessGlobals();
577 
578  PostmasterPid = MyProcPid;
579 
580  IsPostmasterEnvironment = true;
581 
582  /*
583  * We should not be creating any files or directories before we check the
584  * data directory (see checkDataDir()), but just in case set the umask to
585  * the most restrictive (owner-only) permissions.
586  *
587  * checkDataDir() will reset the umask based on the data directory
588  * permissions.
589  */
590  umask(PG_MODE_MASK_OWNER);
591 
592  /*
593  * By default, palloc() requests in the postmaster will be allocated in
594  * the PostmasterContext, which is space that can be recycled by backends.
595  * Allocated data that needs to be available to backends should be
596  * allocated in TopMemoryContext.
597  */
598  PostmasterContext = AllocSetContextCreate(TopMemoryContext,
599  "Postmaster",
600  ALLOCSET_DEFAULT_SIZES);
601  MemoryContextSwitchTo(PostmasterContext);
602 
603  /* Initialize paths to installation files */
604  getInstallationPaths(argv[0]);
605 
606  /*
607  * Set up signal handlers for the postmaster process.
608  *
609  * In the postmaster, we use pqsignal_pm() rather than pqsignal() (which
610  * is used by all child processes and client processes). That has a
611  * couple of special behaviors:
612  *
613  * 1. Except on Windows, we tell sigaction() to block all signals for the
614  * duration of the signal handler. This is faster than our old approach
615  * of blocking/unblocking explicitly in the signal handler, and it should
616  * also prevent excessive stack consumption if signals arrive quickly.
617  *
618  * 2. We do not set the SA_RESTART flag. This is because signals will be
619  * blocked at all times except when ServerLoop is waiting for something to
620  * happen, and during that window, we want signals to exit the select(2)
621  * wait so that ServerLoop can respond if anything interesting happened.
622  * On some platforms, signals marked SA_RESTART would not cause the
623  * select() wait to end.
624  *
625  * Child processes will generally want SA_RESTART, so pqsignal() sets that
626  * flag. We expect children to set up their own handlers before
627  * unblocking signals.
628  *
629  * CAUTION: when changing this list, check for side-effects on the signal
630  * handling setup of child processes. See tcop/postgres.c,
631  * bootstrap/bootstrap.c, postmaster/bgwriter.c, postmaster/walwriter.c,
632  * postmaster/autovacuum.c, postmaster/pgarch.c, postmaster/pgstat.c,
633  * postmaster/syslogger.c, postmaster/bgworker.c and
634  * postmaster/checkpointer.c.
635  */
636  pqinitmask();
637  PG_SETMASK(&BlockSig);
638 
639  pqsignal_pm(SIGHUP, SIGHUP_handler); /* reread config file and have
640  * children do same */
641  pqsignal_pm(SIGINT, pmdie); /* send SIGTERM and shut down */
642  pqsignal_pm(SIGQUIT, pmdie); /* send SIGQUIT and die */
643  pqsignal_pm(SIGTERM, pmdie); /* wait for children and shut down */
644  pqsignal_pm(SIGALRM, SIG_IGN); /* ignored */
645  pqsignal_pm(SIGPIPE, SIG_IGN); /* ignored */
646  pqsignal_pm(SIGUSR1, sigusr1_handler); /* message from child process */
647  pqsignal_pm(SIGUSR2, dummy_handler); /* unused, reserve for children */
648  pqsignal_pm(SIGCHLD, reaper); /* handle child termination */
649 
650  /*
651  * No other place in Postgres should touch SIGTTIN/SIGTTOU handling. We
652  * ignore those signals in a postmaster environment, so that there is no
653  * risk of a child process freezing up due to writing to stderr. But for
654  * a standalone backend, their default handling is reasonable. Hence, all
655  * child processes should just allow the inherited settings to stand.
656  */
657 #ifdef SIGTTIN
658  pqsignal_pm(SIGTTIN, SIG_IGN); /* ignored */
659 #endif
660 #ifdef SIGTTOU
661  pqsignal_pm(SIGTTOU, SIG_IGN); /* ignored */
662 #endif
663 
664  /* ignore SIGXFSZ, so that ulimit violations work like disk full */
665 #ifdef SIGXFSZ
666  pqsignal_pm(SIGXFSZ, SIG_IGN); /* ignored */
667 #endif
668 
669  /*
670  * Options setup
671  */
672  InitializeGUCOptions();
673 
674  opterr = 1;
675 
676  /*
677  * Parse command-line options. CAUTION: keep this in sync with
678  * tcop/postgres.c (the option sets should not conflict) and with the
679  * common help() function in main/main.c.
680  */
681  while ((opt = getopt(argc, argv, "B:bc:C:D:d:EeFf:h:ijk:lN:nOo:Pp:r:S:sTt:W:-:")) != -1)
682  {
683  switch (opt)
684  {
685  case 'B':
686  SetConfigOption("shared_buffers", optarg, PGC_POSTMASTER, PGC_S_ARGV);
687  break;
688 
689  case 'b':
690  /* Undocumented flag used for binary upgrades */
691  IsBinaryUpgrade = true;
692  break;
693 
694  case 'C':
695  output_config_variable = strdup(optarg);
696  break;
697 
698  case 'D':
699  userDoption = strdup(optarg);
700  break;
701 
702  case 'd':
703  set_debug_options(atoi(optarg), PGC_POSTMASTER, PGC_S_ARGV);
704  break;
705 
706  case 'E':
707  SetConfigOption("log_statement", "all", PGC_POSTMASTER, PGC_S_ARGV);
708  break;
709 
710  case 'e':
711  SetConfigOption("datestyle", "euro", PGC_POSTMASTER, PGC_S_ARGV);
712  break;
713 
714  case 'F':
715  SetConfigOption("fsync", "false", PGC_POSTMASTER, PGC_S_ARGV);
716  break;
717 
718  case 'f':
719  if (!set_plan_disabling_options(optarg, PGC_POSTMASTER, PGC_S_ARGV))
720  {
721  write_stderr("%s: invalid argument for option -f: \"%s\"\n",
722  progname, optarg);
723  ExitPostmaster(1);
724  }
725  break;
726 
727  case 'h':
728  SetConfigOption("listen_addresses", optarg, PGC_POSTMASTER, PGC_S_ARGV);
729  break;
730 
731  case 'i':
732  SetConfigOption("listen_addresses", "*", PGC_POSTMASTER, PGC_S_ARGV);
733  break;
734 
735  case 'j':
736  /* only used by interactive backend */
737  break;
738 
739  case 'k':
740  SetConfigOption("unix_socket_directories", optarg, PGC_POSTMASTER, PGC_S_ARGV);
741  break;
742 
743  case 'l':
744  SetConfigOption("ssl", "true", PGC_POSTMASTER, PGC_S_ARGV);
745  break;
746 
747  case 'N':
748  SetConfigOption("max_connections", optarg, PGC_POSTMASTER, PGC_S_ARGV);
749  break;
750 
751  case 'n':
752  /* Don't reinit shared mem after abnormal exit */
753  Reinit = false;
754  break;
755 
756  case 'O':
757  SetConfigOption("allow_system_table_mods", "true", PGC_POSTMASTER, PGC_S_ARGV);
758  break;
759 
760  case 'o':
761  /* Other options to pass to the backend on the command line */
762  snprintf(ExtraOptions + strlen(ExtraOptions),
763  sizeof(ExtraOptions) - strlen(ExtraOptions),
764  " %s", optarg);
765  break;
766 
767  case 'P':
768  SetConfigOption("ignore_system_indexes", "true", PGC_POSTMASTER, PGC_S_ARGV);
769  break;
770 
771  case 'p':
772  SetConfigOption("port", optarg, PGC_POSTMASTER, PGC_S_ARGV);
773  break;
774 
775  case 'r':
776  /* only used by single-user backend */
777  break;
778 
779  case 'S':
780  SetConfigOption("work_mem", optarg, PGC_POSTMASTER, PGC_S_ARGV);
781  break;
782 
783  case 's':
784  SetConfigOption("log_statement_stats", "true", PGC_POSTMASTER, PGC_S_ARGV);
785  break;
786 
787  case 'T':
788 
789  /*
790  * In the event that some backend dumps core, send SIGSTOP,
791  * rather than SIGQUIT, to all its peers. This lets the wily
792  * post_hacker collect core dumps from everyone.
793  */
794  SendStop = true;
795  break;
796 
797  case 't':
798  {
799  const char *tmp = get_stats_option_name(optarg);
800 
801  if (tmp)
802  {
803  SetConfigOption(tmp, "true", PGC_POSTMASTER, PGC_S_ARGV);
804  }
805  else
806  {
807  write_stderr("%s: invalid argument for option -t: \"%s\"\n",
808  progname, optarg);
809  ExitPostmaster(1);
810  }
811  break;
812  }
813 
814  case 'W':
815  SetConfigOption("post_auth_delay", optarg, PGC_POSTMASTER, PGC_S_ARGV);
816  break;
817 
818  case 'c':
819  case '-':
820  {
821  char *name,
822  *value;
823 
824  ParseLongOption(optarg, &name, &value);
825  if (!value)
826  {
827  if (opt == '-')
828  ereport(ERROR,
829  (errcode(ERRCODE_SYNTAX_ERROR),
830  errmsg("--%s requires a value",
831  optarg)));
832  else
833  ereport(ERROR,
834  (errcode(ERRCODE_SYNTAX_ERROR),
835  errmsg("-c %s requires a value",
836  optarg)));
837  }
838 
839  SetConfigOption(name, value, PGC_POSTMASTER, PGC_S_ARGV);
840  free(name);
841  if (value)
842  free(value);
843  break;
844  }
845 
846  default:
847  write_stderr("Try \"%s --help\" for more information.\n",
848  progname);
849  ExitPostmaster(1);
850  }
851  }
852 
853  /*
854  * Postmaster accepts no non-option switch arguments.
855  */
856  if (optind < argc)
857  {
858  write_stderr("%s: invalid argument: \"%s\"\n",
859  progname, argv[optind]);
860  write_stderr("Try \"%s --help\" for more information.\n",
861  progname);
862  ExitPostmaster(1);
863  }
864 
865  /*
866  * Locate the proper configuration files and data directory, and read
867  * postgresql.conf for the first time.
868  */
869  if (!SelectConfigFiles(userDoption, progname))
870  ExitPostmaster(2);
871 
872  if (output_config_variable != NULL)
873  {
874  /*
875  * "-C guc" was specified, so print GUC's value and exit. No extra
876  * permission check is needed because the user is reading inside the
877  * data dir.
878  */
879  const char *config_val = GetConfigOption(output_config_variable,
880  false, false);
881 
882  puts(config_val ? config_val : "");
883  ExitPostmaster(0);
884  }
885 
886  /* Verify that DataDir looks reasonable */
887  checkDataDir();
888 
889  /* Check that pg_control exists */
890  checkControlFile();
891 
892  /* And switch working directory into it */
893  ChangeToDataDir();
894 
895  /*
896  * Check for invalid combinations of GUC settings.
897  */
898  if (ReservedBackends >= MaxConnections)
899  {
900  write_stderr("%s: superuser_reserved_connections (%d) must be less than max_connections (%d)\n",
901  progname,
902  ReservedBackends, MaxConnections);
903  ExitPostmaster(1);
904  }
905  if (XLogArchiveMode > ARCHIVE_MODE_OFF && wal_level == WAL_LEVEL_MINIMAL)
906  ereport(ERROR,
907  (errmsg("WAL archival cannot be enabled when wal_level is \"minimal\"")));
908  if (max_wal_senders > 0 && wal_level == WAL_LEVEL_MINIMAL)
909  ereport(ERROR,
910  (errmsg("WAL streaming (max_wal_senders > 0) requires wal_level \"replica\" or \"logical\"")));
911 
912  /*
913  * Other one-time internal sanity checks can go here, if they are fast.
914  * (Put any slow processing further down, after postmaster.pid creation.)
915  */
916  if (!CheckDateTokenTables())
917  {
918  write_stderr("%s: invalid datetoken tables, please fix\n", progname);
919  ExitPostmaster(1);
920  }
921 
922  /*
923  * Now that we are done processing the postmaster arguments, reset
924  * getopt(3) library so that it will work correctly in subprocesses.
925  */
926  optind = 1;
927 #ifdef HAVE_INT_OPTRESET
928  optreset = 1; /* some systems need this too */
929 #endif
930 
931  /* For debugging: display postmaster environment */
932  {
933  extern char **environ;
934  char **p;
935 
936  ereport(DEBUG3,
937  (errmsg_internal("%s: PostmasterMain: initial environment dump:",
938  progname)));
939  ereport(DEBUG3,
940  (errmsg_internal("-----------------------------------------")));
941  for (p = environ; *p; ++p)
942  ereport(DEBUG3,
943  (errmsg_internal("\t%s", *p)));
944  ereport(DEBUG3,
945  (errmsg_internal("-----------------------------------------")));
946  }
947 
948  /*
949  * Create lockfile for data directory.
950  *
951  * We want to do this before we try to grab the input sockets, because the
952  * data directory interlock is more reliable than the socket-file
953  * interlock (thanks to whoever decided to put socket files in /tmp :-().
954  * For the same reason, it's best to grab the TCP socket(s) before the
955  * Unix socket(s).
956  *
957  * Also note that this internally sets up the on_proc_exit function that
958  * is responsible for removing both data directory and socket lockfiles;
959  * so it must happen before opening sockets so that at exit, the socket
960  * lockfiles go away after CloseServerPorts runs.
961  */
962  CreateDataDirLockFile(true);
963 
964  /*
965  * Read the control file (for error checking and config info).
966  *
967  * Since we verify the control file's CRC, this has a useful side effect
968  * on machines where we need a run-time test for CRC support instructions.
969  * The postmaster will do the test once at startup, and then its child
970  * processes will inherit the correct function pointer and not need to
971  * repeat the test.
972  */
973  LocalProcessControlFile(false);
974 
975  /*
976  * Initialize SSL library, if specified.
977  */
978 #ifdef USE_SSL
979  if (EnableSSL)
980  {
981  (void) secure_initialize(true);
982  LoadedSSL = true;
983  }
984 #endif
985 
986  /*
987  * Register the apply launcher. Since it registers a background worker,
988  * it needs to be called before InitializeMaxBackends(), and it's probably
989  * a good idea to call it before any modules had chance to take the
990  * background worker slots.
991  */
992  ApplyLauncherRegister();
993 
994  /*
995  * process any libraries that should be preloaded at postmaster start
996  */
997  process_shared_preload_libraries();
998 
999  /*
1000  * Now that loadable modules have had their chance to register background
1001  * workers, calculate MaxBackends.
1002  */
1003  InitializeMaxBackends();
1004 
1005  /*
1006  * Set up shared memory and semaphores.
1007  */
1008  reset_shared();
1009 
1010  /*
1011  * Estimate number of openable files. This must happen after setting up
1012  * semaphores, because on some platforms semaphores count as open files.
1013  */
1014  set_max_safe_fds();
1015 
1016  /*
1017  * Set reference point for stack-depth checking.
1018  */
1019  set_stack_base();
1020 
1021  /*
1022  * Initialize pipe (or process handle on Windows) that allows children to
1023  * wake up from sleep on postmaster death.
1024  */
1025  InitPostmasterDeathWatchHandle();
1026 
1027 #ifdef WIN32
1028 
1029  /*
1030  * Initialize I/O completion port used to deliver list of dead children.
1031  */
1032  win32ChildQueue = CreateIoCompletionPort(INVALID_HANDLE_VALUE, NULL, 0, 1);
1033  if (win32ChildQueue == NULL)
1034  ereport(FATAL,
1035  (errmsg("could not create I/O completion port for child queue")));
1036 #endif
1037 
1038 #ifdef EXEC_BACKEND
1039  /* Write out nondefault GUC settings for child processes to use */
1040  write_nondefault_variables(PGC_POSTMASTER);
1041 
1042  /*
1043  * Clean out the temp directory used to transmit parameters to child
1044  * processes (see internal_forkexec, below). We must do this before
1045  * launching any child processes, else we have a race condition: we could
1046  * remove a parameter file before the child can read it. It should be
1047  * safe to do so now, because we verified earlier that there are no
1048  * conflicting Postgres processes in this data directory.
1049  */
1050  RemovePgTempFilesInDir(PG_TEMP_FILES_DIR, true, false);
1051 #endif
1052 
1053  /*
1054  * Forcibly remove the files signaling a standby promotion request.
1055  * Otherwise, the existence of those files triggers a promotion too early,
1056  * whether a user wants that or not.
1057  *
1058  * This removal of files is usually unnecessary because they can exist
1059  * only during a few moments during a standby promotion. However there is
1060  * a race condition: if pg_ctl promote is executed and creates the files
1061  * during a promotion, the files can stay around even after the server is
1062  * brought up to new master. Then, if new standby starts by using the
1063  * backup taken from that master, the files can exist at the server
1064  * startup and should be removed in order to avoid an unexpected
1065  * promotion.
1066  *
1067  * Note that promotion signal files need to be removed before the startup
1068  * process is invoked. Because, after that, they can be used by
1069  * postmaster's SIGUSR1 signal handler.
1070  */
1071  RemovePromoteSignalFiles();
1072 
1073  /* Do the same for logrotate signal file */
1074  RemoveLogrotateSignalFiles();
1075 
1076  /* Remove any outdated file holding the current log filenames. */
1077  if (unlink(LOG_METAINFO_DATAFILE) < 0 && errno != ENOENT)
1078  ereport(LOG,
1079  (errcode_for_file_access(),
1080  errmsg("could not remove file \"%s\": %m",
1081  LOG_METAINFO_DATAFILE)));
1082 
1083  /*
1084  * If enabled, start up syslogger collection subprocess
1085  */
1086  SysLoggerPID = SysLogger_Start();
1087 
1088  /*
1089  * Reset whereToSendOutput from DestDebug (its starting state) to
1090  * DestNone. This stops ereport from sending log messages to stderr unless
1091  * Log_destination permits. We don't do this until the postmaster is
1092  * fully launched, since startup failures may as well be reported to
1093  * stderr.
1094  *
1095  * If we are in fact disabling logging to stderr, first emit a log message
1096  * saying so, to provide a breadcrumb trail for users who may not remember
1097  * that their logging is configured to go somewhere else.
1098  */
1099  if (!(Log_destination & LOG_DESTINATION_STDERR))
1100  ereport(LOG,
1101  (errmsg("ending log output to stderr"),
1102  errhint("Future log output will go to log destination \"%s\".",
1103  Log_destination_string)));
1104 
1105  whereToSendOutput = DestNone;
1106 
1107  /*
1108  * Report server startup in log. While we could emit this much earlier,
1109  * it seems best to do so after starting the log collector, if we intend
1110  * to use one.
1111  */
1112  ereport(LOG,
1113  (errmsg("starting %s", PG_VERSION_STR)));
1114 
1115  /*
1116  * Establish input sockets.
1117  *
1118  * First, mark them all closed, and set up an on_proc_exit function that's
1119  * charged with closing the sockets again at postmaster shutdown.
1120  */
1121  for (i = 0; i < MAXLISTEN; i++)
1122  ListenSocket[i] = PGINVALID_SOCKET;
1123 
1124  on_proc_exit(CloseServerPorts, 0);
1125 
1126  if (ListenAddresses)
1127  {
1128  char *rawstring;
1129  List *elemlist;
1130  ListCell *l;
1131  int success = 0;
1132 
1133  /* Need a modifiable copy of ListenAddresses */
1134  rawstring = pstrdup(ListenAddresses);
1135 
1136  /* Parse string into list of hostnames */
1137  if (!SplitGUCList(rawstring, ',', &elemlist))
1138  {
1139  /* syntax error in list */
1140  ereport(FATAL,
1141  (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
1142  errmsg("invalid list syntax in parameter \"%s\"",
1143  "listen_addresses")));
1144  }
1145 
1146  foreach(l, elemlist)
1147  {
1148  char *curhost = (char *) lfirst(l);
1149 
1150  if (strcmp(curhost, "*") == 0)
1151  status = StreamServerPort(AF_UNSPEC, NULL,
1152  (unsigned short) PostPortNumber,
1153  NULL,
1154  ListenSocket, MAXLISTEN);
1155  else
1156  status = StreamServerPort(AF_UNSPEC, curhost,
1157  (unsigned short) PostPortNumber,
1158  NULL,
1159  ListenSocket, MAXLISTEN);
1160 
1161  if (status == STATUS_OK)
1162  {
1163  success++;
1164  /* record the first successful host addr in lockfile */
1165  if (!listen_addr_saved)
1166  {
1167  AddToDataDirLockFile(LOCK_FILE_LINE_LISTEN_ADDR, curhost);
1168  listen_addr_saved = true;
1169  }
1170  }
1171  else
1172  ereport(WARNING,
1173  (errmsg("could not create listen socket for \"%s\"",
1174  curhost)));
1175  }
1176 
1177  if (!success && elemlist != NIL)
1178  ereport(FATAL,
1179  (errmsg("could not create any TCP/IP sockets")));
1180 
1181  list_free(elemlist);
1182  pfree(rawstring);
1183  }
1184 
1185 #ifdef USE_BONJOUR
1186  /* Register for Bonjour only if we opened TCP socket(s) */
1187  if (enable_bonjour && ListenSocket[0] != PGINVALID_SOCKET)
1188  {
1189  DNSServiceErrorType err;
1190 
1191  /*
1192  * We pass 0 for interface_index, which will result in registering on
1193  * all "applicable" interfaces. It's not entirely clear from the
1194  * DNS-SD docs whether this would be appropriate if we have bound to
1195  * just a subset of the available network interfaces.
1196  */
1197  err = DNSServiceRegister(&bonjour_sdref,
1198  0,
1199  0,
1200  bonjour_name,
1201  "_postgresql._tcp.",
1202  NULL,
1203  NULL,
1204  pg_hton16(PostPortNumber),
1205  0,
1206  NULL,
1207  NULL,
1208  NULL);
1209  if (err != kDNSServiceErr_NoError)
1210  elog(LOG, "DNSServiceRegister() failed: error code %ld",
1211  (long) err);
1212 
1213  /*
1214  * We don't bother to read the mDNS daemon's reply, and we expect that
1215  * it will automatically terminate our registration when the socket is
1216  * closed at postmaster termination. So there's nothing more to be
1217  * done here. However, the bonjour_sdref is kept around so that
1218  * forked children can close their copies of the socket.
1219  */
1220  }
1221 #endif
1222 
1223 #ifdef HAVE_UNIX_SOCKETS
1224  if (Unix_socket_directories)
1225  {
1226  char *rawstring;
1227  List *elemlist;
1228  ListCell *l;
1229  int success = 0;
1230 
1231  /* Need a modifiable copy of Unix_socket_directories */
1232  rawstring = pstrdup(Unix_socket_directories);
1233 
1234  /* Parse string into list of directories */
1235  if (!SplitDirectoriesString(rawstring, ',', &elemlist))
1236  {
1237  /* syntax error in list */
1238  ereport(FATAL,
1239  (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
1240  errmsg("invalid list syntax in parameter \"%s\"",
1241  "unix_socket_directories")));
1242  }
1243 
1244  foreach(l, elemlist)
1245  {
1246  char *socketdir = (char *) lfirst(l);
1247 
1248  status = StreamServerPort(AF_UNIX, NULL,
1249  (unsigned short) PostPortNumber,
1250  socketdir,
1251  ListenSocket, MAXLISTEN);
1252 
1253  if (status == STATUS_OK)
1254  {
1255  success++;
1256  /* record the first successful Unix socket in lockfile */
1257  if (success == 1)
1258  AddToDataDirLockFile(LOCK_FILE_LINE_SOCKET_DIR, socketdir);
1259  }
1260  else
1261  ereport(WARNING,
1262  (errmsg("could not create Unix-domain socket in directory \"%s\"",
1263  socketdir)));
1264  }
1265 
1266  if (!success && elemlist != NIL)
1267  ereport(FATAL,
1268  (errmsg("could not create any Unix-domain sockets")));
1269 
1270  list_free_deep(elemlist);
1271  pfree(rawstring);
1272  }
1273 #endif
1274 
1275  /*
1276  * check that we have some socket to listen on
1277  */
1278  if (ListenSocket[0] == PGINVALID_SOCKET)
1279  ereport(FATAL,
1280  (errmsg("no socket created for listening")));
1281 
1282  /*
1283  * If no valid TCP ports, write an empty line for listen address,
1284  * indicating the Unix socket must be used. Note that this line is not
1285  * added to the lock file until there is a socket backing it.
1286  */
1287  if (!listen_addr_saved)
1288  AddToDataDirLockFile(LOCK_FILE_LINE_LISTEN_ADDR, "");
1289 
1290  /*
1291  * Record postmaster options. We delay this till now to avoid recording
1292  * bogus options (eg, unusable port number).
1293  */
1294  if (!CreateOptsFile(argc, argv, my_exec_path))
1295  ExitPostmaster(1);
1296 
1297  /*
1298  * Write the external PID file if requested
1299  */
1300  if (external_pid_file)
1301  {
1302  FILE *fpidfile = fopen(external_pid_file, "w");
1303 
1304  if (fpidfile)
1305  {
1306  fprintf(fpidfile, "%d\n", MyProcPid);
1307  fclose(fpidfile);
1308 
1309  /* Make PID file world readable */
1310  if (chmod(external_pid_file, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH) != 0)
1311  write_stderr("%s: could not change permissions of external PID file \"%s\": %s\n",
1312  progname, external_pid_file, strerror(errno));
1313  }
1314  else
1315  write_stderr("%s: could not write external PID file \"%s\": %s\n",
1316  progname, external_pid_file, strerror(errno));
1317 
1318  on_proc_exit(unlink_external_pid_file, 0);
1319  }
1320 
1321  /*
1322  * Remove old temporary files. At this point there can be no other
1323  * Postgres processes running in this directory, so this should be safe.
1324  */
1325  RemovePgTempFiles();
1326 
1327  /*
1328  * Initialize stats collection subsystem (this does NOT start the
1329  * collector process!)
1330  */
1331  pgstat_init();
1332 
1333  /*
1334  * Initialize the autovacuum subsystem (again, no process start yet)
1335  */
1336  autovac_init();
1337 
1338  /*
1339  * Load configuration files for client authentication.
1340  */
1341  if (!load_hba())
1342  {
1343  /*
1344  * It makes no sense to continue if we fail to load the HBA file,
1345  * since there is no way to connect to the database in this case.
1346  */
1347  ereport(FATAL,
1348  (errmsg("could not load pg_hba.conf")));
1349  }
1350  if (!load_ident())
1351  {
1352  /*
1353  * We can start up without the IDENT file, although it means that you
1354  * cannot log in using any of the authentication methods that need a
1355  * user name mapping. load_ident() already logged the details of error
1356  * to the log.
1357  */
1358  }
1359 
1360 #ifdef HAVE_PTHREAD_IS_THREADED_NP
1361 
1362  /*
1363  * On macOS, libintl replaces setlocale() with a version that calls
1364  * CFLocaleCopyCurrent() when its second argument is "" and every relevant
1365  * environment variable is unset or empty. CFLocaleCopyCurrent() makes
1366  * the process multithreaded. The postmaster calls sigprocmask() and
1367  * calls fork() without an immediate exec(), both of which have undefined
1368  * behavior in a multithreaded program. A multithreaded postmaster is the
1369  * normal case on Windows, which offers neither fork() nor sigprocmask().
1370  */
1371  if (pthread_is_threaded_np() != 0)
1372  ereport(FATAL,
1373  (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
1374  errmsg("postmaster became multithreaded during startup"),
1375  errhint("Set the LC_ALL environment variable to a valid locale.")));
1376 #endif
1377 
1378  /*
1379  * Remember postmaster startup time
1380  */
1381  PgStartTime = GetCurrentTimestamp();
1382 
1383  /*
1384  * Report postmaster status in the postmaster.pid file, to allow pg_ctl to
1385  * see what's happening.
1386  */
1387  AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_STARTING);
1388 
1389  /*
1390  * We're ready to rock and roll...
1391  */
1392  StartupPID = StartupDataBase();
1393  Assert(StartupPID != 0);
1394  StartupStatus = STARTUP_RUNNING;
1395  pmState = PM_STARTUP;
1396 
1397  /* Some workers may be scheduled to start now */
1398  maybe_start_bgworkers();
1399 
1400  status = ServerLoop();
1401 
1402  /*
1403  * ServerLoop probably shouldn't ever return, but if it does, close down.
1404  */
1405  ExitPostmaster(status != STATUS_OK);
1406 
1407  abort(); /* not reached */
1408 }
1409 
1410 
1411 /*
1412  * on_proc_exit callback to close server's listen sockets
1413  */
1414 static void
1415 CloseServerPorts(int status, Datum arg)
1416 {
1417  int i;
1418 
1419  /*
1420  * First, explicitly close all the socket FDs. We used to just let this
1421  * happen implicitly at postmaster exit, but it's better to close them
1422  * before we remove the postmaster.pid lockfile; otherwise there's a race
1423  * condition if a new postmaster wants to re-use the TCP port number.
1424  */
1425  for (i = 0; i < MAXLISTEN; i++)
1426  {
1427  if (ListenSocket[i] != PGINVALID_SOCKET)
1428  {
1429  StreamClose(ListenSocket[i]);
1430  ListenSocket[i] = PGINVALID_SOCKET;
1431  }
1432  }
1433 
1434  /*
1435  * Next, remove any filesystem entries for Unix sockets. To avoid race
1436  * conditions against incoming postmasters, this must happen after closing
1437  * the sockets and before removing lock files.
1438  */
1439  RemoveSocketFiles();
1440 
1441  /*
1442  * We don't do anything about socket lock files here; those will be
1443  * removed in a later on_proc_exit callback.
1444  */
1445 }
1446 
1447 /*
1448  * on_proc_exit callback to delete external_pid_file
1449  */
1450 static void
1451 unlink_external_pid_file(int status, Datum arg)
1452 {
1453  if (external_pid_file)
1454  unlink(external_pid_file);
1455 }
1456 
1457 
1458 /*
1459  * Compute and check the directory paths to files that are part of the
1460  * installation (as deduced from the postgres executable's own location)
1461  */
1462 static void
1463 getInstallationPaths(const char *argv0)
1464 {
1465  DIR *pdir;
1466 
1467  /* Locate the postgres executable itself */
1468  if (find_my_exec(argv0, my_exec_path) < 0)
1469  elog(FATAL, "%s: could not locate my own executable path", argv0);
1470 
1471 #ifdef EXEC_BACKEND
1472  /* Locate executable backend before we change working directory */
1473  if (find_other_exec(argv0, "postgres", PG_BACKEND_VERSIONSTR,
1474  postgres_exec_path) < 0)
1475  ereport(FATAL,
1476  (errmsg("%s: could not locate matching postgres executable",
1477  argv0)));
1478 #endif
1479 
1480  /*
1481  * Locate the pkglib directory --- this has to be set early in case we try
1482  * to load any modules from it in response to postgresql.conf entries.
1483  */
1484  get_pkglib_path(my_exec_path, pkglib_path);
1485 
1486  /*
1487  * Verify that there's a readable directory there; otherwise the Postgres
1488  * installation is incomplete or corrupt. (A typical cause of this
1489  * failure is that the postgres executable has been moved or hardlinked to
1490  * some directory that's not a sibling of the installation lib/
1491  * directory.)
1492  */
1493  pdir = AllocateDir(pkglib_path);
1494  if (pdir == NULL)
1495  ereport(ERROR,
1496  (errcode_for_file_access(),
1497  errmsg("could not open directory \"%s\": %m",
1498  pkglib_path),
1499  errhint("This may indicate an incomplete PostgreSQL installation, or that the file \"%s\" has been moved away from its proper location.",
1500  my_exec_path)));
1501  FreeDir(pdir);
1502 
1503  /*
1504  * XXX is it worth similarly checking the share/ directory? If the lib/
1505  * directory is there, then share/ probably is too.
1506  */
1507 }
1508 
1509 /*
1510  * Check that pg_control exists in the correct location in the data directory.
1511  *
1512  * No attempt is made to validate the contents of pg_control here. This is
1513  * just a sanity check to see if we are looking at a real data directory.
1514  */
1515 static void
1516 checkControlFile(void)
1517 {
1518  char path[MAXPGPATH];
1519  FILE *fp;
1520 
1521  snprintf(path, sizeof(path), "%s/global/pg_control", DataDir);
1522 
1523  fp = AllocateFile(path, PG_BINARY_R);
1524  if (fp == NULL)
1525  {
1526  write_stderr("%s: could not find the database system\n"
1527  "Expected to find it in the directory \"%s\",\n"
1528  "but could not open file \"%s\": %s\n",
1529  progname, DataDir, path, strerror(errno));
1530  ExitPostmaster(2);
1531  }
1532  FreeFile(fp);
1533 }
1534 
1535 /*
1536  * Determine how long should we let ServerLoop sleep.
1537  *
1538  * In normal conditions we wait at most one minute, to ensure that the other
1539  * background tasks handled by ServerLoop get done even when no requests are
1540  * arriving. However, if there are background workers waiting to be started,
1541  * we don't actually sleep so that they are quickly serviced. Other exception
1542  * cases are as shown in the code.
1543  */
1544 static void
1545 DetermineSleepTime(struct timeval *timeout)
1546 {
1547  TimestampTz next_wakeup = 0;
1548 
1549  /*
1550  * Normal case: either there are no background workers at all, or we're in
1551  * a shutdown sequence (during which we ignore bgworkers altogether).
1552  */
1553  if (Shutdown > NoShutdown ||
1554  (!StartWorkerNeeded && !HaveCrashedWorker))
1555  {
1556  if (AbortStartTime != 0)
1557  {
1558  /* time left to abort; clamp to 0 in case it already expired */
1559  timeout->tv_sec = SIGKILL_CHILDREN_AFTER_SECS -
1560  (time(NULL) - AbortStartTime);
1561  timeout->tv_sec = Max(timeout->tv_sec, 0);
1562  timeout->tv_usec = 0;
1563  }
1564  else
1565  {
1566  timeout->tv_sec = 60;
1567  timeout->tv_usec = 0;
1568  }
1569  return;
1570  }
1571 
1572  if (StartWorkerNeeded)
1573  {
1574  timeout->tv_sec = 0;
1575  timeout->tv_usec = 0;
1576  return;
1577  }
1578 
1579  if (HaveCrashedWorker)
1580  {
1581  slist_mutable_iter siter;
1582 
1583  /*
1584  * When there are crashed bgworkers, we sleep just long enough that
1585  * they are restarted when they request to be. Scan the list to
1586  * determine the minimum of all wakeup times according to most recent
1587  * crash time and requested restart interval.
1588  */
1589  slist_foreach_modify(siter, &BackgroundWorkerList)
1590  {
1591  RegisteredBgWorker *rw;
1592  TimestampTz this_wakeup;
1593 
1594  rw = slist_container(RegisteredBgWorker, rw_lnode, siter.cur);
1595 
1596  if (rw->rw_crashed_at == 0)
1597  continue;
1598 
1599  if (rw->rw_worker.bgw_restart_time == BGW_NEVER_RESTART
1600  || rw->rw_terminate)
1601  {
1602  ForgetBackgroundWorker(&siter);
1603  continue;
1604  }
1605 
1606  this_wakeup = TimestampTzPlusMilliseconds(rw->rw_crashed_at,
1607  1000L * rw->rw_worker.bgw_restart_time);
1608  if (next_wakeup == 0 || this_wakeup < next_wakeup)
1609  next_wakeup = this_wakeup;
1610  }
1611  }
1612 
1613  if (next_wakeup != 0)
1614  {
1615  long secs;
1616  int microsecs;
1617 
1618  TimestampDifference(GetCurrentTimestamp(), next_wakeup,
1619  &secs, &microsecs);
1620  timeout->tv_sec = secs;
1621  timeout->tv_usec = microsecs;
1622 
1623  /* Ensure we don't exceed one minute */
1624  if (timeout->tv_sec > 60)
1625  {
1626  timeout->tv_sec = 60;
1627  timeout->tv_usec = 0;
1628  }
1629  }
1630  else
1631  {
1632  timeout->tv_sec = 60;
1633  timeout->tv_usec = 0;
1634  }
1635 }
1636 
1637 /*
1638  * Main idle loop of postmaster
1639  *
1640  * NB: Needs to be called with signals blocked
1641  */
1642 static int
1643 ServerLoop(void)
1644 {
1645  fd_set readmask;
1646  int nSockets;
1647  time_t last_lockfile_recheck_time,
1648  last_touch_time;
1649 
1650  last_lockfile_recheck_time = last_touch_time = time(NULL);
1651 
1652  nSockets = initMasks(&readmask);
1653 
1654  for (;;)
1655  {
1656  fd_set rmask;
1657  int selres;
1658  time_t now;
1659 
1660  /*
1661  * Wait for a connection request to arrive.
1662  *
1663  * We block all signals except while sleeping. That makes it safe for
1664  * signal handlers, which again block all signals while executing, to
1665  * do nontrivial work.
1666  *
1667  * If we are in PM_WAIT_DEAD_END state, then we don't want to accept
1668  * any new connections, so we don't call select(), and just sleep.
1669  */
1670  memcpy((char *) &rmask, (char *) &readmask, sizeof(fd_set));
1671 
1672  if (pmState == PM_WAIT_DEAD_END)
1673  {
1674  PG_SETMASK(&UnBlockSig);
1675 
1676  pg_usleep(100000L); /* 100 msec seems reasonable */
1677  selres = 0;
1678 
1679  PG_SETMASK(&BlockSig);
1680  }
1681  else
1682  {
1683  /* must set timeout each time; some OSes change it! */
1684  struct timeval timeout;
1685 
1686  /* Needs to run with blocked signals! */
1687  DetermineSleepTime(&timeout);
1688 
1689  PG_SETMASK(&UnBlockSig);
1690 
1691  selres = select(nSockets, &rmask, NULL, NULL, &timeout);
1692 
1693  PG_SETMASK(&BlockSig);
1694  }
1695 
1696  /* Now check the select() result */
1697  if (selres < 0)
1698  {
1699  if (errno != EINTR && errno != EWOULDBLOCK)
1700  {
1701  ereport(LOG,
1702  (errcode_for_socket_access(),
1703  errmsg("select() failed in postmaster: %m")));
1704  return STATUS_ERROR;
1705  }
1706  }
1707 
1708  /*
1709  * New connection pending on any of our sockets? If so, fork a child
1710  * process to deal with it.
1711  */
1712  if (selres > 0)
1713  {
1714  int i;
1715 
1716  for (i = 0; i < MAXLISTEN; i++)
1717  {
1718  if (ListenSocket[i] == PGINVALID_SOCKET)
1719  break;
1720  if (FD_ISSET(ListenSocket[i], &rmask))
1721  {
1722  Port *port;
1723 
1724  port = ConnCreate(ListenSocket[i]);
1725  if (port)
1726  {
1727  BackendStartup(port);
1728 
1729  /*
1730  * We no longer need the open socket or port structure
1731  * in this process
1732  */
1733  StreamClose(port->sock);
1734  ConnFree(port);
1735  }
1736  }
1737  }
1738  }
1739 
1740  /* If we have lost the log collector, try to start a new one */
1741  if (SysLoggerPID == 0 && Logging_collector)
1742  SysLoggerPID = SysLogger_Start();
1743 
1744  /*
1745  * If no background writer process is running, and we are not in a
1746  * state that prevents it, start one. It doesn't matter if this
1747  * fails, we'll just try again later. Likewise for the checkpointer.
1748  */
1749  if (pmState == PM_RUN || pmState == PM_RECOVERY ||
1750  pmState == PM_HOT_STANDBY)
1751  {
1752  if (CheckpointerPID == 0)
1753  CheckpointerPID = StartCheckpointer();
1754  if (BgWriterPID == 0)
1755  BgWriterPID = StartBackgroundWriter();
1756  }
1757 
1758  /*
1759  * Likewise, if we have lost the walwriter process, try to start a new
1760  * one. But this is needed only in normal operation (else we cannot
1761  * be writing any new WAL).
1762  */
1763  if (WalWriterPID == 0 && pmState == PM_RUN)
1764  WalWriterPID = StartWalWriter();
1765 
1766  /*
1767  * If we have lost the autovacuum launcher, try to start a new one. We
1768  * don't want autovacuum to run in binary upgrade mode because
1769  * autovacuum might update relfrozenxid for empty tables before the
1770  * physical files are put in place.
1771  */
1772  if (!IsBinaryUpgrade && AutoVacPID == 0 &&
1773  (AutoVacuumingActive() || start_autovac_launcher) &&
1774  pmState == PM_RUN)
1775  {
1776  AutoVacPID = StartAutoVacLauncher();
1777  if (AutoVacPID != 0)
1778  start_autovac_launcher = false; /* signal processed */
1779  }
1780 
1781  /* If we have lost the stats collector, try to start a new one */
1782  if (PgStatPID == 0 &&
1783  (pmState == PM_RUN || pmState == PM_HOT_STANDBY))
1784  PgStatPID = pgstat_start();
1785 
1786  /* If we have lost the archiver, try to start a new one. */
1787  if (PgArchPID == 0 && PgArchStartupAllowed())
1788  PgArchPID = pgarch_start();
1789 
1790  /* If we need to signal the autovacuum launcher, do so now */
1791  if (avlauncher_needs_signal)
1792  {
1793  avlauncher_needs_signal = false;
1794  if (AutoVacPID != 0)
1795  kill(AutoVacPID, SIGUSR2);
1796  }
1797 
1798  /* If we need to start a WAL receiver, try to do that now */
1799  if (WalReceiverRequested)
1800  MaybeStartWalReceiver();
1801 
1802  /* Get other worker processes running, if needed */
1803  if (StartWorkerNeeded || HaveCrashedWorker)
1804  maybe_start_bgworkers();
1805 
1806 #ifdef HAVE_PTHREAD_IS_THREADED_NP
1807 
1808  /*
1809  * With assertions enabled, check regularly for appearance of
1810  * additional threads. All builds check at start and exit.
1811  */
1812  Assert(pthread_is_threaded_np() == 0);
1813 #endif
1814 
1815  /*
1816  * Lastly, check to see if it's time to do some things that we don't
1817  * want to do every single time through the loop, because they're a
1818  * bit expensive. Note that there's up to a minute of slop in when
1819  * these tasks will be performed, since DetermineSleepTime() will let
1820  * us sleep at most that long; except for SIGKILL timeout which has
1821  * special-case logic there.
1822  */
1823  now = time(NULL);
1824 
1825  /*
1826  * If we already sent SIGQUIT to children and they are slow to shut
1827  * down, it's time to send them SIGKILL. This doesn't happen
1828  * normally, but under certain conditions backends can get stuck while
1829  * shutting down. This is a last measure to get them unwedged.
1830  *
1831  * Note we also do this during recovery from a process crash.
1832  */
1833  if ((Shutdown >= ImmediateShutdown || (FatalError && !SendStop)) &&
1834  AbortStartTime != 0 &&
1835  (now - AbortStartTime) >= SIGKILL_CHILDREN_AFTER_SECS)
1836  {
1837  /* We were gentle with them before. Not anymore */
1838  TerminateChildren(SIGKILL);
1839  /* reset flag so we don't SIGKILL again */
1840  AbortStartTime = 0;
1841  }
1842 
1843  /*
1844  * Once a minute, verify that postmaster.pid hasn't been removed or
1845  * overwritten. If it has, we force a shutdown. This avoids having
1846  * postmasters and child processes hanging around after their database
1847  * is gone, and maybe causing problems if a new database cluster is
1848  * created in the same place. It also provides some protection
1849  * against a DBA foolishly removing postmaster.pid and manually
1850  * starting a new postmaster. Data corruption is likely to ensue from
1851  * that anyway, but we can minimize the damage by aborting ASAP.
1852  */
1853  if (now - last_lockfile_recheck_time >= 1 * SECS_PER_MINUTE)
1854  {
1855  if (!RecheckDataDirLockFile())
1856  {
1857  ereport(LOG,
1858  (errmsg("performing immediate shutdown because data directory lock file is invalid")));
1859  kill(MyProcPid, SIGQUIT);
1860  }
1861  last_lockfile_recheck_time = now;
1862  }
1863 
1864  /*
1865  * Touch Unix socket and lock files every 58 minutes, to ensure that
1866  * they are not removed by overzealous /tmp-cleaning tasks. We assume
1867  * no one runs cleaners with cutoff times of less than an hour ...
1868  */
1869  if (now - last_touch_time >= 58 * SECS_PER_MINUTE)
1870  {
1871  TouchSocketFiles();
1872  TouchSocketLockFiles();
1873  last_touch_time = now;
1874  }
1875  }
1876 }
1877 
1878 /*
1879  * Initialise the masks for select() for the ports we are listening on.
1880  * Return the number of sockets to listen on.
1881  */
1882 static int
1883 initMasks(fd_set *rmask)
1884 {
1885  int maxsock = -1;
1886  int i;
1887 
1888  FD_ZERO(rmask);
1889 
1890  for (i = 0; i < MAXLISTEN; i++)
1891  {
1892  int fd = ListenSocket[i];
1893 
1894  if (fd == PGINVALID_SOCKET)
1895  break;
1896  FD_SET(fd, rmask);
1897 
1898  if (fd > maxsock)
1899  maxsock = fd;
1900  }
1901 
1902  return maxsock + 1;
1903 }
1904 
1905 
1906 /*
1907  * Read a client's startup packet and do something according to it.
1908  *
1909  * Returns STATUS_OK or STATUS_ERROR, or might call ereport(FATAL) and
1910  * not return at all.
1911  *
1912  * (Note that ereport(FATAL) stuff is sent to the client, so only use it
1913  * if that's what you want. Return STATUS_ERROR if you don't want to
1914  * send anything to the client, which would typically be appropriate
1915  * if we detect a communications failure.)
1916  *
1917  * Set secure_done when negotiation of an encrypted layer (currently, TLS or
1918  * GSSAPI) is already completed.
1919  */
1920 static int
1921 ProcessStartupPacket(Port *port, bool secure_done)
1922 {
1923  int32 len;
1924  void *buf;
1925  ProtocolVersion proto;
1926  MemoryContext oldcontext;
1927 
1928  pq_startmsgread();
1929 
1930  /*
1931  * Grab the first byte of the length word separately, so that we can tell
1932  * whether we have no data at all or an incomplete packet. (This might
1933  * sound inefficient, but it's not really, because of buffering in
1934  * pqcomm.c.)
1935  */
1936  if (pq_getbytes((char *) &len, 1) == EOF)
1937  {
1938  /*
1939  * If we get no data at all, don't clutter the log with a complaint;
1940  * such cases often occur for legitimate reasons. An example is that
1941  * we might be here after responding to NEGOTIATE_SSL_CODE, and if the
1942  * client didn't like our response, it'll probably just drop the
1943  * connection. Service-monitoring software also often just opens and
1944  * closes a connection without sending anything. (So do port
1945  * scanners, which may be less benign, but it's not really our job to
1946  * notice those.)
1947  */
1948  return STATUS_ERROR;
1949  }
1950 
1951  if (pq_getbytes(((char *) &len) + 1, 3) == EOF)
1952  {
1953  /* Got a partial length word, so bleat about that */
1954  if (!secure_done)
1955  ereport(COMMERROR,
1956  (errcode(ERRCODE_PROTOCOL_VIOLATION),
1957  errmsg("incomplete startup packet")));
1958  return STATUS_ERROR;
1959  }
1960 
1961  len = pg_ntoh32(len);
1962  len -= 4;
1963 
1964  if (len < (int32) sizeof(ProtocolVersion) ||
1965  len > MAX_STARTUP_PACKET_LENGTH)
1966  {
1967  ereport(COMMERROR,
1968  (errcode(ERRCODE_PROTOCOL_VIOLATION),
1969  errmsg("invalid length of startup packet")));
1970  return STATUS_ERROR;
1971  }
1972 
1973  /*
1974  * Allocate at least the size of an old-style startup packet, plus one
1975  * extra byte, and make sure all are zeroes. This ensures we will have
1976  * null termination of all strings, in both fixed- and variable-length
1977  * packet layouts.
1978  */
1979  if (len <= (int32) sizeof(StartupPacket))
1980  buf = palloc0(sizeof(StartupPacket) + 1);
1981  else
1982  buf = palloc0(len + 1);
1983 
1984  if (pq_getbytes(buf, len) == EOF)
1985  {
1986  ereport(COMMERROR,
1987  (errcode(ERRCODE_PROTOCOL_VIOLATION),
1988  errmsg("incomplete startup packet")));
1989  return STATUS_ERROR;
1990  }
1991  pq_endmsgread();
1992 
1993  /*
1994  * The first field is either a protocol version number or a special
1995  * request code.
1996  */
1997  port->proto = proto = pg_ntoh32(*((ProtocolVersion *) buf));
1998 
1999  if (proto == CANCEL_REQUEST_CODE)
2000  {
2001  processCancelRequest(port, buf);
2002  /* Not really an error, but we don't want to proceed further */
2003  return STATUS_ERROR;
2004  }
2005 
2006  if (proto == NEGOTIATE_SSL_CODE && !secure_done)
2007  {
2008  char SSLok;
2009 
2010 #ifdef USE_SSL
2011  /* No SSL when disabled or on Unix sockets */
2012  if (!LoadedSSL || IS_AF_UNIX(port->laddr.addr.ss_family))
2013  SSLok = 'N';
2014  else
2015  SSLok = 'S'; /* Support for SSL */
2016 #else
2017  SSLok = 'N'; /* No support for SSL */
2018 #endif
2019 
2020 retry1:
2021  if (send(port->sock, &SSLok, 1, 0) != 1)
2022  {
2023  if (errno == EINTR)
2024  goto retry1; /* if interrupted, just retry */
2025  ereport(COMMERROR,
2026  (errcode_for_socket_access(),
2027  errmsg("failed to send SSL negotiation response: %m")));
2028  return STATUS_ERROR; /* close the connection */
2029  }
2030 
2031 #ifdef USE_SSL
2032  if (SSLok == 'S' && secure_open_server(port) == -1)
2033  return STATUS_ERROR;
2034 #endif
2035  /* regular startup packet, cancel, etc packet should follow... */
2036  /* but not another SSL negotiation request */
2037  return ProcessStartupPacket(port, true);
2038  }
2039  else if (proto == NEGOTIATE_GSS_CODE && !secure_done)
2040  {
2041  char GSSok = 'N';
2042 #ifdef ENABLE_GSS
2043  /* No GSSAPI encryption when on Unix socket */
2044  if (!IS_AF_UNIX(port->laddr.addr.ss_family))
2045  GSSok = 'G';
2046 #endif
2047 
2048  while (send(port->sock, &GSSok, 1, 0) != 1)
2049  {
2050  if (errno == EINTR)
2051  continue;
2052  ereport(COMMERROR,
2053  (errcode_for_socket_access(),
2054  errmsg("failed to send GSSAPI negotiation response: %m")));
2055  return STATUS_ERROR; /* close the connection */
2056  }
2057 
2058 #ifdef ENABLE_GSS
2059  if (GSSok == 'G' && secure_open_gssapi(port) == -1)
2060  return STATUS_ERROR;
2061 #endif
2062  /* Won't ever see more than one negotiation request */
2063  return ProcessStartupPacket(port, true);
2064  }
2065 
2066  /* Could add additional special packet types here */
2067 
2068  /*
2069  * Set FrontendProtocol now so that ereport() knows what format to send if
2070  * we fail during startup.
2071  */
2072  FrontendProtocol = proto;
2073 
2074  /* Check that the major protocol version is in range. */
2075  if (PG_PROTOCOL_MAJOR(proto) < PG_PROTOCOL_MAJOR(PG_PROTOCOL_EARLIEST) ||
2076  PG_PROTOCOL_MAJOR(proto) > PG_PROTOCOL_MAJOR(PG_PROTOCOL_LATEST))
2077  ereport(FATAL,
2078  (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
2079  errmsg("unsupported frontend protocol %u.%u: server supports %u.0 to %u.%u",
2080  PG_PROTOCOL_MAJOR(proto), PG_PROTOCOL_MINOR(proto),
2081  PG_PROTOCOL_MAJOR(PG_PROTOCOL_EARLIEST),
2082  PG_PROTOCOL_MAJOR(PG_PROTOCOL_LATEST),
2083  PG_PROTOCOL_MINOR(PG_PROTOCOL_LATEST))));
2084 
2085  /*
2086  * Now fetch parameters out of startup packet and save them into the Port
2087  * structure. All data structures attached to the Port struct must be
2088  * allocated in TopMemoryContext so that they will remain available in a
2089  * running backend (even after PostmasterContext is destroyed). We need
2090  * not worry about leaking this storage on failure, since we aren't in the
2091  * postmaster process anymore.
2092  */
2093  oldcontext = MemoryContextSwitchTo(TopMemoryContext);
2094 
2095  if (PG_PROTOCOL_MAJOR(proto) >= 3)
2096  {
2097  int32 offset = sizeof(ProtocolVersion);
2098  List *unrecognized_protocol_options = NIL;
2099 
2100  /*
2101  * Scan packet body for name/option pairs. We can assume any string
2102  * beginning within the packet body is null-terminated, thanks to
2103  * zeroing extra byte above.
2104  */
2105  port->guc_options = NIL;
2106 
2107  while (offset < len)
2108  {
2109  char *nameptr = ((char *) buf) + offset;
2110  int32 valoffset;
2111  char *valptr;
2112 
2113  if (*nameptr == '\0')
2114  break; /* found packet terminator */
2115  valoffset = offset + strlen(nameptr) + 1;
2116  if (valoffset >= len)
2117  break; /* missing value, will complain below */
2118  valptr = ((char *) buf) + valoffset;
2119 
2120  if (strcmp(nameptr, "database") == 0)
2121  port->database_name = pstrdup(valptr);
2122  else if (strcmp(nameptr, "user") == 0)
2123  port->user_name = pstrdup(valptr);
2124  else if (strcmp(nameptr, "options") == 0)
2125  port->cmdline_options = pstrdup(valptr);
2126  else if (strcmp(nameptr, "replication") == 0)
2127  {
2128  /*
2129  * Due to backward compatibility concerns the replication
2130  * parameter is a hybrid beast which allows the value to be
2131  * either boolean or the string 'database'. The latter
2132  * connects to a specific database which is e.g. required for
2133  * logical decoding while.
2134  */
2135  if (strcmp(valptr, "database") == 0)
2136  {
2137  am_walsender = true;
2138  am_db_walsender = true;
2139  }
2140  else if (!parse_bool(valptr, &am_walsender))
2141  ereport(FATAL,
2142  (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
2143  errmsg("invalid value for parameter \"%s\": \"%s\"",
2144  "replication",
2145  valptr),
2146  errhint("Valid values are: \"false\", 0, \"true\", 1, \"database\".")));
2147  }
2148  else if (strncmp(nameptr, "_pq_.", 5) == 0)
2149  {
2150  /*
2151  * Any option beginning with _pq_. is reserved for use as a
2152  * protocol-level option, but at present no such options are
2153  * defined.
2154  */
2155  unrecognized_protocol_options =
2156  lappend(unrecognized_protocol_options, pstrdup(nameptr));
2157  }
2158  else
2159  {
2160  /* Assume it's a generic GUC option */
2161  port->guc_options = lappend(port->guc_options,
2162  pstrdup(nameptr));
2163  port->guc_options = lappend(port->guc_options,
2164  pstrdup(valptr));
2165 
2166  /*
2167  * Copy application_name to port if we come across it. This
2168  * is done so we can log the application_name in the
2169  * connection authorization message. Note that the GUC would
2170  * be used but we haven't gone through GUC setup yet.
2171  */
2172  if (strcmp(nameptr, "application_name") == 0)
2173  {
2174  char *tmp_app_name = pstrdup(valptr);
2175 
2176  pg_clean_ascii(tmp_app_name);
2177 
2178  port->application_name = tmp_app_name;
2179  }
2180  }
2181  offset = valoffset + strlen(valptr) + 1;
2182  }
2183 
2184  /*
2185  * If we didn't find a packet terminator exactly at the end of the
2186  * given packet length, complain.
2187  */
2188  if (offset != len - 1)
2189  ereport(FATAL,
2190  (errcode(ERRCODE_PROTOCOL_VIOLATION),
2191  errmsg("invalid startup packet layout: expected terminator as last byte")));
2192 
2193  /*
2194  * If the client requested a newer protocol version or if the client
2195  * requested any protocol options we didn't recognize, let them know
2196  * the newest minor protocol version we do support and the names of
2197  * any unrecognized options.
2198  */
2199  if (PG_PROTOCOL_MINOR(proto) > PG_PROTOCOL_MINOR(PG_PROTOCOL_LATEST) ||
2200  unrecognized_protocol_options != NIL)
2201  SendNegotiateProtocolVersion(unrecognized_protocol_options);
2202  }
2203  else
2204  {
2205  /*
2206  * Get the parameters from the old-style, fixed-width-fields startup
2207  * packet as C strings. The packet destination was cleared first so a
2208  * short packet has zeros silently added. We have to be prepared to
2209  * truncate the pstrdup result for oversize fields, though.
2210  */
2211  StartupPacket *packet = (StartupPacket *) buf;
2212 
2213  port->database_name = pstrdup(packet->database);
2214  if (strlen(port->database_name) > sizeof(packet->database))
2215  port->database_name[sizeof(packet->database)] = '\0';
2216  port->user_name = pstrdup(packet->user);
2217  if (strlen(port->user_name) > sizeof(packet->user))
2218  port->user_name[sizeof(packet->user)] = '\0';
2219  port->cmdline_options = pstrdup(packet->options);
2220  if (strlen(port->cmdline_options) > sizeof(packet->options))
2221  port->cmdline_options[sizeof(packet->options)] = '\0';
2222  port->guc_options = NIL;
2223  }
2224 
2225  /* Check a user name was given. */
2226  if (port->user_name == NULL || port->user_name[0] == '\0')
2227  ereport(FATAL,
2228  (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
2229  errmsg("no PostgreSQL user name specified in startup packet")));
2230 
2231  /* The database defaults to the user name. */
2232  if (port->database_name == NULL || port->database_name[0] == '\0')
2233  port->database_name = pstrdup(port->user_name);
2234 
2235  if (Db_user_namespace)
2236  {
2237  /*
2238  * If user@, it is a global user, remove '@'. We only want to do this
2239  * if there is an '@' at the end and no earlier in the user string or
2240  * they may fake as a local user of another database attaching to this
2241  * database.
2242  */
2243  if (strchr(port->user_name, '@') ==
2244  port->user_name + strlen(port->user_name) - 1)
2245  *strchr(port->user_name, '@') = '\0';
2246  else
2247  {
2248  /* Append '@' and dbname */
2249  port->user_name = psprintf("%s@%s", port->user_name, port->database_name);
2250  }
2251  }
2252 
2253  /*
2254  * Truncate given database and user names to length of a Postgres name.
2255  * This avoids lookup failures when overlength names are given.
2256  */
2257  if (strlen(port->database_name) >= NAMEDATALEN)
2258  port->database_name[NAMEDATALEN - 1] = '\0';
2259  if (strlen(port->user_name) >= NAMEDATALEN)
2260  port->user_name[NAMEDATALEN - 1] = '\0';
2261 
2262  /*
2263  * Normal walsender backends, e.g. for streaming replication, are not
2264  * connected to a particular database. But walsenders used for logical
2265  * replication need to connect to a specific database. We allow streaming
2266  * replication commands to be issued even if connected to a database as it
2267  * can make sense to first make a basebackup and then stream changes
2268  * starting from that.
2269  */
2270  if (am_walsender && !am_db_walsender)
2271  port->database_name[0] = '\0';
2272 
2273  /*
2274  * Done putting stuff in TopMemoryContext.
2275  */
2276  MemoryContextSwitchTo(oldcontext);
2277 
2278  /*
2279  * If we're going to reject the connection due to database state, say so
2280  * now instead of wasting cycles on an authentication exchange. (This also
2281  * allows a pg_ping utility to be written.)
2282  */
2283  switch (port->canAcceptConnections)
2284  {
2285  case CAC_STARTUP:
2286  ereport(FATAL,
2287  (errcode(ERRCODE_CANNOT_CONNECT_NOW),
2288  errmsg("the database system is starting up")));
2289  break;
2290  case CAC_SHUTDOWN:
2291  ereport(FATAL,
2292  (errcode(ERRCODE_CANNOT_CONNECT_NOW),
2293  errmsg("the database system is shutting down")));
2294  break;
2295  case CAC_RECOVERY:
2296  ereport(FATAL,
2297  (errcode(ERRCODE_CANNOT_CONNECT_NOW),
2298  errmsg("the database system is in recovery mode")));
2299  break;
2300  case CAC_TOOMANY:
2301  ereport(FATAL,
2302  (errcode(ERRCODE_TOO_MANY_CONNECTIONS),
2303  errmsg("sorry, too many clients already")));
2304  break;
2305  case CAC_WAITBACKUP:
2306  /* OK for now, will check in InitPostgres */
2307  break;
2308  case CAC_OK:
2309  break;
2310  }
2311 
2312  return STATUS_OK;
2313 }
2314 
2315 /*
2316  * Send a NegotiateProtocolVersion to the client. This lets the client know
2317  * that they have requested a newer minor protocol version than we are able
2318  * to speak. We'll speak the highest version we know about; the client can,
2319  * of course, abandon the connection if that's a problem.
2320  *
2321  * We also include in the response a list of protocol options we didn't
2322  * understand. This allows clients to include optional parameters that might
2323  * be present either in newer protocol versions or third-party protocol
2324  * extensions without fear of having to reconnect if those options are not
2325  * understood, while at the same time making certain that the client is aware
2326  * of which options were actually accepted.
2327  */
2328 static void
2329 SendNegotiateProtocolVersion(List *unrecognized_protocol_options)
2330 {
2331  StringInfoData buf;
2332  ListCell *lc;
2333 
2334  pq_beginmessage(&buf, 'v'); /* NegotiateProtocolVersion */
2335  pq_sendint32(&buf, PG_PROTOCOL_LATEST);
2336  pq_sendint32(&buf, list_length(unrecognized_protocol_options));
2337  foreach(lc, unrecognized_protocol_options)
2338  pq_sendstring(&buf, lfirst(lc));
2339  pq_endmessage(&buf);
2340 
2341  /* no need to flush, some other message will follow */
2342 }
2343 
2344 /*
2345  * The client has sent a cancel request packet, not a normal
2346  * start-a-new-connection packet. Perform the necessary processing.
2347  * Nothing is sent back to the client.
2348  */
2349 static void
2350 processCancelRequest(Port *port, void *pkt)
2351 {
2352  CancelRequestPacket *canc = (CancelRequestPacket *) pkt;
2353  int backendPID;
2354  int32 cancelAuthCode;
2355  Backend *bp;
2356 
2357 #ifndef EXEC_BACKEND
2358  dlist_iter iter;
2359 #else
2360  int i;
2361 #endif
2362 
2363  backendPID = (int) pg_ntoh32(canc->backendPID);
2364  cancelAuthCode = (int32) pg_ntoh32(canc->cancelAuthCode);
2365 
2366  /*
2367  * See if we have a matching backend. In the EXEC_BACKEND case, we can no
2368  * longer access the postmaster's own backend list, and must rely on the
2369  * duplicate array in shared memory.
2370  */
2371 #ifndef EXEC_BACKEND
2372  dlist_foreach(iter, &BackendList)
2373  {
2374  bp = dlist_container(Backend, elem, iter.cur);
2375 #else
2376  for (i = MaxLivePostmasterChildren() - 1; i >= 0; i--)
2377  {
2378  bp = (Backend *) &ShmemBackendArray[i];
2379 #endif
2380  if (bp->pid == backendPID)
2381  {
2382  if (bp->cancel_key == cancelAuthCode)
2383  {
2384  /* Found a match; signal that backend to cancel current op */
2385  ereport(DEBUG2,
2386  (errmsg_internal("processing cancel request: sending SIGINT to process %d",
2387  backendPID)));
2388  signal_child(bp->pid, SIGINT);
2389  }
2390  else
2391  /* Right PID, wrong key: no way, Jose */
2392  ereport(LOG,
2393  (errmsg("wrong key in cancel request for process %d",
2394  backendPID)));
2395  return;
2396  }
2397 #ifndef EXEC_BACKEND /* make GNU Emacs 26.1 see brace balance */
2398  }
2399 #else
2400  }
2401 #endif
2402 
2403  /* No matching backend */
2404  ereport(LOG,
2405  (errmsg("PID %d in cancel request did not match any process",
2406  backendPID)));
2407 }
2408 
2409 /*
2410  * canAcceptConnections --- check to see if database state allows connections
2411  * of the specified type. backend_type can be BACKEND_TYPE_NORMAL,
2412  * BACKEND_TYPE_AUTOVAC, or BACKEND_TYPE_BGWORKER. (Note that we don't yet
2413  * know whether a NORMAL connection might turn into a walsender.)
2414  */
2415 static CAC_state
2416 canAcceptConnections(int backend_type)
2417 {
2418  CAC_state result = CAC_OK;
2419 
2420  /*
2421  * Can't start backends when in startup/shutdown/inconsistent recovery
2422  * state. We treat autovac workers the same as user backends for this
2423  * purpose. However, bgworkers are excluded from this test; we expect
2424  * bgworker_should_start_now() decided whether the DB state allows them.
2425  *
2426  * In state PM_WAIT_BACKUP only superusers can connect (this must be
2427  * allowed so that a superuser can end online backup mode); we return
2428  * CAC_WAITBACKUP code to indicate that this must be checked later. Note
2429  * that neither CAC_OK nor CAC_WAITBACKUP can safely be returned until we
2430  * have checked for too many children.
2431  */
2432  if (pmState != PM_RUN &&
2433  backend_type != BACKEND_TYPE_BGWORKER)
2434  {
2435  if (pmState == PM_WAIT_BACKUP)
2436  result = CAC_WAITBACKUP; /* allow superusers only */
2437  else if (Shutdown > NoShutdown)
2438  return CAC_SHUTDOWN; /* shutdown is pending */
2439  else if (!FatalError &&
2440  (pmState == PM_STARTUP ||
2441  pmState == PM_RECOVERY))
2442  return CAC_STARTUP; /* normal startup */
2443  else if (!FatalError &&
2444  pmState == PM_HOT_STANDBY)
2445  result = CAC_OK; /* connection OK during hot standby */
2446  else
2447  return CAC_RECOVERY; /* else must be crash recovery */
2448  }
2449 
2450  /*
2451  * Don't start too many children.
2452  *
2453  * We allow more connections here than we can have backends because some
2454  * might still be authenticating; they might fail auth, or some existing
2455  * backend might exit before the auth cycle is completed. The exact
2456  * MaxBackends limit is enforced when a new backend tries to join the
2457  * shared-inval backend array.
2458  *
2459  * The limit here must match the sizes of the per-child-process arrays;
2460  * see comments for MaxLivePostmasterChildren().
2461  */
2462  if (CountChildren(BACKEND_TYPE_ALL) >= MaxLivePostmasterChildren())
2463  result = CAC_TOOMANY;
2464 
2465  return result;
2466 }
2467 
2468 
2469 /*
2470  * ConnCreate -- create a local connection data structure
2471  *
2472  * Returns NULL on failure, other than out-of-memory which is fatal.
2473  */
2474 static Port *
2475 ConnCreate(int serverFd)
2476 {
2477  Port *port;
2478 
2479  if (!(port = (Port *) calloc(1, sizeof(Port))))
2480  {
2481  ereport(LOG,
2482  (errcode(ERRCODE_OUT_OF_MEMORY),
2483  errmsg("out of memory")));
2484  ExitPostmaster(1);
2485  }
2486 
2487  if (StreamConnection(serverFd, port) != STATUS_OK)
2488  {
2489  if (port->sock != PGINVALID_SOCKET)
2490  StreamClose(port->sock);
2491  ConnFree(port);
2492  return NULL;
2493  }
2494 
2495  /*
2496  * Allocate GSSAPI specific state struct
2497  */
2498 #ifndef EXEC_BACKEND
2499 #if defined(ENABLE_GSS) || defined(ENABLE_SSPI)
2500  port->gss = (pg_gssinfo *) calloc(1, sizeof(pg_gssinfo));
2501  if (!port->gss)
2502  {
2503  ereport(LOG,
2504  (errcode(ERRCODE_OUT_OF_MEMORY),
2505  errmsg("out of memory")));
2506  ExitPostmaster(1);
2507  }
2508 #endif
2509 #endif
2510 
2511  return port;
2512 }
2513 
2514 
2515 /*
2516  * ConnFree -- free a local connection data structure
2517  */
2518 static void
2519 ConnFree(Port *conn)
2520 {
2521 #ifdef USE_SSL
2522  secure_close(conn);
2523 #endif
2524  if (conn->gss)
2525  free(conn->gss);
2526  free(conn);
2527 }
2528 
2529 
2530 /*
2531  * ClosePostmasterPorts -- close all the postmaster's open sockets
2532  *
2533  * This is called during child process startup to release file descriptors
2534  * that are not needed by that child process. The postmaster still has
2535  * them open, of course.
2536  *
2537  * Note: we pass am_syslogger as a boolean because we don't want to set
2538  * the global variable yet when this is called.
2539  */
2540 void
2541 ClosePostmasterPorts(bool am_syslogger)
2542 {
2543  int i;
2544 
2545 #ifndef WIN32
2546 
2547  /*
2548  * Close the write end of postmaster death watch pipe. It's important to
2549  * do this as early as possible, so that if postmaster dies, others won't
2550  * think that it's still running because we're holding the pipe open.
2551  */
2552  if (close(postmaster_alive_fds[POSTMASTER_FD_OWN]) != 0)
2553  ereport(FATAL,
2554  (errcode_for_file_access(),
2555  errmsg_internal("could not close postmaster death monitoring pipe in child process: %m")));
2556  postmaster_alive_fds[POSTMASTER_FD_OWN] = -1;
2557 #endif
2558 
2559  /* Close the listen sockets */
2560  for (i = 0; i < MAXLISTEN; i++)
2561  {
2562  if (ListenSocket[i] != PGINVALID_SOCKET)
2563  {
2564  StreamClose(ListenSocket[i]);
2565  ListenSocket[i] = PGINVALID_SOCKET;
2566  }
2567  }
2568 
2569  /* If using syslogger, close the read side of the pipe */
2570  if (!am_syslogger)
2571  {
2572 #ifndef WIN32
2573  if (syslogPipe[0] >= 0)
2574  close(syslogPipe[0]);
2575  syslogPipe[0] = -1;
2576 #else
2577  if (syslogPipe[0])
2578  CloseHandle(syslogPipe[0]);
2579  syslogPipe[0] = 0;
2580 #endif
2581  }
2582 
2583 #ifdef USE_BONJOUR
2584  /* If using Bonjour, close the connection to the mDNS daemon */
2585  if (bonjour_sdref)
2586  close(DNSServiceRefSockFD(bonjour_sdref));
2587 #endif
2588 }
2589 
2590 
2591 /*
2592  * InitProcessGlobals -- set MyProcPid, MyStartTime[stamp], random seeds
2593  *
2594  * Called early in the postmaster and every backend.
2595  */
2596 void
2597 InitProcessGlobals(void)
2598 {
2599  unsigned int rseed;
2600 
2601  MyProcPid = getpid();
2602  MyStartTimestamp = GetCurrentTimestamp();
2603  MyStartTime = timestamptz_to_time_t(MyStartTimestamp);
2604 
2605  /*
2606  * Set a different seed for random() in every process. We want something
2607  * unpredictable, so if possible, use high-quality random bits for the
2608  * seed. Otherwise, fall back to a seed based on timestamp and PID.
2609  */
2610  if (!pg_strong_random(&rseed, sizeof(rseed)))
2611  {
2612  /*
2613  * Since PIDs and timestamps tend to change more frequently in their
2614  * least significant bits, shift the timestamp left to allow a larger
2615  * total number of seeds in a given time period. Since that would
2616  * leave only 20 bits of the timestamp that cycle every ~1 second,
2617  * also mix in some higher bits.
2618  */
2619  rseed = ((uint64) MyProcPid) ^
2620  ((uint64) MyStartTimestamp << 12) ^
2621  ((uint64) MyStartTimestamp >> 20);
2622  }
2623  srandom(rseed);
2624 }
2625 
2626 
2627 /*
2628  * reset_shared -- reset shared memory and semaphores
2629  */
2630 static void
2631 reset_shared(void)
2632 {
2633  /*
2634  * Create or re-create shared memory and semaphores.
2635  *
2636  * Note: in each "cycle of life" we will normally assign the same IPC keys
2637  * (if using SysV shmem and/or semas). This helps ensure that we will
2638  * clean up dead IPC objects if the postmaster crashes and is restarted.
2639  */
2640  CreateSharedMemoryAndSemaphores();
2641 }
2642 
2643 
2644 /*
2645  * SIGHUP -- reread config files, and tell children to do same
2646  */
2647 static void
2648 SIGHUP_handler(SIGNAL_ARGS)
2649 {
2650  int save_errno = errno;
2651 
2652  /*
2653  * We rely on the signal mechanism to have blocked all signals ... except
2654  * on Windows, which lacks sigaction(), so we have to do it manually.
2655  */
2656 #ifdef WIN32
2657  PG_SETMASK(&BlockSig);
2658 #endif
2659 
2660  if (Shutdown <= SmartShutdown)
2661  {
2662  ereport(LOG,
2663  (errmsg("received SIGHUP, reloading configuration files")));
2664  ProcessConfigFile(PGC_SIGHUP);
2665  SignalChildren(SIGHUP);
2666  if (StartupPID != 0)
2667  signal_child(StartupPID, SIGHUP);
2668  if (BgWriterPID != 0)
2669  signal_child(BgWriterPID, SIGHUP);
2670  if (CheckpointerPID != 0)
2671  signal_child(CheckpointerPID, SIGHUP);
2672  if (WalWriterPID != 0)
2673  signal_child(WalWriterPID, SIGHUP);
2674  if (WalReceiverPID != 0)
2675  signal_child(WalReceiverPID, SIGHUP);
2676  if (AutoVacPID != 0)
2677  signal_child(AutoVacPID, SIGHUP);
2678  if (PgArchPID != 0)
2679  signal_child(PgArchPID, SIGHUP);
2680  if (SysLoggerPID != 0)
2681  signal_child(SysLoggerPID, SIGHUP);
2682  if (PgStatPID != 0)
2683  signal_child(PgStatPID, SIGHUP);
2684 
2685  /* Reload authentication config files too */
2686  if (!load_hba())
2687  ereport(LOG,
2688  /* translator: %s is a configuration file */
2689  (errmsg("%s was not reloaded", "pg_hba.conf")));
2690 
2691  if (!load_ident())
2692  ereport(LOG,
2693  (errmsg("%s was not reloaded", "pg_ident.conf")));
2694 
2695 #ifdef USE_SSL
2696  /* Reload SSL configuration as well */
2697  if (EnableSSL)
2698  {
2699  if (secure_initialize(false) == 0)
2700  LoadedSSL = true;
2701  else
2702  ereport(LOG,
2703  (errmsg("SSL configuration was not reloaded")));
2704  }
2705  else
2706  {
2707  secure_destroy();
2708  LoadedSSL = false;
2709  }
2710 #endif
2711 
2712 #ifdef EXEC_BACKEND
2713  /* Update the starting-point file for future children */
2714  write_nondefault_variables(PGC_SIGHUP);
2715 #endif
2716  }
2717 
2718 #ifdef WIN32
2719  PG_SETMASK(&UnBlockSig);
2720 #endif
2721 
2722  errno = save_errno;
2723 }
2724 
2725 
2726 /*
2727  * pmdie -- signal handler for processing various postmaster signals.
2728  */
2729 static void
2730 pmdie(SIGNAL_ARGS)
2731 {
2732  int save_errno = errno;
2733 
2734  /*
2735  * We rely on the signal mechanism to have blocked all signals ... except
2736  * on Windows, which lacks sigaction(), so we have to do it manually.
2737  */
2738 #ifdef WIN32
2739  PG_SETMASK(&BlockSig);
2740 #endif
2741 
2742  ereport(DEBUG2,
2743  (errmsg_internal("postmaster received signal %d",
2744  postgres_signal_arg)));
2745 
2746  switch (postgres_signal_arg)
2747  {
2748  case SIGTERM:
2749 
2750  /*
2751  * Smart Shutdown:
2752  *
2753  * Wait for children to end their work, then shut down.
2754  */
2755  if (Shutdown >= SmartShutdown)
2756  break;
2757  Shutdown = SmartShutdown;
2758  ereport(LOG,
2759  (errmsg("received smart shutdown request")));
2760 
2761  /* Report status */
2762  AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_STOPPING);
2763 #ifdef USE_SYSTEMD
2764  sd_notify(0, "STOPPING=1");
2765 #endif
2766 
2767  if (pmState == PM_RUN || pmState == PM_RECOVERY ||
2768  pmState == PM_HOT_STANDBY || pmState == PM_STARTUP)
2769  {
2770  /* autovac workers are told to shut down immediately */
2771  /* and bgworkers too; does this need tweaking? */
2772  SignalSomeChildren(SIGTERM,
2773  BACKEND_TYPE_AUTOVAC | BACKEND_TYPE_BGWORKER);
2774  /* and the autovac launcher too */
2775  if (AutoVacPID != 0)
2776  signal_child(AutoVacPID, SIGTERM);
2777  /* and the bgwriter too */
2778  if (BgWriterPID != 0)
2779  signal_child(BgWriterPID, SIGTERM);
2780  /* and the walwriter too */
2781  if (WalWriterPID != 0)
2782  signal_child(WalWriterPID, SIGTERM);
2783 
2784  /*
2785  * If we're in recovery, we can't kill the startup process
2786  * right away, because at present doing so does not release
2787  * its locks. We might want to change this in a future
2788  * release. For the time being, the PM_WAIT_READONLY state
2789  * indicates that we're waiting for the regular (read only)
2790  * backends to die off; once they do, we'll kill the startup
2791  * and walreceiver processes.
2792  */
2793  pmState = (pmState == PM_RUN) ?
2794  PM_WAIT_BACKUP : PM_WAIT_READONLY;
2795  }
2796 
2797  /*
2798  * Now wait for online backup mode to end and backends to exit. If
2799  * that is already the case, PostmasterStateMachine will take the
2800  * next step.
2801  */
2802  PostmasterStateMachine();
2803  break;
2804 
2805  case SIGINT:
2806 
2807  /*
2808  * Fast Shutdown:
2809  *
2810  * Abort all children with SIGTERM (rollback active transactions
2811  * and exit) and shut down when they are gone.
2812  */
2813  if (Shutdown >= FastShutdown)
2814  break;
2815  Shutdown = FastShutdown;
2816  ereport(LOG,
2817  (errmsg("received fast shutdown request")));
2818 
2819  /* Report status */
2820  AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_STOPPING);
2821 #ifdef USE_SYSTEMD
2822  sd_notify(0, "STOPPING=1");
2823 #endif
2824 
2825  if (StartupPID != 0)
2826  signal_child(StartupPID, SIGTERM);
2827  if (BgWriterPID != 0)
2828  signal_child(BgWriterPID, SIGTERM);
2829  if (WalReceiverPID != 0)
2830  signal_child(WalReceiverPID, SIGTERM);
2831  if (pmState == PM_STARTUP || pmState == PM_RECOVERY)
2832  {
2833  SignalSomeChildren(SIGTERM, BACKEND_TYPE_BGWORKER);
2834 
2835  /*
2836  * Only startup, bgwriter, walreceiver, possibly bgworkers,
2837  * and/or checkpointer should be active in this state; we just
2838  * signaled the first four, and we don't want to kill
2839  * checkpointer yet.
2840  */
2841  pmState = PM_WAIT_BACKENDS;
2842  }
2843  else if (pmState == PM_RUN ||
2844  pmState == PM_WAIT_BACKUP ||
2845  pmState == PM_WAIT_READONLY ||
2846  pmState == PM_WAIT_BACKENDS ||
2847  pmState == PM_HOT_STANDBY)
2848  {
2849  ereport(LOG,
2850  (errmsg("aborting any active transactions")));
2851  /* shut down all backends and workers */
2852  SignalSomeChildren(SIGTERM,
2853  BACKEND_TYPE_NORMAL | BACKEND_TYPE_AUTOVAC |
2854  BACKEND_TYPE_BGWORKER);
2855  /* and the autovac launcher too */
2856  if (AutoVacPID != 0)
2857  signal_child(AutoVacPID, SIGTERM);
2858  /* and the walwriter too */
2859  if (WalWriterPID != 0)
2860  signal_child(WalWriterPID, SIGTERM);
2861  pmState = PM_WAIT_BACKENDS;
2862  }
2863 
2864  /*
2865  * Now wait for backends to exit. If there are none,
2866  * PostmasterStateMachine will take the next step.
2867  */
2868  PostmasterStateMachine();
2869  break;
2870 
2871  case SIGQUIT:
2872 
2873  /*
2874  * Immediate Shutdown:
2875  *
2876  * abort all children with SIGQUIT, wait for them to exit,
2877  * terminate remaining ones with SIGKILL, then exit without
2878  * attempt to properly shut down the data base system.
2879  */
2880  if (Shutdown >= ImmediateShutdown)
2881  break;
2882  Shutdown = ImmediateShutdown;
2883  ereport(LOG,
2884  (errmsg("received immediate shutdown request")));
2885 
2886  /* Report status */
2887  AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_STOPPING);
2888 #ifdef USE_SYSTEMD
2889  sd_notify(0, "STOPPING=1");
2890 #endif
2891 
2892  TerminateChildren(SIGQUIT);
2893  pmState = PM_WAIT_BACKENDS;
2894 
2895  /* set stopwatch for them to die */
2896  AbortStartTime = time(NULL);
2897 
2898  /*
2899  * Now wait for backends to exit. If there are none,
2900  * PostmasterStateMachine will take the next step.
2901  */
2902  PostmasterStateMachine();
2903  break;
2904  }
2905 
2906 #ifdef WIN32
2907  PG_SETMASK(&UnBlockSig);
2908 #endif
2909 
2910  errno = save_errno;
2911 }
2912 
2913 /*
2914  * Reaper -- signal handler to cleanup after a child process dies.
2915  */
2916 static void
2917 reaper(SIGNAL_ARGS)
2918 {
2919  int save_errno = errno;
2920  int pid; /* process id of dead child process */
2921  int exitstatus; /* its exit status */
2922 
2923  /*
2924  * We rely on the signal mechanism to have blocked all signals ... except
2925  * on Windows, which lacks sigaction(), so we have to do it manually.
2926  */
2927 #ifdef WIN32
2928  PG_SETMASK(&BlockSig);
2929 #endif
2930 
2931  ereport(DEBUG4,
2932  (errmsg_internal("reaping dead processes")));
2933 
2934  while ((pid = waitpid(-1, &exitstatus, WNOHANG)) > 0)
2935  {
2936  /*
2937  * Check if this child was a startup process.
2938  */
2939  if (pid == StartupPID)
2940  {
2941  StartupPID = 0;
2942 
2943  /*
2944  * Startup process exited in response to a shutdown request (or it
2945  * completed normally regardless of the shutdown request).
2946  */
2947  if (Shutdown > NoShutdown &&
2948  (EXIT_STATUS_0(exitstatus) || EXIT_STATUS_1(exitstatus)))
2949  {
2950  StartupStatus = STARTUP_NOT_RUNNING;
2951  pmState = PM_WAIT_BACKENDS;
2952  /* PostmasterStateMachine logic does the rest */
2953  continue;
2954  }
2955 
2956  if (EXIT_STATUS_3(exitstatus))
2957  {
2958  ereport(LOG,
2959  (errmsg("shutdown at recovery target")));
2960  StartupStatus = STARTUP_NOT_RUNNING;
2961  Shutdown = SmartShutdown;
2962  TerminateChildren(SIGTERM);
2963  pmState = PM_WAIT_BACKENDS;
2964  /* PostmasterStateMachine logic does the rest */
2965  continue;
2966  }
2967 
2968  /*
2969  * Unexpected exit of startup process (including FATAL exit)
2970  * during PM_STARTUP is treated as catastrophic. There are no
2971  * other processes running yet, so we can just exit.
2972  */
2973  if (pmState == PM_STARTUP &&
2974  StartupStatus != STARTUP_SIGNALED &&
2975  !EXIT_STATUS_0(exitstatus))
2976  {
2977  LogChildExit(LOG, _("startup process"),
2978  pid, exitstatus);
2979  ereport(LOG,
2980  (errmsg("aborting startup due to startup process failure")));
2981  ExitPostmaster(1);
2982  }
2983 
2984  /*
2985  * After PM_STARTUP, any unexpected exit (including FATAL exit) of
2986  * the startup process is catastrophic, so kill other children,
2987  * and set StartupStatus so we don't try to reinitialize after
2988  * they're gone. Exception: if StartupStatus is STARTUP_SIGNALED,
2989  * then we previously sent the startup process a SIGQUIT; so
2990  * that's probably the reason it died, and we do want to try to
2991  * restart in that case.
2992  *
2993  * This stanza also handles the case where we sent a SIGQUIT
2994  * during PM_STARTUP due to some dead_end child crashing: in that
2995  * situation, if the startup process dies on the SIGQUIT, we need
2996  * to transition to PM_WAIT_BACKENDS state which will allow
2997  * PostmasterStateMachine to restart the startup process. (On the
2998  * other hand, the startup process might complete normally, if we
2999  * were too late with the SIGQUIT. In that case we'll fall
3000  * through and commence normal operations.)
3001  */
3002  if (!EXIT_STATUS_0(exitstatus))
3003  {
3004  if (StartupStatus == STARTUP_SIGNALED)
3005  {
3006  StartupStatus = STARTUP_NOT_RUNNING;
3007  if (pmState == PM_STARTUP)
3008  pmState = PM_WAIT_BACKENDS;
3009  }
3010  else
3011  StartupStatus = STARTUP_CRASHED;
3012  HandleChildCrash(pid, exitstatus,
3013  _("startup process"));
3014  continue;
3015  }
3016 
3017  /*
3018  * Startup succeeded, commence normal operations
3019  */
3020  StartupStatus = STARTUP_NOT_RUNNING;
3021  FatalError = false;
3022  AbortStartTime = 0;
3023  ReachedNormalRunning = true;
3024  pmState = PM_RUN;
3025 
3026  /*
3027  * Crank up the background tasks, if we didn't do that already
3028  * when we entered consistent recovery state. It doesn't matter
3029  * if this fails, we'll just try again later.
3030  */
3031  if (CheckpointerPID == 0)
3032  CheckpointerPID = StartCheckpointer();
3033  if (BgWriterPID == 0)
3034  BgWriterPID = StartBackgroundWriter();
3035  if (WalWriterPID == 0)
3036  WalWriterPID = StartWalWriter();
3037 
3038  /*
3039  * Likewise, start other special children as needed. In a restart
3040  * situation, some of them may be alive already.
3041  */
3042  if (!IsBinaryUpgrade && AutoVacuumingActive() && AutoVacPID == 0)
3043  AutoVacPID = StartAutoVacLauncher();
3044  if (PgArchStartupAllowed() && PgArchPID == 0)
3045  PgArchPID = pgarch_start();
3046  if (PgStatPID == 0)
3047  PgStatPID = pgstat_start();
3048 
3049  /* workers may be scheduled to start now */
3050  maybe_start_bgworkers();
3051 
3052  /* at this point we are really open for business */
3053  ereport(LOG,
3054  (errmsg("database system is ready to accept connections")));
3055 
3056  /* Report status */
3057  AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_READY);
3058 #ifdef USE_SYSTEMD
3059  sd_notify(0, "READY=1");
3060 #endif
3061 
3062  continue;
3063  }
3064 
3065  /*
3066  * Was it the bgwriter? Normal exit can be ignored; we'll start a new
3067  * one at the next iteration of the postmaster's main loop, if
3068  * necessary. Any other exit condition is treated as a crash.
3069  */
3070  if (pid == BgWriterPID)
3071  {
3072  BgWriterPID = 0;
3073  if (!EXIT_STATUS_0(exitstatus))
3074  HandleChildCrash(pid, exitstatus,
3075  _("background writer process"));
3076  continue;
3077  }
3078 
3079  /*
3080  * Was it the checkpointer?
3081  */
3082  if (pid == CheckpointerPID)
3083  {
3084  CheckpointerPID = 0;
3085  if (EXIT_STATUS_0(exitstatus) && pmState == PM_SHUTDOWN)
3086  {
3087  /*
3088  * OK, we saw normal exit of the checkpointer after it's been
3089  * told to shut down. We expect that it wrote a shutdown
3090  * checkpoint. (If for some reason it didn't, recovery will
3091  * occur on next postmaster start.)
3092  *
3093  * At this point we should have no normal backend children
3094  * left (else we'd not be in PM_SHUTDOWN state) but we might
3095  * have dead_end children to wait for.
3096  *
3097  * If we have an archiver subprocess, tell it to do a last
3098  * archive cycle and quit. Likewise, if we have walsender
3099  * processes, tell them to send any remaining WAL and quit.
3100  */
3101  Assert(Shutdown > NoShutdown);
3102 
3103  /* Waken archiver for the last time */
3104  if (PgArchPID != 0)
3105  signal_child(PgArchPID, SIGUSR2);
3106 
3107  /*
3108  * Waken walsenders for the last time. No regular backends
3109  * should be around anymore.
3110  */
3111  SignalChildren(SIGUSR2);
3112 
3113  pmState = PM_SHUTDOWN_2;
3114 
3115  /*
3116  * We can also shut down the stats collector now; there's
3117  * nothing left for it to do.
3118  */
3119  if (PgStatPID != 0)
3120  signal_child(PgStatPID, SIGQUIT);
3121  }
3122  else
3123  {
3124  /*
3125  * Any unexpected exit of the checkpointer (including FATAL
3126  * exit) is treated as a crash.
3127  */
3128  HandleChildCrash(pid, exitstatus,
3129  _("checkpointer process"));
3130  }
3131 
3132  continue;
3133  }
3134 
3135  /*
3136  * Was it the wal writer? Normal exit can be ignored; we'll start a
3137  * new one at the next iteration of the postmaster's main loop, if
3138  * necessary. Any other exit condition is treated as a crash.
3139  */
3140  if (pid == WalWriterPID)
3141  {
3142  WalWriterPID = 0;
3143  if (!EXIT_STATUS_0(exitstatus))
3144  HandleChildCrash(pid, exitstatus,
3145  _("WAL writer process"));
3146  continue;
3147  }
3148 
3149  /*
3150  * Was it the wal receiver? If exit status is zero (normal) or one
3151  * (FATAL exit), we assume everything is all right just like normal
3152  * backends. (If we need a new wal receiver, we'll start one at the
3153  * next iteration of the postmaster's main loop.)
3154  */
3155  if (pid == WalReceiverPID)
3156  {
3157  WalReceiverPID = 0;
3158  if (!EXIT_STATUS_0(exitstatus) && !EXIT_STATUS_1(exitstatus))
3159  HandleChildCrash(pid, exitstatus,
3160  _("WAL receiver process"));
3161  continue;
3162  }
3163 
3164  /*
3165  * Was it the autovacuum launcher? Normal exit can be ignored; we'll
3166  * start a new one at the next iteration of the postmaster's main
3167  * loop, if necessary. Any other exit condition is treated as a
3168  * crash.
3169  */
3170  if (pid == AutoVacPID)
3171  {
3172  AutoVacPID = 0;
3173  if (!EXIT_STATUS_0(exitstatus))
3174  HandleChildCrash(pid, exitstatus,
3175  _("autovacuum launcher process"));
3176  continue;
3177  }
3178 
3179  /*
3180  * Was it the archiver? If so, just try to start a new one; no need
3181  * to force reset of the rest of the system. (If fail, we'll try
3182  * again in future cycles of the main loop.). Unless we were waiting
3183  * for it to shut down; don't restart it in that case, and
3184  * PostmasterStateMachine() will advance to the next shutdown step.
3185  */
3186  if (pid == PgArchPID)
3187  {
3188  PgArchPID = 0;
3189  if (!EXIT_STATUS_0(exitstatus))
3190  LogChildExit(LOG, _("archiver process"),
3191  pid, exitstatus);
3192  if (PgArchStartupAllowed())
3193  PgArchPID = pgarch_start();
3194  continue;
3195  }
3196 
3197  /*
3198  * Was it the statistics collector? If so, just try to start a new
3199  * one; no need to force reset of the rest of the system. (If fail,
3200  * we'll try again in future cycles of the main loop.)
3201  */
3202  if (pid == PgStatPID)
3203  {
3204  PgStatPID = 0;
3205  if (!EXIT_STATUS_0(exitstatus))
3206  LogChildExit(LOG, _("statistics collector process"),
3207  pid, exitstatus);
3208  if (pmState == PM_RUN || pmState == PM_HOT_STANDBY)
3209  PgStatPID = pgstat_start();
3210  continue;
3211  }
3212 
3213  /* Was it the system logger? If so, try to start a new one */
3214  if (pid == SysLoggerPID)
3215  {
3216  SysLoggerPID = 0;
3217  /* for safety's sake, launch new logger *first* */
3218  SysLoggerPID = SysLogger_Start();
3219  if (!EXIT_STATUS_0(exitstatus))
3220  LogChildExit(LOG, _("system logger process"),
3221  pid, exitstatus);
3222  continue;
3223  }
3224 
3225  /* Was it one of our background workers? */
3226  if (CleanupBackgroundWorker(pid, exitstatus))
3227  {
3228  /* have it be restarted */
3229  HaveCrashedWorker = true;
3230  continue;
3231  }
3232 
3233  /*
3234  * Else do standard backend child cleanup.
3235  */
3236  CleanupBackend(pid, exitstatus);
3237  } /* loop over pending child-death reports */
3238 
3239  /*
3240  * After cleaning out the SIGCHLD queue, see if we have any state changes
3241  * or actions to make.
3242  */
3243  PostmasterStateMachine();
3244 
3245  /* Done with signal handler */
3246 #ifdef WIN32
3247  PG_SETMASK(&UnBlockSig);
3248 #endif
3249 
3250  errno = save_errno;
3251 }
3252 
3253 /*
3254  * Scan the bgworkers list and see if the given PID (which has just stopped
3255  * or crashed) is in it. Handle its shutdown if so, and return true. If not a
3256  * bgworker, return false.
3257  *
3258  * This is heavily based on CleanupBackend. One important difference is that
3259  * we don't know yet that the dying process is a bgworker, so we must be silent
3260  * until we're sure it is.
3261  */
3262 static bool
3263 CleanupBackgroundWorker(int pid,
3264  int exitstatus) /* child's exit status */
3265 {
3266  char namebuf[MAXPGPATH];
3267  slist_mutable_iter iter;
3268 
3269  slist_foreach_modify(iter, &BackgroundWorkerList)
3270  {
3271  RegisteredBgWorker *rw;
3272 
3273  rw = slist_container(RegisteredBgWorker, rw_lnode, iter.cur);
3274 
3275  if (rw->rw_pid != pid)
3276  continue;
3277 
3278 #ifdef WIN32
3279  /* see CleanupBackend */
3280  if (exitstatus == ERROR_WAIT_NO_CHILDREN)
3281  exitstatus = 0;
3282 #endif
3283 
3284  snprintf(namebuf, MAXPGPATH, _("background worker \"%s\""),
3285  rw->rw_worker.bgw_type);
3286 
3287 
3288  if (!EXIT_STATUS_0(exitstatus))
3289  {
3290  /* Record timestamp, so we know when to restart the worker. */
3291  rw->rw_crashed_at = GetCurrentTimestamp();
3292  }
3293  else
3294  {
3295  /* Zero exit status means terminate */
3296  rw->rw_crashed_at = 0;
3297  rw->rw_terminate = true;
3298  }
3299 
3300  /*
3301  * Additionally, for shared-memory-connected workers, just like a
3302  * backend, any exit status other than 0 or 1 is considered a crash
3303  * and causes a system-wide restart.
3304  */
3305  if ((rw->rw_worker.bgw_flags & BGWORKER_SHMEM_ACCESS) != 0)
3306  {
3307  if (!EXIT_STATUS_0(exitstatus) && !EXIT_STATUS_1(exitstatus))
3308  {
3309  HandleChildCrash(pid, exitstatus, namebuf);
3310  return true;
3311  }
3312  }
3313 
3314  /*
3315  * We must release the postmaster child slot whether this worker is
3316  * connected to shared memory or not, but we only treat it as a crash
3317  * if it is in fact connected.
3318  */
3319  if (!ReleasePostmasterChildSlot(rw->rw_child_slot) &&
3320  (rw->rw_worker.bgw_flags & BGWORKER_SHMEM_ACCESS) != 0)
3321  {
3322  HandleChildCrash(pid, exitstatus, namebuf);
3323  return true;
3324  }
3325 
3326  /* Get it out of the BackendList and clear out remaining data */
3327  dlist_delete(&rw->rw_backend->elem);
3328 #ifdef EXEC_BACKEND
3329  ShmemBackendArrayRemove(rw->rw_backend);
3330 #endif
3331 
3332  /*
3333  * It's possible that this background worker started some OTHER
3334  * background worker and asked to be notified when that worker started
3335  * or stopped. If so, cancel any notifications destined for the
3336  * now-dead backend.
3337  */
3338  if (rw->rw_backend->bgworker_notify)
3339  BackgroundWorkerStopNotifications(rw->rw_pid);
3340  free(rw->rw_backend);
3341  rw->rw_backend = NULL;
3342  rw->rw_pid = 0;
3343  rw->rw_child_slot = 0;
3344  ReportBackgroundWorkerExit(&iter); /* report child death */
3345 
3346  LogChildExit(EXIT_STATUS_0(exitstatus) ? DEBUG1 : LOG,
3347  namebuf, pid, exitstatus);
3348 
3349  return true;
3350  }
3351 
3352  return false;
3353 }
3354 
3355 /*
3356  * CleanupBackend -- cleanup after terminated backend.
3357  *
3358  * Remove all local state associated with backend.
3359  *
3360  * If you change this, see also CleanupBackgroundWorker.
3361  */
3362 static void
3363 CleanupBackend(int pid,
3364  int exitstatus) /* child's exit status. */
3365 {
3366  dlist_mutable_iter iter;
3367 
3368  LogChildExit(DEBUG2, _("server process"), pid, exitstatus);
3369 
3370  /*
3371  * If a backend dies in an ugly way then we must signal all other backends
3372  * to quickdie. If exit status is zero (normal) or one (FATAL exit), we
3373  * assume everything is all right and proceed to remove the backend from
3374  * the active backend list.
3375  */
3376 
3377 #ifdef WIN32
3378 
3379  /*
3380  * On win32, also treat ERROR_WAIT_NO_CHILDREN (128) as nonfatal case,
3381  * since that sometimes happens under load when the process fails to start
3382  * properly (long before it starts using shared memory). Microsoft reports
3383  * it is related to mutex failure:
3384  * http://archives.postgresql.org/pgsql-hackers/2010-09/msg00790.php
3385  */
3386  if (exitstatus == ERROR_WAIT_NO_CHILDREN)
3387  {
3388  LogChildExit(LOG, _("server process"), pid, exitstatus);
3389  exitstatus = 0;
3390  }
3391 #endif
3392 
3393  if (!EXIT_STATUS_0(exitstatus) && !EXIT_STATUS_1(exitstatus))
3394  {
3395  HandleChildCrash(pid, exitstatus, _("server process"));
3396  return;
3397  }
3398 
3399  dlist_foreach_modify(iter, &BackendList)
3400  {
3401  Backend *bp = dlist_container(Backend, elem, iter.cur);
3402 
3403  if (bp->pid == pid)
3404  {
3405  if (!bp->dead_end)
3406  {
3407  if (!ReleasePostmasterChildSlot(bp->child_slot))
3408  {
3409  /*
3410  * Uh-oh, the child failed to clean itself up. Treat as a
3411  * crash after all.
3412  */
3413  HandleChildCrash(pid, exitstatus, _("server process"));
3414  return;
3415  }
3416 #ifdef EXEC_BACKEND
3417  ShmemBackendArrayRemove(bp);
3418 #endif
3419  }
3420  if (bp->bgworker_notify)
3421  {
3422  /*
3423  * This backend may have been slated to receive SIGUSR1 when
3424  * some background worker started or stopped. Cancel those
3425  * notifications, as we don't want to signal PIDs that are not
3426  * PostgreSQL backends. This gets skipped in the (probably
3427  * very common) case where the backend has never requested any
3428  * such notifications.
3429  */
3430  BackgroundWorkerStopNotifications(bp->pid);
3431  }
3432  dlist_delete(iter.cur);
3433  free(bp);
3434  break;
3435  }
3436  }
3437 }
3438 
3439 /*
3440  * HandleChildCrash -- cleanup after failed backend, bgwriter, checkpointer,
3441  * walwriter, autovacuum, or background worker.
3442  *
3443  * The objectives here are to clean up our local state about the child
3444  * process, and to signal all other remaining children to quickdie.
3445  */
3446 static void
3447 HandleChildCrash(int pid, int exitstatus, const char *procname)
3448 {
3449  dlist_mutable_iter iter;
3450  slist_iter siter;
3451  Backend *bp;
3452  bool take_action;
3453 
3454  /*
3455  * We only log messages and send signals if this is the first process
3456  * crash and we're not doing an immediate shutdown; otherwise, we're only
3457  * here to update postmaster's idea of live processes. If we have already
3458  * signalled children, nonzero exit status is to be expected, so don't
3459  * clutter log.
3460  */
3461  take_action = !FatalError && Shutdown != ImmediateShutdown;
3462 
3463  if (take_action)
3464  {
3465  LogChildExit(LOG, procname, pid, exitstatus);
3466  ereport(LOG,
3467  (errmsg("terminating any other active server processes")));
3468  }
3469 
3470  /* Process background workers. */
3471  slist_foreach(siter, &BackgroundWorkerList)
3472  {
3473  RegisteredBgWorker *rw;
3474 
3475  rw = slist_container(RegisteredBgWorker, rw_lnode, siter.cur);
3476  if (rw->rw_pid == 0)
3477  continue; /* not running */
3478  if (rw->rw_pid == pid)
3479  {
3480  /*
3481  * Found entry for freshly-dead worker, so remove it.
3482  */
3483  (void) ReleasePostmasterChildSlot(rw->rw_child_slot);
3484  dlist_delete(&rw->rw_backend->elem);
3485 #ifdef EXEC_BACKEND
3486  ShmemBackendArrayRemove(rw->rw_backend);
3487 #endif
3488  free(rw->rw_backend);
3489  rw->rw_backend = NULL;
3490  rw->rw_pid = 0;
3491  rw->rw_child_slot = 0;
3492  /* don't reset crashed_at */
3493  /* don't report child stop, either */
3494  /* Keep looping so we can signal remaining workers */
3495  }
3496  else
3497  {
3498  /*
3499  * This worker is still alive. Unless we did so already, tell it
3500  * to commit hara-kiri.
3501  *
3502  * SIGQUIT is the special signal that says exit without proc_exit
3503  * and let the user know what's going on. But if SendStop is set
3504  * (-s on command line), then we send SIGSTOP instead, so that we
3505  * can get core dumps from all backends by hand.
3506  */
3507  if (take_action)
3508  {
3509  ereport(DEBUG2,
3510  (errmsg_internal("sending %s to process %d",
3511  (SendStop ? "SIGSTOP" : "SIGQUIT"),
3512  (int) rw->rw_pid)));
3513  signal_child(rw->rw_pid, (SendStop ? SIGSTOP : SIGQUIT));
3514  }
3515  }
3516  }
3517 
3518  /* Process regular backends */
3519  dlist_foreach_modify(iter, &BackendList)
3520  {
3521  bp = dlist_container(Backend, elem, iter.cur);
3522 
3523  if (bp->pid == pid)
3524  {
3525  /*
3526  * Found entry for freshly-dead backend, so remove it.
3527  */
3528  if (!bp->dead_end)
3529  {
3530  (void) ReleasePostmasterChildSlot(bp->child_slot);
3531 #ifdef EXEC_BACKEND
3532  ShmemBackendArrayRemove(bp);
3533 #endif
3534  }
3535  dlist_delete(iter.cur);
3536  free(bp);
3537  /* Keep looping so we can signal remaining backends */
3538  }
3539  else
3540  {
3541  /*
3542  * This backend is still alive. Unless we did so already, tell it
3543  * to commit hara-kiri.
3544  *
3545  * SIGQUIT is the special signal that says exit without proc_exit
3546  * and let the user know what's going on. But if SendStop is set
3547  * (-s on command line), then we send SIGSTOP instead, so that we
3548  * can get core dumps from all backends by hand.
3549  *
3550  * We could exclude dead_end children here, but at least in the
3551  * SIGSTOP case it seems better to include them.
3552  *
3553  * Background workers were already processed above; ignore them
3554  * here.
3555  */
3556  if (bp->bkend_type == BACKEND_TYPE_BGWORKER)
3557  continue;
3558 
3559  if (take_action)
3560  {
3561  ereport(DEBUG2,
3562  (errmsg_internal("sending %s to process %d",
3563  (SendStop ? "SIGSTOP" : "SIGQUIT"),
3564  (int) bp->pid)));
3565  signal_child(bp->pid, (SendStop ? SIGSTOP : SIGQUIT));
3566  }
3567  }
3568  }
3569 
3570  /* Take care of the startup process too */
3571  if (pid == StartupPID)
3572  {
3573  StartupPID = 0;
3574  /* Caller adjusts StartupStatus, so don't touch it here */
3575  }
3576  else if (StartupPID != 0 && take_action)
3577  {
3578  ereport(DEBUG2,
3579  (errmsg_internal("sending %s to process %d",
3580  (SendStop ? "SIGSTOP" : "SIGQUIT"),
3581  (int) StartupPID)));
3582  signal_child(StartupPID, (SendStop ? SIGSTOP : SIGQUIT));
3583  StartupStatus = STARTUP_SIGNALED;
3584  }
3585 
3586  /* Take care of the bgwriter too */
3587  if (pid == BgWriterPID)
3588  BgWriterPID = 0;
3589  else if (BgWriterPID != 0 && take_action)
3590  {
3591  ereport(DEBUG2,
3592  (errmsg_internal("sending %s to process %d",
3593  (SendStop ? "SIGSTOP" : "SIGQUIT"),
3594  (int) BgWriterPID)));
3595  signal_child(BgWriterPID, (SendStop ? SIGSTOP : SIGQUIT));
3596  }
3597 
3598  /* Take care of the checkpointer too */
3599  if (pid == CheckpointerPID)
3600  CheckpointerPID = 0;
3601  else if (CheckpointerPID != 0 && take_action)
3602  {
3603  ereport(DEBUG2,
3604  (errmsg_internal("sending %s to process %d",
3605  (SendStop ? "SIGSTOP" : "SIGQUIT"),
3606  (int) CheckpointerPID)));
3607  signal_child(CheckpointerPID, (SendStop ? SIGSTOP : SIGQUIT));
3608  }
3609 
3610  /* Take care of the walwriter too */
3611  if (pid == WalWriterPID)
3612  WalWriterPID = 0;
3613  else if (WalWriterPID != 0 && take_action)
3614  {
3615  ereport(DEBUG2,
3616  (errmsg_internal("sending %s to process %d",
3617  (SendStop ? "SIGSTOP" : "SIGQUIT"),
3618  (int) WalWriterPID)));
3619  signal_child(WalWriterPID, (SendStop ? SIGSTOP : SIGQUIT));
3620  }
3621 
3622  /* Take care of the walreceiver too */
3623  if (pid == WalReceiverPID)
3624  WalReceiverPID = 0;
3625  else if (WalReceiverPID != 0 && take_action)
3626  {
3627  ereport(DEBUG2,
3628  (errmsg_internal("sending %s to process %d",
3629  (SendStop ? "SIGSTOP" : "SIGQUIT"),
3630  (int) WalReceiverPID)));
3631  signal_child(WalReceiverPID, (SendStop ? SIGSTOP : SIGQUIT));
3632  }
3633 
3634  /* Take care of the autovacuum launcher too */
3635  if (pid == AutoVacPID)
3636  AutoVacPID = 0;
3637  else if (AutoVacPID != 0 && take_action)
3638  {
3639  ereport(DEBUG2,
3640  (errmsg_internal("sending %s to process %d",
3641  (SendStop ? "SIGSTOP" : "SIGQUIT"),
3642  (int) AutoVacPID)));
3643  signal_child(AutoVacPID, (SendStop ? SIGSTOP : SIGQUIT));
3644  }
3645 
3646  /*
3647  * Force a power-cycle of the pgarch process too. (This isn't absolutely
3648  * necessary, but it seems like a good idea for robustness, and it
3649  * simplifies the state-machine logic in the case where a shutdown request
3650  * arrives during crash processing.)
3651  */
3652  if (PgArchPID != 0 && take_action)
3653  {
3654  ereport(DEBUG2,
3655  (errmsg_internal("sending %s to process %d",
3656  "SIGQUIT",
3657  (int) PgArchPID)));
3658  signal_child(PgArchPID, SIGQUIT);
3659  }
3660 
3661  /*
3662  * Force a power-cycle of the pgstat process too. (This isn't absolutely
3663  * necessary, but it seems like a good idea for robustness, and it
3664  * simplifies the state-machine logic in the case where a shutdown request
3665  * arrives during crash processing.)
3666  */
3667  if (PgStatPID != 0 && take_action)
3668  {
3669  ereport(DEBUG2,
3670  (errmsg_internal("sending %s to process %d",
3671  "SIGQUIT",
3672  (int) PgStatPID)));
3673  signal_child(PgStatPID, SIGQUIT);
3674  allow_immediate_pgstat_restart();
3675  }
3676 
3677  /* We do NOT restart the syslogger */
3678 
3679  if (Shutdown != ImmediateShutdown)
3680  FatalError = true;
3681 
3682  /* We now transit into a state of waiting for children to die */
3683  if (pmState == PM_RECOVERY ||
3684  pmState == PM_HOT_STANDBY ||
3685  pmState == PM_RUN ||
3686  pmState == PM_WAIT_BACKUP ||
3687  pmState == PM_WAIT_READONLY ||
3688  pmState == PM_SHUTDOWN)
3689  pmState = PM_WAIT_BACKENDS;
3690 
3691  /*
3692  * .. and if this doesn't happen quickly enough, now the clock is ticking
3693  * for us to kill them without mercy.
3694  */
3695  if (AbortStartTime == 0)
3696  AbortStartTime = time(NULL);
3697 }
3698 
3699 /*
3700  * Log the death of a child process.
3701  */
3702 static void
3703 LogChildExit(int lev, const char *procname, int pid, int exitstatus)
3704 {
3705  /*
3706  * size of activity_buffer is arbitrary, but set equal to default
3707  * track_activity_query_size
3708  */
3709  char activity_buffer[1024];
3710  const char *activity = NULL;
3711 
3712  if (!EXIT_STATUS_0(exitstatus))
3713  activity = pgstat_get_crashed_backend_activity(pid,
3714  activity_buffer,
3715  sizeof(activity_buffer));
3716 
3717  if (WIFEXITED(exitstatus))
3718  ereport(lev,
3719 
3720  /*------
3721  translator: %s is a noun phrase describing a child process, such as
3722  "server process" */
3723  (errmsg("%s (PID %d) exited with exit code %d",
3724  procname, pid, WEXITSTATUS(exitstatus)),
3725  activity ? errdetail("Failed process was running: %s", activity) : 0));
3726  else if (WIFSIGNALED(exitstatus))
3727  {
3728 #if defined(WIN32)
3729  ereport(lev,
3730 
3731  /*------
3732  translator: %s is a noun phrase describing a child process, such as
3733  "server process" */
3734  (errmsg("%s (PID %d) was terminated by exception 0x%X",
3735  procname, pid, WTERMSIG(exitstatus)),
3736  errhint("See C include file \"ntstatus.h\" for a description of the hexadecimal value."),
3737  activity ? errdetail("Failed process was running: %s", activity) : 0));
3738 #else
3739  ereport(lev,
3740 
3741  /*------
3742  translator: %s is a noun phrase describing a child process, such as
3743  "server process" */
3744  (errmsg("%s (PID %d) was terminated by signal %d: %s",
3745  procname, pid, WTERMSIG(exitstatus),
3746  pg_strsignal(WTERMSIG(exitstatus))),
3747  activity ? errdetail("Failed process was running: %s", activity) : 0));
3748 #endif
3749  }
3750  else
3751  ereport(lev,
3752 
3753  /*------
3754  translator: %s is a noun phrase describing a child process, such as
3755  "server process" */
3756  (errmsg("%s (PID %d) exited with unrecognized status %d",
3757  procname, pid, exitstatus),
3758  activity ? errdetail("Failed process was running: %s", activity) : 0));
3759 }
3760 
3761 /*
3762  * Advance the postmaster's state machine and take actions as appropriate
3763  *
3764  * This is common code for pmdie(), reaper() and sigusr1_handler(), which
3765  * receive the signals that might mean we need to change state.
3766  */
3767 static void
3768 PostmasterStateMachine(void)
3769 {
3770  if (pmState == PM_WAIT_BACKUP)
3771  {
3772  /*
3773  * PM_WAIT_BACKUP state ends when online backup mode is not active.
3774  */
3775  if (!BackupInProgress())
3776  pmState = PM_WAIT_BACKENDS;
3777  }
3778 
3779  if (pmState == PM_WAIT_READONLY)
3780  {
3781  /*
3782  * PM_WAIT_READONLY state ends when we have no regular backends that
3783  * have been started during recovery. We kill the startup and
3784  * walreceiver processes and transition to PM_WAIT_BACKENDS. Ideally,
3785  * we might like to kill these processes first and then wait for
3786  * backends to die off, but that doesn't work at present because
3787  * killing the startup process doesn't release its locks.
3788  */
3789  if (CountChildren(BACKEND_TYPE_NORMAL) == 0)
3790  {
3791  if (StartupPID != 0)
3792  signal_child(StartupPID, SIGTERM);
3793  if (WalReceiverPID != 0)
3794  signal_child(WalReceiverPID, SIGTERM);
3795  pmState = PM_WAIT_BACKENDS;
3796  }
3797  }
3798 
3799  /*
3800  * If we are in a state-machine state that implies waiting for backends to
3801  * exit, see if they're all gone, and change state if so.
3802  */
3803  if (pmState == PM_WAIT_BACKENDS)
3804  {
3805  /*
3806  * PM_WAIT_BACKENDS state ends when we have no regular backends
3807  * (including autovac workers), no bgworkers (including unconnected
3808  * ones), and no walwriter, autovac launcher or bgwriter. If we are
3809  * doing crash recovery or an immediate shutdown then we expect the
3810  * checkpointer to exit as well, otherwise not. The archiver, stats,
3811  * and syslogger processes are disregarded since they are not
3812  * connected to shared memory; we also disregard dead_end children
3813  * here. Walsenders are also disregarded, they will be terminated
3814  * later after writing the checkpoint record, like the archiver
3815  * process.
3816  */
3817  if (CountChildren(BACKEND_TYPE_NORMAL | BACKEND_TYPE_WORKER) == 0 &&
3818  StartupPID == 0 &&
3819  WalReceiverPID == 0 &&
3820  BgWriterPID == 0 &&
3821  (CheckpointerPID == 0 ||
3822  (!FatalError && Shutdown < ImmediateShutdown)) &&
3823  WalWriterPID == 0 &&
3824  AutoVacPID == 0)
3825  {
3826  if (Shutdown >= ImmediateShutdown || FatalError)
3827  {
3828  /*
3829  * Start waiting for dead_end children to die. This state
3830  * change causes ServerLoop to stop creating new ones.
3831  */
3832  pmState = PM_WAIT_DEAD_END;
3833 
3834  /*
3835  * We already SIGQUIT'd the archiver and stats processes, if
3836  * any, when we started immediate shutdown or entered
3837  * FatalError state.
3838  */
3839  }
3840  else
3841  {
3842  /*
3843  * If we get here, we are proceeding with normal shutdown. All
3844  * the regular children are gone, and it's time to tell the
3845  * checkpointer to do a shutdown checkpoint.
3846  */
3847  Assert(Shutdown > NoShutdown);
3848  /* Start the checkpointer if not running */
3849  if (CheckpointerPID == 0)
3850  CheckpointerPID = StartCheckpointer();
3851  /* And tell it to shut down */
3852  if (CheckpointerPID != 0)
3853  {
3854  signal_child(CheckpointerPID, SIGUSR2);
3855  pmState = PM_SHUTDOWN;
3856  }
3857  else
3858  {
3859  /*
3860  * If we failed to fork a checkpointer, just shut down.
3861  * Any required cleanup will happen at next restart. We
3862  * set FatalError so that an "abnormal shutdown" message
3863  * gets logged when we exit.
3864  */
3865  FatalError = true;
3866  pmState = PM_WAIT_DEAD_END;
3867 
3868  /* Kill the walsenders, archiver and stats collector too */
3869  SignalChildren(SIGQUIT);
3870  if (PgArchPID != 0)
3871  signal_child(PgArchPID, SIGQUIT);
3872  if (PgStatPID != 0)
3873  signal_child(PgStatPID, SIGQUIT);
3874  }
3875  }
3876  }
3877  }
3878 
3879  if (pmState == PM_SHUTDOWN_2)
3880  {
3881  /*
3882  * PM_SHUTDOWN_2 state ends when there's no other children than
3883  * dead_end children left. There shouldn't be any regular backends
3884  * left by now anyway; what we're really waiting for is walsenders and
3885  * archiver.
3886  */
3887  if (PgArchPID == 0 && CountChildren(BACKEND_TYPE_ALL) == 0)
3888  {
3889  pmState = PM_WAIT_DEAD_END;
3890  }
3891  }
3892 
3893  if (pmState == PM_WAIT_DEAD_END)
3894  {
3895  /*
3896  * PM_WAIT_DEAD_END state ends when the BackendList is entirely empty
3897  * (ie, no dead_end children remain), and the archiver and stats
3898  * collector are gone too.
3899  *
3900  * The reason we wait for those two is to protect them against a new
3901  * postmaster starting conflicting subprocesses; this isn't an
3902  * ironclad protection, but it at least helps in the
3903  * shutdown-and-immediately-restart scenario. Note that they have
3904  * already been sent appropriate shutdown signals, either during a
3905  * normal state transition leading up to PM_WAIT_DEAD_END, or during
3906  * FatalError processing.
3907  */
3908  if (dlist_is_empty(&BackendList) &&
3909  PgArchPID == 0 && PgStatPID == 0)
3910  {
3911  /* These other guys should be dead already */
3912  Assert(StartupPID == 0);
3913  Assert(WalReceiverPID == 0);
3914  Assert(BgWriterPID == 0);
3915  Assert(CheckpointerPID == 0);
3916  Assert(WalWriterPID == 0);
3917  Assert(AutoVacPID == 0);
3918  /* syslogger is not considered here */
3919  pmState = PM_NO_CHILDREN;
3920  }
3921  }
3922 
3923  /*
3924  * If we've been told to shut down, we exit as soon as there are no
3925  * remaining children. If there was a crash, cleanup will occur at the
3926  * next startup. (Before PostgreSQL 8.3, we tried to recover from the
3927  * crash before exiting, but that seems unwise if we are quitting because
3928  * we got SIGTERM from init --- there may well not be time for recovery
3929  * before init decides to SIGKILL us.)
3930  *
3931  * Note that the syslogger continues to run. It will exit when it sees
3932  * EOF on its input pipe, which happens when there are no more upstream
3933  * processes.
3934  */
3935  if (Shutdown > NoShutdown && pmState == PM_NO_CHILDREN)
3936  {
3937  if (FatalError)
3938  {
3939  ereport(LOG, (errmsg("abnormal database system shutdown")));
3940  ExitPostmaster(1);
3941  }
3942  else
3943  {
3944  /*
3945  * Terminate exclusive backup mode to avoid recovery after a clean
3946  * fast shutdown. Since an exclusive backup can only be taken
3947  * during normal running (and not, for example, while running
3948  * under Hot Standby) it only makes sense to do this if we reached
3949  * normal running. If we're still in recovery, the backup file is
3950  * one we're recovering *from*, and we must keep it around so that
3951  * recovery restarts from the right place.
3952  */
3953  if (ReachedNormalRunning)
3954  CancelBackup();
3955 
3956  /* Normal exit from the postmaster is here */
3957  ExitPostmaster(0);
3958  }
3959  }
3960 
3961  /*
3962  * If the startup process failed, or the user does not want an automatic
3963  * restart after backend crashes, wait for all non-syslogger children to
3964  * exit, and then exit postmaster. We don't try to reinitialize when the
3965  * startup process fails, because more than likely it will just fail again
3966  * and we will keep trying forever.
3967  */
3968  if (pmState == PM_NO_CHILDREN &&
3969  (StartupStatus == STARTUP_CRASHED || !restart_after_crash))
3970  ExitPostmaster(1);
3971 
3972  /*
3973  * If we need to recover from a crash, wait for all non-syslogger children
3974  * to exit, then reset shmem and StartupDataBase.
3975  */
3976  if (FatalError && pmState == PM_NO_CHILDREN)
3977  {
3978  ereport(LOG,
3979  (errmsg("all server processes terminated; reinitializing")));
3980 
3981  /* allow background workers to immediately restart */
3982  ResetBackgroundWorkerCrashTimes();
3983 
3984  shmem_exit(1);
3985 
3986  /* re-read control file into local memory */
3987  LocalProcessControlFile(true);
3988 
3989  reset_shared();
3990 
3991  StartupPID = StartupDataBase();
3992  Assert(StartupPID != 0);
3993  StartupStatus = STARTUP_RUNNING;
3994  pmState = PM_STARTUP;
3995  /* crash recovery started, reset SIGKILL flag */
3996  AbortStartTime = 0;
3997  }
3998 }
3999 
4000 
4001 /*
4002  * Send a signal to a postmaster child process
4003  *
4004  * On systems that have setsid(), each child process sets itself up as a
4005  * process group leader. For signals that are generally interpreted in the
4006  * appropriate fashion, we signal the entire process group not just the
4007  * direct child process. This allows us to, for example, SIGQUIT a blocked
4008  * archive_recovery script, or SIGINT a script being run by a backend via
4009  * system().
4010  *
4011  * There is a race condition for recently-forked children: they might not
4012  * have executed setsid() yet. So we signal the child directly as well as
4013  * the group. We assume such a child will handle the signal before trying
4014  * to spawn any grandchild processes. We also assume that signaling the
4015  * child twice will not cause any problems.
4016  */
4017 static void
4018 signal_child(pid_t pid, int signal)
4019 {
4020  if (kill(pid, signal) < 0)
4021  elog(DEBUG3, "kill(%ld,%d) failed: %m", (long) pid, signal);
4022 #ifdef HAVE_SETSID
4023  switch (signal)
4024  {
4025  case SIGINT:
4026  case SIGTERM:
4027  case SIGQUIT:
4028  case SIGSTOP:
4029  case SIGKILL:
4030  if (kill(-pid, signal) < 0)
4031  elog(DEBUG3, "kill(%ld,%d) failed: %m", (long) (-pid), signal);
4032  break;
4033  default:
4034  break;
4035  }
4036 #endif
4037 }
4038 
4039 /*
4040  * Send a signal to the targeted children (but NOT special children;
4041  * dead_end children are never signaled, either).
4042  */
4043 static bool
4044 SignalSomeChildren(int signal, int target)
4045 {
4046  dlist_iter iter;
4047  bool signaled = false;
4048 
4049  dlist_foreach(iter, &BackendList)
4050  {
4051  Backend *bp = dlist_container(Backend, elem, iter.cur);
4052 
4053  if (bp->dead_end)
4054  continue;
4055 
4056  /*
4057  * Since target == BACKEND_TYPE_ALL is the most common case, we test
4058  * it first and avoid touching shared memory for every child.
4059  */
4060  if (target != BACKEND_TYPE_ALL)
4061  {
4062  /*
4063  * Assign bkend_type for any recently announced WAL Sender
4064  * processes.
4065  */
4066  if (bp->bkend_type == BACKEND_TYPE_NORMAL &&
4067  IsPostmasterChildWalSender(bp->child_slot))
4068  bp->bkend_type = BACKEND_TYPE_WALSND;
4069 
4070  if (!(target & bp->bkend_type))
4071  continue;
4072  }
4073 
4074  ereport(DEBUG4,
4075  (errmsg_internal("sending signal %d to process %d",
4076  signal, (int) bp->pid)));
4077  signal_child(bp->pid, signal);
4078  signaled = true;
4079  }
4080  return signaled;
4081 }
4082 
4083 /*
4084  * Send a termination signal to children. This considers all of our children
4085  * processes, except syslogger and dead_end backends.
4086  */
4087 static void
4088 TerminateChildren(int signal)
4089 {
4090  SignalChildren(signal);
4091  if (StartupPID != 0)
4092  {
4093  signal_child(StartupPID, signal);
4094  if (signal == SIGQUIT || signal == SIGKILL)
4095  StartupStatus = STARTUP_SIGNALED;
4096  }
4097  if (BgWriterPID != 0)
4098  signal_child(BgWriterPID, signal);
4099  if (CheckpointerPID != 0)
4100  signal_child(CheckpointerPID, signal);
4101  if (WalWriterPID != 0)
4102  signal_child(WalWriterPID, signal);
4103  if (WalReceiverPID != 0)
4104  signal_child(WalReceiverPID, signal);
4105  if (AutoVacPID != 0)
4106  signal_child(AutoVacPID, signal);
4107  if (PgArchPID != 0)
4108  signal_child(PgArchPID, signal);
4109  if (PgStatPID != 0)
4110  signal_child(PgStatPID, signal);
4111 }
4112 
4113 /*
4114  * BackendStartup -- start backend process
4115  *
4116  * returns: STATUS_ERROR if the fork failed, STATUS_OK otherwise.
4117  *
4118  * Note: if you change this code, also consider StartAutovacuumWorker.
4119  */
4120 static int
4121 BackendStartup(Port *port)
4122 {
4123  Backend *bn; /* for backend cleanup */
4124  pid_t pid;
4125 
4126  /*
4127  * Create backend data structure. Better before the fork() so we can
4128  * handle failure cleanly.
4129  */
4130  bn = (Backend *) malloc(sizeof(Backend));
4131  if (!bn)
4132  {
4133  ereport(LOG,
4134  (errcode(ERRCODE_OUT_OF_MEMORY),
4135  errmsg("out of memory")));
4136  return STATUS_ERROR;
4137  }
4138 
4139  /*
4140  * Compute the cancel key that will be assigned to this backend. The
4141  * backend will have its own copy in the forked-off process' value of
4142  * MyCancelKey, so that it can transmit the key to the frontend.
4143  */
4144  if (!RandomCancelKey(&MyCancelKey))
4145  {
4146  free(bn);
4147  ereport(LOG,
4148  (errcode(ERRCODE_INTERNAL_ERROR),
4149  errmsg("could not generate random cancel key")));
4150  return STATUS_ERROR;
4151  }
4152 
4153  bn->cancel_key = MyCancelKey;
4154 
4155  /* Pass down canAcceptConnections state */
4156  port->canAcceptConnections = canAcceptConnections(BACKEND_TYPE_NORMAL);
4157  bn->dead_end = (port->canAcceptConnections != CAC_OK &&
4158  port->canAcceptConnections != CAC_WAITBACKUP);
4159 
4160  /*
4161  * Unless it's a dead_end child, assign it a child slot number
4162  */
4163  if (!bn->dead_end)
4164  bn->child_slot = MyPMChildSlot = AssignPostmasterChildSlot();
4165  else
4166  bn->child_slot = 0;
4167 
4168  /* Hasn't asked to be notified about any bgworkers yet */
4169  bn->bgworker_notify = false;
4170 
4171 #ifdef EXEC_BACKEND
4172  pid = backend_forkexec(port);
4173 #else /* !EXEC_BACKEND */
4174  pid = fork_process();
4175  if (pid == 0) /* child */
4176  {
4177  free(bn);
4178 
4179  /* Detangle from postmaster */
4180  InitPostmasterChild();
4181 
4182  /* Close the postmaster's sockets */
4183  ClosePostmasterPorts(false);
4184 
4185  /* Perform additional initialization and collect startup packet */
4186  BackendInitialize(port);
4187 
4188  /* And run the backend */
4189  BackendRun(port);
4190  }
4191 #endif /* EXEC_BACKEND */
4192 
4193  if (pid < 0)
4194  {
4195  /* in parent, fork failed */
4196  int save_errno = errno;
4197 
4198  if (!bn->dead_end)
4199  (void) ReleasePostmasterChildSlot(bn->child_slot);
4200  free(bn);
4201  errno = save_errno;
4202  ereport(LOG,
4203  (errmsg("could not fork new process for connection: %m")));
4204  report_fork_failure_to_client(port, save_errno);
4205  return STATUS_ERROR;
4206  }
4207 
4208  /* in parent, successful fork */
4209  ereport(DEBUG2,
4210  (errmsg_internal("forked new backend, pid=%d socket=%d",
4211  (int) pid, (int) port->sock)));
4212 
4213  /*
4214  * Everything's been successful, it's safe to add this backend to our list
4215  * of backends.
4216  */
4217  bn->pid = pid;
4218  bn->bkend_type = BACKEND_TYPE_NORMAL; /* Can change later to WALSND */
4219  dlist_push_head(&BackendList, &bn->elem);
4220 
4221 #ifdef EXEC_BACKEND
4222  if (!bn->dead_end)
4223  ShmemBackendArrayAdd(bn);
4224 #endif
4225 
4226  return STATUS_OK;
4227 }
4228 
4229 /*
4230  * Try to report backend fork() failure to client before we close the
4231  * connection. Since we do not care to risk blocking the postmaster on
4232  * this connection, we set the connection to non-blocking and try only once.
4233  *
4234  * This is grungy special-purpose code; we cannot use backend libpq since
4235  * it's not up and running.
4236  */
4237 static void
4238 report_fork_failure_to_client(Port *port, int errnum)
4239 {
4240  char buffer[1000];
4241  int rc;
4242 
4243  /* Format the error message packet (always V2 protocol) */
4244  snprintf(buffer, sizeof(buffer), "E%s%s\n",
4245  _("could not fork new process for connection: "),
4246  strerror(errnum));
4247 
4248  /* Set port to non-blocking. Don't do send() if this fails */
4249  if (!pg_set_noblock(port->sock))
4250  return;
4251 
4252  /* We'll retry after EINTR, but ignore all other failures */
4253  do
4254  {
4255  rc = send(port->sock, buffer, strlen(buffer) + 1, 0);
4256  } while (rc < 0 && errno == EINTR);
4257 }
4258 
4259 
4260 /*
4261  * BackendInitialize -- initialize an interactive (postmaster-child)
4262  * backend process, and collect the client's startup packet.
4263  *
4264  * returns: nothing. Will not return at all if there's any failure.
4265  *
4266  * Note: this code does not depend on having any access to shared memory.
4267  * In the EXEC_BACKEND case, we are physically attached to shared memory
4268  * but have not yet set up most of our local pointers to shmem structures.
4269  */
4270 static void
4271 BackendInitialize(Port *port)
4272 {
4273  int status;
4274  int ret;
4275  char remote_host[NI_MAXHOST];
4276  char remote_port[NI_MAXSERV];
4277  char remote_ps_data[NI_MAXHOST];
4278 
4279  /* Save port etc. for ps status */
4280  MyProcPort = port;
4281 
4282  /*
4283  * PreAuthDelay is a debugging aid for investigating problems in the
4284  * authentication cycle: it can be set in postgresql.conf to allow time to
4285  * attach to the newly-forked backend with a debugger. (See also
4286  * PostAuthDelay, which we allow clients to pass through PGOPTIONS, but it
4287  * is not honored until after authentication.)
4288  */
4289  if (PreAuthDelay > 0)
4290  pg_usleep(PreAuthDelay * 1000000L);
4291 
4292  /* This flag will remain set until InitPostgres finishes authentication */
4293  ClientAuthInProgress = true; /* limit visibility of log messages */
4294 
4295  /* set these to empty in case they are needed before we set them up */
4296  port->remote_host = "";
4297  port->remote_port = "";
4298 
4299  /*
4300  * Initialize libpq and enable reporting of ereport errors to the client.
4301  * Must do this now because authentication uses libpq to send messages.
4302  */
4303  pq_init(); /* initialize libpq to talk to client */
4304  whereToSendOutput = DestRemote; /* now safe to ereport to client */
4305 
4306  /*
4307  * We arrange for a simple exit(1) if we receive SIGTERM or SIGQUIT or
4308  * timeout while trying to collect the startup packet. Otherwise the
4309  * postmaster cannot shutdown the database FAST or IMMED cleanly if a
4310  * buggy client fails to send the packet promptly. XXX it follows that
4311  * the remainder of this function must tolerate losing control at any
4312  * instant. Likewise, any pg_on_exit_callback registered before or during
4313  * this function must be prepared to execute at any instant between here
4314  * and the end of this function. Furthermore, affected callbacks execute
4315  * partially or not at all when a second exit-inducing signal arrives
4316  * after proc_exit_prepare() decrements on_proc_exit_index. (Thanks to
4317  * that mechanic, callbacks need not anticipate more than one call.) This
4318  * is fragile; it ought to instead follow the norm of handling interrupts
4319  * at selected, safe opportunities.
4320  */
4321  pqsignal(SIGTERM, startup_die);
4322  pqsignal(SIGQUIT, startup_die);
4323  InitializeTimeouts(); /* establishes SIGALRM handler */
4324  PG_SETMASK(&StartupBlockSig);
4325 
4326  /*
4327  * Get the remote host name and port for logging and status display.
4328  */
4329  remote_host[0] = '\0';
4330  remote_port[0] = '\0';
4331  if ((ret = pg_getnameinfo_all(&port->raddr.addr, port->raddr.salen,
4332  remote_host, sizeof(remote_host),
4333  remote_port, sizeof(remote_port),
4334  (log_hostname ? 0 : NI_NUMERICHOST) | NI_NUMERICSERV)) != 0)
4335  ereport(WARNING,
4336  (errmsg_internal("pg_getnameinfo_all() failed: %s",
4337  gai_strerror(ret))));
4338  if (remote_port[0] == '\0')
4339  snprintf(remote_ps_data, sizeof(remote_ps_data), "%s", remote_host);
4340  else
4341  snprintf(remote_ps_data, sizeof(remote_ps_data), "%s(%s)", remote_host, remote_port);
4342 
4343  /*
4344  * Save remote_host and remote_port in port structure (after this, they
4345  * will appear in log_line_prefix data for log messages).
4346  */
4347  port->remote_host = strdup(remote_host);
4348  port->remote_port = strdup(remote_port);
4349 
4350  /* And now we can issue the Log_connections message, if wanted */
4351  if (Log_connections)
4352  {
4353  if (remote_port[0])
4354  ereport(LOG,
4355  (errmsg("connection received: host=%s port=%s",
4356  remote_host,
4357  remote_port)));
4358  else
4359  ereport(LOG,
4360  (errmsg("connection received: host=%s",
4361  remote_host)));
4362  }
4363 
4364  /*
4365  * If we did a reverse lookup to name, we might as well save the results
4366  * rather than possibly repeating the lookup during authentication.
4367  *
4368  * Note that we don't want to specify NI_NAMEREQD above, because then we'd
4369  * get nothing useful for a client without an rDNS entry. Therefore, we
4370  * must check whether we got a numeric IPv4 or IPv6 address, and not save
4371  * it into remote_hostname if so. (This test is conservative and might
4372  * sometimes classify a hostname as numeric, but an error in that
4373  * direction is safe; it only results in a possible extra lookup.)
4374  */
4375  if (log_hostname &&
4376  ret == 0 &&
4377  strspn(remote_host, "0123456789.") < strlen(remote_host) &&
4378  strspn(remote_host, "0123456789ABCDEFabcdef:") < strlen(remote_host))
4379  port->remote_hostname = strdup(remote_host);
4380 
4381  /*
4382  * Ready to begin client interaction. We will give up and exit(1) after a
4383  * time delay, so that a broken client can't hog a connection
4384  * indefinitely. PreAuthDelay and any DNS interactions above don't count
4385  * against the time limit.
4386  *
4387  * Note: AuthenticationTimeout is applied here while waiting for the
4388  * startup packet, and then again in InitPostgres for the duration of any
4389  * authentication operations. So a hostile client could tie up the
4390  * process for nearly twice AuthenticationTimeout before we kick him off.
4391  *
4392  * Note: because PostgresMain will call InitializeTimeouts again, the
4393  * registration of STARTUP_PACKET_TIMEOUT will be lost. This is okay
4394  * since we never use it again after this function.
4395  */
4396  RegisterTimeout(STARTUP_PACKET_TIMEOUT, StartupPacketTimeoutHandler);
4397  enable_timeout_after(STARTUP_PACKET_TIMEOUT, AuthenticationTimeout * 1000);
4398 
4399  /*
4400  * Receive the startup packet (which might turn out to be a cancel request
4401  * packet).
4402  */
4403  status = ProcessStartupPacket(port, false);
4404 
4405  /*
4406  * Stop here if it was bad or a cancel packet. ProcessStartupPacket
4407  * already did any appropriate error reporting.
4408  */
4409  if (status != STATUS_OK)
4410  proc_exit(0);
4411 
4412  /*
4413  * Now that we have the user and database name, we can set the process
4414  * title for ps. It's good to do this as early as possible in startup.
4415  *
4416  * For a walsender, the ps display is set in the following form:
4417  *
4418  * postgres: walsender <user> <host> <activity>
4419  *
4420  * To achieve that, we pass "walsender" as username and username as dbname
4421  * to init_ps_display(). XXX: should add a new variant of
4422  * init_ps_display() to avoid abusing the parameters like this.
4423  */
4424  if (am_walsender)
4425  init_ps_display(pgstat_get_backend_desc(B_WAL_SENDER), port->user_name, remote_ps_data,
4426  update_process_title ? "authentication" : "");
4427  else
4428  init_ps_display(port->user_name, port->database_name, remote_ps_data,
4429  update_process_title ? "authentication" : "");
4430 
4431  /*
4432  * Disable the timeout, and prevent SIGTERM/SIGQUIT again.
4433  */
4434  disable_timeout(STARTUP_PACKET_TIMEOUT, false);
4435  PG_SETMASK(&BlockSig);
4436 }
4437 
4438 
4439 /*
4440  * BackendRun -- set up the backend's argument list and invoke PostgresMain()
4441  *
4442  * returns:
4443  * Shouldn't return at all.
4444  * If PostgresMain() fails, return status.
4445  */
4446 static void
4447 BackendRun(Port *port)
4448 {
4449  char **av;
4450  int maxac;
4451  int ac;
4452  int i;
4453 
4454  /*
4455  * Now, build the argv vector that will be given to PostgresMain.
4456  *
4457  * The maximum possible number of commandline arguments that could come
4458  * from ExtraOptions is (strlen(ExtraOptions) + 1) / 2; see
4459  * pg_split_opts().
4460  */
4461  maxac = 2; /* for fixed args supplied below */
4462  maxac += (strlen(ExtraOptions) + 1) / 2;
4463 
4464  av = (char **) MemoryContextAlloc(TopMemoryContext,
4465  maxac * sizeof(char *));
4466  ac = 0;
4467 
4468  av[ac++] = "postgres";
4469 
4470  /*
4471  * Pass any backend switches specified with -o on the postmaster's own
4472  * command line. We assume these are secure.
4473  */
4474  pg_split_opts(av, &ac, ExtraOptions);
4475 
4476  av[ac] = NULL;
4477 
4478  Assert(ac < maxac);
4479 
4480  /*
4481  * Debug: print arguments being passed to backend
4482  */
4483  ereport(DEBUG3,
4484  (errmsg_internal("%s child[%d]: starting with (",
4485  progname, (int) getpid())));
4486  for (i = 0; i < ac; ++i)
4487  ereport(DEBUG3,
4488  (errmsg_internal("\t%s", av[i])));
4489  ereport(DEBUG3,
4490  (errmsg_internal(")")));
4491 
4492  /*
4493  * Make sure we aren't in PostmasterContext anymore. (We can't delete it
4494  * just yet, though, because InitPostgres will need the HBA data.)
4495  */
4496  MemoryContextSwitchTo(TopMemoryContext);
4497 
4498  PostgresMain(ac, av, port->database_name, port->user_name);
4499 }
4500 
4501 
4502 #ifdef EXEC_BACKEND
4503 
4504 /*
4505  * postmaster_forkexec -- fork and exec a postmaster subprocess
4506  *
4507  * The caller must have set up the argv array already, except for argv[2]
4508  * which will be filled with the name of the temp variable file.
4509  *
4510  * Returns the child process PID, or -1 on fork failure (a suitable error
4511  * message has been logged on failure).
4512  *
4513  * All uses of this routine will dispatch to SubPostmasterMain in the
4514  * child process.
4515  */
4516 pid_t
4517 postmaster_forkexec(int argc, char *argv[])
4518 {
4519  Port port;
4520 
4521  /* This entry point passes dummy values for the Port variables */
4522  memset(&port, 0, sizeof(port));
4523  return internal_forkexec(argc, argv, &port);
4524 }
4525 
4526 /*
4527  * backend_forkexec -- fork/exec off a backend process
4528  *
4529  * Some operating systems (WIN32) don't have fork() so we have to simulate
4530  * it by storing parameters that need to be passed to the child and
4531  * then create a new child process.
4532  *
4533  * returns the pid of the fork/exec'd process, or -1 on failure
4534  */
4535 static pid_t
4536 backend_forkexec(Port *port)
4537 {
4538  char *av[4];
4539  int ac = 0;
4540 
4541  av[ac++] = "postgres";
4542  av[ac++] = "--forkbackend";
4543  av[ac++] = NULL; /* filled in by internal_forkexec */
4544 
4545  av[ac] = NULL;
4546  Assert(ac < lengthof(av));
4547 
4548  return internal_forkexec(ac, av, port);
4549 }
4550 
4551 #ifndef WIN32
4552 
4553 /*
4554  * internal_forkexec non-win32 implementation
4555  *
4556  * - writes out backend variables to the parameter file
4557  * - fork():s, and then exec():s the child process
4558  */
4559 static pid_t
4560 internal_forkexec(int argc, char *argv[], Port *port)
4561 {
4562  static unsigned long tmpBackendFileNum = 0;
4563  pid_t pid;
4564  char tmpfilename[MAXPGPATH];
4565  BackendParameters param;
4566  FILE *fp;
4567 
4568  if (!save_backend_variables(&param, port))
4569  return -1; /* log made by save_backend_variables */
4570 
4571  /* Calculate name for temp file */
4572  snprintf(tmpfilename, MAXPGPATH, "%s/%s.backend_var.%d.%lu",
4573  PG_TEMP_FILES_DIR, PG_TEMP_FILE_PREFIX,
4574  MyProcPid, ++tmpBackendFileNum);
4575 
4576  /* Open file */
4577  fp = AllocateFile(tmpfilename, PG_BINARY_W);
4578  if (!fp)
4579  {
4580  /*
4581  * As in OpenTemporaryFileInTablespace, try to make the temp-file
4582  * directory, ignoring errors.
4583  */
4584  (void) MakePGDirectory(PG_TEMP_FILES_DIR);
4585 
4586  fp = AllocateFile(tmpfilename, PG_BINARY_W);
4587  if (!fp)
4588  {
4589  ereport(LOG,
4590  (errcode_for_file_access(),
4591  errmsg("could not create file \"%s\": %m",
4592  tmpfilename)));
4593  return -1;
4594  }
4595  }
4596 
4597  if (fwrite(&param, sizeof(param), 1, fp) != 1)
4598  {
4599  ereport(LOG,
4600  (errcode_for_file_access(),
4601  errmsg("could not write to file \"%s\": %m", tmpfilename)));
4602  FreeFile(fp);
4603  return -1;
4604  }
4605 
4606  /* Release file */
4607  if (FreeFile(fp))
4608  {
4609  ereport(LOG,
4610  (errcode_for_file_access(),
4611  errmsg("could not write to file \"%s\": %m", tmpfilename)));
4612  return -1;
4613  }
4614 
4615  /* Make sure caller set up argv properly */
4616  Assert(argc >= 3);
4617  Assert(argv[argc] == NULL);
4618  Assert(strncmp(argv[1], "--fork", 6) == 0);
4619  Assert(argv[2] == NULL);
4620 
4621  /* Insert temp file name after --fork argument */
4622  argv[2] = tmpfilename;
4623 
4624  /* Fire off execv in child */
4625  if ((pid = fork_process()) == 0)
4626  {
4627  if (execv(postgres_exec_path, argv) < 0)
4628  {
4629  ereport(LOG,
4630  (errmsg("could not execute server process \"%s\": %m",
4631  postgres_exec_path)));
4632  /* We're already in the child process here, can't return */
4633  exit(1);
4634  }
4635  }
4636 
4637  return pid; /* Parent returns pid, or -1 on fork failure */
4638 }
4639 #else /* WIN32 */
4640 
4641 /*
4642  * internal_forkexec win32 implementation
4643  *
4644  * - starts backend using CreateProcess(), in suspended state
4645  * - writes out backend variables to the parameter file
4646  * - during this, duplicates handles and sockets required for
4647  * inheritance into the new process
4648  * - resumes execution of the new process once the backend parameter
4649  * file is complete.
4650  */
4651 static pid_t
4652 internal_forkexec(int argc, char *argv[], Port *port)
4653 {
4654  int retry_count = 0;
4655  STARTUPINFO si;
4656  PROCESS_INFORMATION pi;
4657  int i;
4658  int j;
4659  char cmdLine[MAXPGPATH * 2];
4660  HANDLE paramHandle;
4661  BackendParameters *param;
4662  SECURITY_ATTRIBUTES sa;
4663  char paramHandleStr[32];
4664  win32_deadchild_waitinfo *childinfo;
4665 
4666  /* Make sure caller set up argv properly */
4667  Assert(argc >= 3);
4668  Assert(argv[argc] == NULL);
4669  Assert(strncmp(argv[1], "--fork", 6) == 0);
4670  Assert(argv[2] == NULL);
4671 
4672  /* Resume here if we need to retry */
4673 retry:
4674 
4675  /* Set up shared memory for parameter passing */
4676  ZeroMemory(&sa, sizeof(sa));
4677  sa.nLength = sizeof(sa);
4678  sa.bInheritHandle = TRUE;
4679  paramHandle = CreateFileMapping(INVALID_HANDLE_VALUE,
4680  &sa,
4681  PAGE_READWRITE,
4682  0,
4683  sizeof(BackendParameters),
4684  NULL);
4685  if (paramHandle == INVALID_HANDLE_VALUE)
4686  {
4687  elog(LOG, "could not create backend parameter file mapping: error code %lu",
4688  GetLastError());
4689  return -1;
4690  }
4691 
4692  param = MapViewOfFile(paramHandle, FILE_MAP_WRITE, 0, 0, sizeof(BackendParameters));
4693  if (!param)
4694  {
4695  elog(LOG, "could not map backend parameter memory: error code %lu",
4696  GetLastError());
4697  CloseHandle(paramHandle);
4698  return -1;
4699  }
4700 
4701  /* Insert temp file name after --fork argument */
4702 #ifdef _WIN64
4703  sprintf(paramHandleStr, "%llu", (LONG_PTR) paramHandle);
4704 #else
4705  sprintf(paramHandleStr, "%lu", (DWORD) paramHandle);
4706 #endif
4707  argv[2] = paramHandleStr;
4708 
4709  /* Format the cmd line */
4710  cmdLine[sizeof(cmdLine) - 1] = '\0';
4711  cmdLine[sizeof(cmdLine) - 2] = '\0';
4712  snprintf(cmdLine, sizeof(cmdLine) - 1, "\"%s\"", postgres_exec_path);
4713  i = 0;
4714  while (argv[++i] != NULL)
4715  {
4716  j = strlen(cmdLine);
4717  snprintf(cmdLine + j, sizeof(cmdLine) - 1 - j, " \"%s\"", argv[i]);
4718  }
4719  if (cmdLine[sizeof(cmdLine) - 2] != '\0')
4720  {
4721  elog(LOG, "subprocess command line too long");
4722  return -1;
4723  }
4724 
4725  memset(&pi, 0, sizeof(pi));
4726  memset(&si, 0, sizeof(si));
4727  si.cb = sizeof(si);
4728 
4729  /*
4730  * Create the subprocess in a suspended state. This will be resumed later,
4731  * once we have written out the parameter file.
4732  */
4733  if (!CreateProcess(NULL, cmdLine, NULL, NULL, TRUE, CREATE_SUSPENDED,
4734  NULL, NULL, &si, &pi))
4735  {
4736  elog(LOG, "CreateProcess call failed: %m (error code %lu)",
4737  GetLastError());
4738  return -1;
4739  }
4740 
4741  if (!save_backend_variables(param, port, pi.hProcess, pi.dwProcessId))
4742  {
4743  /*
4744  * log made by save_backend_variables, but we have to clean up the
4745  * mess with the half-started process
4746  */
4747  if (!TerminateProcess(pi.hProcess, 255))
4748  ereport(LOG,
4749  (errmsg_internal("could not terminate unstarted process: error code %lu",
4750  GetLastError())));
4751  CloseHandle(pi.hProcess);
4752  CloseHandle(pi.hThread);
4753  return -1; /* log made by save_backend_variables */
4754  }
4755 
4756  /* Drop the parameter shared memory that is now inherited to the backend */
4757  if (!UnmapViewOfFile(param))
4758  elog(LOG, "could not unmap view of backend parameter file: error code %lu",
4759  GetLastError());
4760  if (!CloseHandle(paramHandle))
4761  elog(LOG, "could not close handle to backend parameter file: error code %lu",
4762  GetLastError());
4763 
4764  /*
4765  * Reserve the memory region used by our main shared memory segment before
4766  * we resume the child process. Normally this should succeed, but if ASLR
4767  * is active then it might sometimes fail due to the stack or heap having
4768  * gotten mapped into that range. In that case, just terminate the
4769  * process and retry.
4770  */
4771  if (!pgwin32_ReserveSharedMemoryRegion(pi.hProcess))
4772  {
4773  /* pgwin32_ReserveSharedMemoryRegion already made a log entry */
4774  if (!TerminateProcess(pi.hProcess, 255))
4775  ereport(LOG,
4776  (errmsg_internal("could not terminate process that failed to reserve memory: error code %lu",
4777  GetLastError())));
4778  CloseHandle(pi.hProcess);
4779  CloseHandle(pi.hThread);
4780  if (++retry_count < 100)
4781  goto retry;
4782  ereport(LOG,
4783  (errmsg("giving up after too many tries to reserve shared memory"),
4784  errhint("This might be caused by ASLR or antivirus software.")));
4785  return -1;
4786  }
4787 
4788  /*
4789  * Now that the backend variables are written out, we start the child
4790  * thread so it can start initializing while we set up the rest of the
4791  * parent state.
4792  */
4793  if (ResumeThread(pi.hThread) == -1)
4794  {
4795  if (!TerminateProcess(pi.hProcess, 255))
4796  {
4797  ereport(LOG,
4798  (errmsg_internal("could not terminate unstartable process: error code %lu",
4799  GetLastError())));
4800  CloseHandle(pi.hProcess);
4801  CloseHandle(pi.hThread);
4802  return -1;
4803  }
4804  CloseHandle(pi.hProcess);
4805  CloseHandle(pi.hThread);
4806  ereport(LOG,
4807  (errmsg_internal("could not resume thread of unstarted process: error code %lu",
4808  GetLastError())));
4809  return -1;
4810  }
4811 
4812  /*
4813  * Queue a waiter to signal when this child dies. The wait will be handled
4814  * automatically by an operating system thread pool.
4815  *
4816  * Note: use malloc instead of palloc, since it needs to be thread-safe.
4817  * Struct will be free():d from the callback function that runs on a
4818  * different thread.
4819  */
4820  childinfo = malloc(sizeof(win32_deadchild_waitinfo));
4821  if (!childinfo)
4822  ereport(FATAL,
4823  (errcode(ERRCODE_OUT_OF_MEMORY),
4824  errmsg("out of memory")));
4825 
4826  childinfo->procHandle = pi.hProcess;
4827  childinfo->procId = pi.dwProcessId;
4828 
4829  if (!RegisterWaitForSingleObject(&childinfo->waitHandle,
4830  pi.hProcess,
4831  pgwin32_deadchild_callback,
4832  childinfo,
4833  INFINITE,
4834  WT_EXECUTEONLYONCE | WT_EXECUTEINWAITTHREAD))
4835  ereport(FATAL,
4836  (errmsg_internal("could not register process for wait: error code %lu",
4837  GetLastError())));
4838 
4839  /* Don't close pi.hProcess here - the wait thread needs access to it */
4840 
4841  CloseHandle(pi.hThread);
4842 
4843  return pi.dwProcessId;
4844 }
4845 #endif /* WIN32 */
4846 
4847 
4848 /*
4849  * SubPostmasterMain -- Get the fork/exec'd process into a state equivalent
4850  * to what it would be if we'd simply forked on Unix, and then
4851  * dispatch to the appropriate place.
4852  *
4853  * The first two command line arguments are expected to be "--forkFOO"
4854  * (where FOO indicates which postmaster child we are to become), and
4855  * the name of a variables file that we can read to load data that would
4856  * have been inherited by fork() on Unix. Remaining arguments go to the
4857  * subprocess FooMain() routine.
4858  */
4859 void
4860 SubPostmasterMain(int argc, char *argv[])
4861 {
4862  Port port;
4863 
4864  /* In EXEC_BACKEND case we will not have inherited these settings */
4865  IsPostmasterEnvironment = true;
4866  whereToSendOutput = DestNone;
4867 
4868  /* Setup as postmaster child */
4869  InitPostmasterChild();
4870 
4871  /* Setup essential subsystems (to ensure elog() behaves sanely) */
4872  InitializeGUCOptions();
4873 
4874  /* Check we got appropriate args */
4875  if (argc < 3)
4876  elog(FATAL, "invalid subpostmaster invocation");
4877 
4878  /* Read in the variables file */
4879  memset(&port, 0, sizeof(Port));
4880  read_backend_variables(argv[2], &port);
4881 
4882  /* Close the postmaster's sockets (as soon as we know them) */
4883  ClosePostmasterPorts(strcmp(argv[1], "--forklog") == 0);
4884 
4885  /*
4886  * Set reference point for stack-depth checking
4887  */
4888  set_stack_base();
4889 
4890  /*
4891  * Set up memory area for GSS information. Mirrors the code in ConnCreate
4892  * for the non-exec case.
4893  */
4894 #if defined(ENABLE_GSS) || defined(ENABLE_SSPI)
4895  port.gss = (pg_gssinfo *) calloc(1, sizeof(pg_gssinfo));
4896  if (!port.gss)
4897  ereport(FATAL,
4898  (errcode(ERRCODE_OUT_OF_MEMORY),
4899  errmsg("out of memory")));
4900 #endif
4901 
4902  /*
4903  * If appropriate, physically re-attach to shared memory segment. We want
4904  * to do this before going any further to ensure that we can attach at the
4905  * same address the postmaster used. On the other hand, if we choose not
4906  * to re-attach, we may have other cleanup to do.
4907  *
4908  * If testing EXEC_BACKEND on Linux, you should run this as root before
4909  * starting the postmaster:
4910  *
4911  * echo 0 >/proc/sys/kernel/randomize_va_space
4912  *
4913  * This prevents using randomized stack and code addresses that cause the
4914  * child process's memory map to be different from the parent's, making it
4915  * sometimes impossible to attach to shared memory at the desired address.
4916  * Return the setting to its old value (usually '1' or '2') when finished.
4917  */
4918  if (strcmp(argv[1], "--forkbackend") == 0 ||
4919  strcmp(argv[1], "--forkavlauncher") == 0 ||
4920  strcmp(argv[1], "--forkavworker") == 0 ||
4921  strcmp(argv[1], "--forkboot") == 0 ||
4922  strncmp(argv[1], "--forkbgworker=", 15) == 0)
4923  PGSharedMemoryReAttach();
4924  else
4925  PGSharedMemoryNoReAttach();
4926 
4927  /* autovacuum needs this set before calling InitProcess */
4928  if (strcmp(argv[1], "--forkavlauncher") == 0)
4929  AutovacuumLauncherIAm();
4930  if (strcmp(argv[1], "--forkavworker") == 0)
4931  AutovacuumWorkerIAm();
4932 
4933  /*
4934  * Start our win32 signal implementation. This has to be done after we
4935  * read the backend variables, because we need to pick up the signal pipe
4936  * from the parent process.
4937  */
4938 #ifdef WIN32
4939  pgwin32_signal_initialize();
4940 #endif
4941 
4942  /* In EXEC_BACKEND case we will not have inherited these settings */
4943  pqinitmask();
4944  PG_SETMASK(&BlockSig);
4945 
4946  /* Read in remaining GUC variables */
4947  read_nondefault_variables();
4948 
4949  /*
4950  * Check that the data directory looks valid, which will also check the
4951  * privileges on the data directory and update our umask and file/group
4952  * variables for creating files later. Note: this should really be done
4953  * before we create any files or directories.
4954  */
4955  checkDataDir();
4956 
4957  /*
4958  * (re-)read control file, as it contains config. The postmaster will
4959  * already have read this, but this process doesn't know about that.
4960  */
4961  LocalProcessControlFile(false);
4962 
4963  /*
4964  * Reload any libraries that were preloaded by the postmaster. Since we
4965  * exec'd this process, those libraries didn't come along with us; but we
4966  * should load them into all child processes to be consistent with the
4967  * non-EXEC_BACKEND behavior.
4968  */
4969  process_shared_preload_libraries();
4970 
4971  /* Run backend or appropriate child */
4972  if (strcmp(argv[1], "--forkbackend") == 0)
4973  {
4974  Assert(argc == 3); /* shouldn't be any more args */
4975 
4976  /*
4977  * Need to reinitialize the SSL library in the backend, since the
4978  * context structures contain function pointers and cannot be passed
4979  * through the parameter file.
4980  *
4981  * If for some reason reload fails (maybe the user installed broken
4982  * key files), soldier on without SSL; that's better than all
4983  * connections becoming impossible.
4984  *
4985  * XXX should we do this in all child processes? For the moment it's
4986  * enough to do it in backend children.
4987  */
4988 #ifdef USE_SSL
4989  if (EnableSSL)
4990  {
4991  if (secure_initialize(false) == 0)
4992  LoadedSSL = true;
4993  else
4994  ereport(LOG,
4995  (errmsg("SSL configuration could not be loaded in child process")));
4996  }
4997 #endif
4998 
4999  /*
5000  * Perform additional initialization and collect startup packet.
5001  *
5002  * We want to do this before InitProcess() for a couple of reasons: 1.
5003  * so that we aren't eating up a PGPROC slot while waiting on the
5004  * client. 2. so that if InitProcess() fails due to being out of
5005  * PGPROC slots, we have already initialized libpq and are able to
5006  * report the error to the client.
5007  */
5008  BackendInitialize(&port);
5009 
5010  /* Restore basic shared memory pointers */
5011  InitShmemAccess(UsedShmemSegAddr);
5012 
5013  /* Need a PGPROC to run CreateSharedMemoryAndSemaphores */
5014  InitProcess();
5015 
5016  /* Attach process to shared data structures */
5017  CreateSharedMemoryAndSemaphores();
5018 
5019  /* And run the backend */
5020  BackendRun(&port); /* does not return */
5021  }
5022  if (strcmp(argv[1], "--forkboot") == 0)
5023  {
5024  /* Restore basic shared memory pointers */
5025  InitShmemAccess(UsedShmemSegAddr);
5026 
5027  /* Need a PGPROC to run CreateSharedMemoryAndSemaphores */
5028  InitAuxiliaryProcess();
5029 
5030  /* Attach process to shared data structures */
5031  CreateSharedMemoryAndSemaphores();
5032 
5033  AuxiliaryProcessMain(argc - 2, argv + 2); /* does not return */
5034  }
5035  if (strcmp(argv[1], "--forkavlauncher") == 0)
5036  {
5037  /* Restore basic shared memory pointers */
5038  InitShmemAccess(UsedShmemSegAddr);
5039 
5040  /* Need a PGPROC to run CreateSharedMemoryAndSemaphores */
5041  InitProcess();
5042 
5043  /* Attach process to shared data structures */
5044  CreateSharedMemoryAndSemaphores();
5045 
5046  AutoVacLauncherMain(argc - 2, argv + 2); /* does not return */
5047  }
5048  if (strcmp(argv[1], "--forkavworker") == 0)
5049  {
5050  /* Restore basic shared memory pointers */
5051  InitShmemAccess(UsedShmemSegAddr);
5052 
5053  /* Need a PGPROC to run CreateSharedMemoryAndSemaphores */
5054  InitProcess();
5055 
5056  /* Attach process to shared data structures */
5057  CreateSharedMemoryAndSemaphores();
5058 
5059  AutoVacWorkerMain(argc - 2, argv + 2); /* does not return */
5060  }
5061  if (strncmp(argv[1], "--forkbgworker=", 15) == 0)
5062  {
5063  int shmem_slot;
5064 
5065  /* do this as early as possible; in particular, before InitProcess() */
5066  IsBackgroundWorker = true;
5067 
5068  /* Restore basic shared memory pointers */
5069  InitShmemAccess(UsedShmemSegAddr);
5070 
5071  /* Need a PGPROC to run CreateSharedMemoryAndSemaphores */
5072  InitProcess();
5073 
5074  /* Attach process to shared data structures */
5075  CreateSharedMemoryAndSemaphores();
5076 
5077  /* Fetch MyBgworkerEntry from shared memory */
5078  shmem_slot = atoi(argv[1] + 15);
5079  MyBgworkerEntry = BackgroundWorkerEntry(shmem_slot);
5080 
5081  StartBackgroundWorker();
5082  }
5083  if (strcmp(argv[1], "--forkarch") == 0)
5084  {
5085  /* Do not want to attach to shared memory */
5086 
5087  PgArchiverMain(argc, argv); /* does not return */
5088  }
5089  if (strcmp(argv[1], "--forkcol") == 0)
5090  {
5091  /* Do not want to attach to shared memory */
5092 
5093  PgstatCollectorMain(argc, argv); /* does not return */
5094  }
5095  if (strcmp(argv[1], "--forklog") == 0)
5096  {
5097  /* Do not want to attach to shared memory */
5098 
5099  SysLoggerMain(argc, argv); /* does not return */
5100  }
5101 
5102  abort(); /* shouldn't get here */
5103 }
5104 #endif /* EXEC_BACKEND */
5105 
5106 
5107 /*
5108  * ExitPostmaster -- cleanup
5109  *
5110  * Do NOT call exit() directly --- always go through here!
5111  */
5112 static void
5113 ExitPostmaster(int status)
5114 {
5115 #ifdef HAVE_PTHREAD_IS_THREADED_NP
5116 
5117  /*
5118  * There is no known cause for a postmaster to become multithreaded after
5119  * startup. Recheck to account for the possibility of unknown causes.
5120  * This message uses LOG level, because an unclean shutdown at this point
5121  * would usually not look much different from a clean shutdown.
5122  */
5123  if (pthread_is_threaded_np() != 0)
5124  ereport(LOG,
5125  (errcode(ERRCODE_INTERNAL_ERROR),
5126  errmsg_internal("postmaster became multithreaded"),
5127  errdetail("Please report this to <pgsql-bugs@lists.postgresql.org>.")));
5128 #endif
5129 
5130  /* should cleanup shared memory and kill all backends */
5131 
5132  /*
5133  * Not sure of the semantics here. When the Postmaster dies, should the
5134  * backends all be killed? probably not.
5135  *
5136  * MUST -- vadim 05-10-1999
5137  */
5138 
5139  proc_exit(status);
5140 }
5141 
5142 /*
5143  * sigusr1_handler - handle signal conditions from child processes
5144  */
5145 static void
5146 sigusr1_handler(SIGNAL_ARGS)
5147 {
5148  int save_errno = errno;
5149 
5150  /*
5151  * We rely on the signal mechanism to have blocked all signals ... except
5152  * on Windows, which lacks sigaction(), so we have to do it manually.
5153  */
5154 #ifdef WIN32
5155  PG_SETMASK(&BlockSig);
5156 #endif
5157 
5158  /* Process background worker state change. */
5159  if (CheckPostmasterSignal(PMSIGNAL_BACKGROUND_WORKER_CHANGE))
5160  {
5161  BackgroundWorkerStateChange();
5162  StartWorkerNeeded = true;
5163  }
5164 
5165  /*
5166  * RECOVERY_STARTED and BEGIN_HOT_STANDBY signals are ignored in
5167  * unexpected states. If the startup process quickly starts up, completes
5168  * recovery, exits, we might process the death of the startup process
5169  * first. We don't want to go back to recovery in that case.
5170  */
5171  if (CheckPostmasterSignal(PMSIGNAL_RECOVERY_STARTED) &&
5172  pmState == PM_STARTUP && Shutdown == NoShutdown)
5173  {
5174  /* WAL redo has started. We're out of reinitialization. */
5175  FatalError = false;
5176  AbortStartTime = 0;
5177 
5178  /*
5179  * Crank up the background tasks. It doesn't matter if this fails,
5180  * we'll just try again later.
5181  */
5182  Assert(CheckpointerPID == 0);
5183  CheckpointerPID = StartCheckpointer();
5184  Assert(BgWriterPID == 0);
5185  BgWriterPID = StartBackgroundWriter();
5186 
5187  /*
5188  * Start the archiver if we're responsible for (re-)archiving received
5189  * files.
5190  */
5191  Assert(PgArchPID == 0);
5192  if (XLogArchivingAlways())
5193  PgArchPID = pgarch_start();
5194 
5195  /*
5196  * If we aren't planning to enter hot standby mode later, treat
5197  * RECOVERY_STARTED as meaning we're out of startup, and report status
5198  * accordingly.
5199  */
5200  if (!EnableHotStandby)
5201  {
5202  AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_STANDBY);
5203 #ifdef USE_SYSTEMD
5204  sd_notify(0, "READY=1");
5205 #endif
5206  }
5207 
5208  pmState = PM_RECOVERY;
5209  }
5210  if (CheckPostmasterSignal(PMSIGNAL_BEGIN_HOT_STANDBY) &&
5211  pmState == PM_RECOVERY && Shutdown == NoShutdown)
5212  {
5213  /*
5214  * Likewise, start other special children as needed.
5215  */
5216  Assert(PgStatPID == 0);
5217  PgStatPID = pgstat_start();
5218 
5219  ereport(LOG,
5220  (errmsg("database system is ready to accept read only connections")));
5221 
5222  /* Report status */
5223  AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_READY);
5224 #ifdef USE_SYSTEMD
5225  sd_notify(0, "READY=1");
5226 #endif
5227 
5228  pmState = PM_HOT_STANDBY;
5229  /* Some workers may be scheduled to start now */
5230  StartWorkerNeeded = true;
5231  }
5232 
5233  if (StartWorkerNeeded || HaveCrashedWorker)
5234  maybe_start_bgworkers();
5235 
5236  if (CheckPostmasterSignal(PMSIGNAL_WAKEN_ARCHIVER) &&
5237  PgArchPID != 0)
5238  {
5239  /*
5240  * Send SIGUSR1 to archiver process, to wake it up and begin archiving
5241  * next WAL file.
5242  */
5243  signal_child(PgArchPID, SIGUSR1);
5244  }
5245 
5246  /* Tell syslogger to rotate logfile if requested */
5247  if (SysLoggerPID != 0)
5248  {
5249  if (CheckLogrotateSignal())
5250  {
5251  signal_child(SysLoggerPID, SIGUSR1);
5252  RemoveLogrotateSignalFiles();
5253  }
5254  else if (CheckPostmasterSignal(PMSIGNAL_ROTATE_LOGFILE))
5255  {
5256  signal_child(SysLoggerPID, SIGUSR1);
5257  }
5258  }
5259 
5260  if (CheckPostmasterSignal(PMSIGNAL_START_AUTOVAC_LAUNCHER) &&
5261  Shutdown == NoShutdown)
5262  {
5263  /*
5264  * Start one iteration of the autovacuum daemon, even if autovacuuming
5265  * is nominally not enabled. This is so we can have an active defense
5266  * against transaction ID wraparound. We set a flag for the main loop
5267  * to do it rather than trying to do it here --- this is because the
5268  * autovac process itself may send the signal, and we want to handle
5269  * that by launching another iteration as soon as the current one
5270  * completes.
5271  */
5272  start_autovac_launcher = true;
5273  }
5274 
5275  if (CheckPostmasterSignal(PMSIGNAL_START_AUTOVAC_WORKER) &&
5276  Shutdown == NoShutdown)
5277  {
5278  /* The autovacuum launcher wants us to start a worker process. */
5279  StartAutovacuumWorker();
5280  }
5281 
5282  if (CheckPostmasterSignal(PMSIGNAL_START_WALRECEIVER))
5283  {
5284  /* Startup Process wants us to start the walreceiver process. */
5285  /* Start immediately if possible, else remember request for later. */
5286  WalReceiverRequested = true;
5287  MaybeStartWalReceiver();
5288  }
5289 
5290  /*
5291  * Try to advance postmaster's state machine, if a child requests it.
5292  *
5293  * Be careful about the order of this action relative to sigusr1_handler's
5294  * other actions. Generally, this should be after other actions, in case
5295  * they have effects PostmasterStateMachine would need to know about.
5296  * However, we should do it before the CheckPromoteSignal step, which
5297  * cannot have any (immediate) effect on the state machine, but does
5298  * depend on what state we're in now.
5299  */
5300  if (CheckPostmasterSignal(PMSIGNAL_ADVANCE_STATE_MACHINE))
5301  {
5302  PostmasterStateMachine();
5303  }
5304 
5305  if (StartupPID != 0 &&
5306  (pmState == PM_STARTUP || pmState == PM_RECOVERY ||
5307  pmState == PM_HOT_STANDBY || pmState == PM_WAIT_READONLY) &&
5308  CheckPromoteSignal())
5309  {
5310  /* Tell startup process to finish recovery */
5311  signal_child(StartupPID, SIGUSR2);
5312  }
5313 
5314 #ifdef WIN32
5315  PG_SETMASK(&UnBlockSig);
5316 #endif
5317 
5318  errno = save_errno;
5319 }
5320 
5321 /*
5322  * SIGTERM or SIGQUIT while processing startup packet.
5323  * Clean up and exit(1).
5324  *
5325  * XXX: possible future improvement: try to send a message indicating
5326  * why we are disconnecting. Problem is to be sure we don't block while
5327  * doing so, nor mess up SSL initialization. In practice, if the client
5328  * has wedged here, it probably couldn't do anything with the message anyway.
5329  */
5330 static void
5331 startup_die(SIGNAL_ARGS)
5332 {
5333  proc_exit(1);
5334 }
5335 
5336 /*
5337  * Dummy signal handler
5338  *
5339  * We use this for signals that we don't actually use in the postmaster,
5340  * but we do use in backends. If we were to SIG_IGN such signals in the
5341  * postmaster, then a newly started backend might drop a signal that arrives
5342  * before it's able to reconfigure its signal processing. (See notes in
5343  * tcop/postgres.c.)
5344  */
5345 static void
5346 dummy_handler(SIGNAL_ARGS)
5347 {
5348 }
5349 
5350 /*
5351  * Timeout while processing startup packet.
5352  * As for startup_die(), we clean up and exit(1).
5353  */
5354 static void
5355 StartupPacketTimeoutHandler(void)
5356 {
5357  proc_exit(1);
5358 }
5359 
5360 
5361 /*
5362  * Generate a random cancel key.
5363  */
5364 static bool
5365 RandomCancelKey(int32 *cancel_key)
5366 {
5367  return pg_strong_random(cancel_key, sizeof(int32));
5368 }
5369 
5370 /*
5371  * Count up number of child processes of specified types (dead_end children
5372  * are always excluded).
5373  */
5374 static int
5375 CountChildren(int target)
5376 {
5377  dlist_iter iter;
5378  int cnt = 0;
5379 
5380  dlist_foreach(iter, &BackendList)
5381  {
5382  Backend *bp = dlist_container(Backend, elem, iter.cur);
5383 
5384  if (bp->dead_end)
5385  continue;
5386 
5387  /*
5388  * Since target == BACKEND_TYPE_ALL is the most common case, we test
5389  * it first and avoid touching shared memory for every child.
5390  */
5391  if (target != BACKEND_TYPE_ALL)
5392  {
5393  /*
5394  * Assign bkend_type for any recently announced WAL Sender
5395  * processes.
5396  */
5397  if (bp->bkend_type == BACKEND_TYPE_NORMAL &&
5398  IsPostmasterChildWalSender(bp->child_slot))
5399  bp->bkend_type = BACKEND_TYPE_WALSND;
5400 
5401  if (!(target & bp->bkend_type))
5402  continue;
5403  }
5404 
5405  cnt++;
5406  }
5407  return cnt;
5408 }
5409 
5410 
5411 /*
5412  * StartChildProcess -- start an auxiliary process for the postmaster
5413  *
5414  * "type" determines what kind of child will be started. All child types
5415  * initially go to AuxiliaryProcessMain, which will handle common setup.
5416  *
5417  * Return value of StartChildProcess is subprocess' PID, or 0 if failed
5418  * to start subprocess.
5419  */
5420 static pid_t
5421 StartChildProcess(AuxProcType type)
5422 {
5423  pid_t pid;
5424  char *av[10];
5425  int ac = 0;
5426  char typebuf[32];
5427 
5428  /*
5429  * Set up command-line arguments for subprocess
5430  */
5431  av[ac++] = "postgres";
5432 
5433 #ifdef EXEC_BACKEND
5434  av[ac++] = "--forkboot";
5435  av[ac++] = NULL; /* filled in by postmaster_forkexec */
5436 #endif
5437 
5438  snprintf(typebuf, sizeof(typebuf), "-x%d", type);
5439  av[ac++] = typebuf;
5440 
5441  av[ac] = NULL;
5442  Assert(ac < lengthof(av));
5443 
5444 #ifdef EXEC_BACKEND
5445  pid = postmaster_forkexec(ac, av);
5446 #else /* !EXEC_BACKEND */
5447  pid = fork_process();
5448 
5449  if (pid == 0) /* child */
5450  {
5451  InitPostmasterChild();
5452 
5453  /* Close the postmaster's sockets */
5454  ClosePostmasterPorts(false);
5455 
5456  /* Release postmaster's working memory context */
5457  MemoryContextSwitchTo(TopMemoryContext);
5458  MemoryContextDelete(PostmasterContext);
5459  PostmasterContext = NULL;
5460 
5461  AuxiliaryProcessMain(ac, av);
5462  ExitPostmaster(0);
5463  }
5464 #endif /* EXEC_BACKEND */
5465 
5466  if (pid < 0)
5467  {
5468  /* in parent, fork failed */
5469  int save_errno = errno;
5470 
5471  errno = save_errno;
5472  switch (type)
5473  {
5474  case StartupProcess:
5475  ereport(LOG,
5476  (errmsg("could not fork startup process: %m")));
5477  break;
5478  case BgWriterProcess:
5479  ereport(LOG,
5480  (errmsg("could not fork background writer process: %m")));
5481  break;
5482  case CheckpointerProcess:
5483  ereport(LOG,
5484  (errmsg("could not fork checkpointer process: %m")));
5485  break;
5486  case WalWriterProcess:
5487  ereport(LOG,
5488  (errmsg("could not fork WAL writer process: %m")));
5489  break;
5490  case WalReceiverProcess:
5491  ereport(LOG,
5492  (errmsg("could not fork WAL receiver process: %m")));
5493  break;
5494  default:
5495  ereport(LOG,
5496  (errmsg("could not fork process: %m")));
5497  break;
5498  }
5499 
5500  /*
5501  * fork failure is fatal during startup, but there's no need to choke
5502  * immediately if starting other child types fails.
5503  */
5504  if (type == StartupProcess)
5505  ExitPostmaster(1);
5506  return 0;
5507  }
5508 
5509  /*
5510  * in parent, successful fork
5511  */
5512  return pid;
5513 }
5514 
5515 /*
5516  * StartAutovacuumWorker
5517  * Start an autovac worker process.
5518  *
5519  * This function is here because it enters the resulting PID into the
5520  * postmaster's private backends list.
5521  *
5522  * NB -- this code very roughly matches BackendStartup.
5523  */
5524 static void
5525 StartAutovacuumWorker(void)
5526 {
5527  Backend *bn;
5528 
5529  /*
5530  * If not in condition to run a process, don't try, but handle it like a
5531  * fork failure. This does not normally happen, since the signal is only
5532  * supposed to be sent by autovacuum launcher when it's OK to do it, but
5533  * we have to check to avoid race-condition problems during DB state
5534  * changes.
5535  */
5536  if (canAcceptConnections(BACKEND_TYPE_AUTOVAC) == CAC_OK)
5537  {
5538  /*
5539  * Compute the cancel key that will be assigned to this session. We
5540  * probably don't need cancel keys for autovac workers, but we'd
5541  * better have something random in the field to prevent unfriendly
5542  * people from sending cancels to them.
5543  */
5544  if (!RandomCancelKey(&MyCancelKey))
5545  {
5546  ereport(LOG,
5547  (errcode(ERRCODE_INTERNAL_ERROR),
5548  errmsg("could not generate random cancel key")));
5549  return;
5550  }
5551 
5552  bn = (Backend *) malloc(sizeof(Backend));
5553  if (bn)
5554  {
5555  bn->cancel_key = MyCancelKey;
5556 
5557  /* Autovac workers are not dead_end and need a child slot */
5558  bn->dead_end = false;
5559  bn->child_slot = MyPMChildSlot = AssignPostmasterChildSlot();
5560  bn->bgworker_notify = false;
5561 
5562  bn->pid = StartAutoVacWorker();
5563  if (bn->pid > 0)
5564  {
5565  bn->bkend_type = BACKEND_TYPE_AUTOVAC;
5566  dlist_push_head(&BackendList, &bn->elem);
5567 #ifdef EXEC_BACKEND
5568  ShmemBackendArrayAdd(bn);
5569 #endif
5570  /* all OK */
5571  return;
5572  }
5573 
5574  /*
5575  * fork failed, fall through to report -- actual error message was
5576  * logged by StartAutoVacWorker
5577  */
5578  (void) ReleasePostmasterChildSlot(bn->child_slot);
5579  free(bn);
5580  }
5581  else
5582  ereport(LOG,
5583  (errcode(ERRCODE_OUT_OF_MEMORY),
5584  errmsg("out of memory")));
5585  }
5586 
5587  /*
5588  * Report the failure to the launcher, if it's running. (If it's not, we
5589  * might not even be connected to shared memory, so don't try to call
5590  * AutoVacWorkerFailed.) Note that we also need to signal it so that it
5591  * responds to the condition, but we don't do that here, instead waiting
5592  * for ServerLoop to do it. This way we avoid a ping-pong signalling in
5593  * quick succession between the autovac launcher and postmaster in case
5594  * things get ugly.
5595  */
5596  if (AutoVacPID != 0)
5597  {
5598  AutoVacWorkerFailed();
5599  avlauncher_needs_signal = true;
5600  }
5601 }
5602 
5603 /*
5604  * MaybeStartWalReceiver
5605  * Start the WAL receiver process, if not running and our state allows.
5606  *
5607  * Note: if WalReceiverPID is already nonzero, it might seem that we should
5608  * clear WalReceiverRequested. However, there's a race condition if the
5609  * walreceiver terminates and the startup process immediately requests a new
5610  * one: it's quite possible to get the signal for the request before reaping
5611  * the dead walreceiver process. Better to risk launching an extra
5612  * walreceiver than to miss launching one we need. (The walreceiver code
5613  * has logic to recognize that it should go away if not needed.)
5614  */
5615 static void
5616 MaybeStartWalReceiver(void)
5617 {
5618  if (WalReceiverPID == 0 &&
5619  (pmState == PM_STARTUP || pmState == PM_RECOVERY ||
5620  pmState == PM_HOT_STANDBY || pmState == PM_WAIT_READONLY) &&
5621  Shutdown == NoShutdown)
5622  {
5623  WalReceiverPID = StartWalReceiver();
5624  if (WalReceiverPID != 0)
5625  WalReceiverRequested = false;
5626  /* else leave the flag set, so we'll try again later */
5627  }
5628 }
5629 
5630 
5631 /*
5632  * Create the opts file
5633  */
5634 static bool
5635 CreateOptsFile(int argc, char *argv[], char *fullprogname)
5636 {
5637  FILE *fp;
5638  int i;
5639 
5640 #define OPTS_FILE "postmaster.opts"
5641 
5642  if ((fp = fopen(OPTS_FILE, "w")) == NULL)
5643  {
5644  elog(LOG, "could not create file \"%s\": %m", OPTS_FILE);
5645  return false;
5646  }
5647 
5648  fprintf(fp, "%s", fullprogname);
5649  for (i = 1; i < argc; i++)
5650  fprintf(fp, " \"%s\"", argv[i]);
5651  fputs("\n", fp);
5652 
5653  if (fclose(fp))
5654  {
5655  elog(LOG, "could not write file \"%s\": %m", OPTS_FILE);
5656  return false;
5657  }
5658 
5659  return true;
5660 }
5661 
5662 
5663 /*
5664  * MaxLivePostmasterChildren
5665  *
5666  * This reports the number of entries needed in per-child-process arrays
5667  * (the PMChildFlags array, and if EXEC_BACKEND the ShmemBackendArray).
5668  * These arrays include regular backends, autovac workers, walsenders
5669  * and background workers, but not special children nor dead_end children.
5670  * This allows the arrays to have a fixed maximum size, to wit the same
5671  * too-many-children limit enforced by canAcceptConnections(). The exact value
5672  * isn't too critical as long as it's more than MaxBackends.
5673  */
5674 int
5675 MaxLivePostmasterChildren(void)
5676 {
5677  return 2 * (MaxConnections + autovacuum_max_workers + 1 +
5678  max_wal_senders + max_worker_processes);
5679 }
5680 
5681 /*
5682  * Connect background worker to a database.
5683  */
5684 void
5685 BackgroundWorkerInitializeConnection(const char *dbname, const char *username, uint32 flags)
5686 {
5687  BackgroundWorker *worker = MyBgworkerEntry;
5688 
5689  /* XXX is this the right errcode? */
5690  if (!(worker->bgw_flags & BGWORKER_BACKEND_DATABASE_CONNECTION))
5691  ereport(FATAL,
5692  (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
5693  errmsg("database connection requirement not indicated during registration")));
5694 
5695  InitPostgres(dbname, InvalidOid, username, InvalidOid, NULL, (flags & BGWORKER_BYPASS_ALLOWCONN) != 0);
5696 
5697  /* it had better not gotten out of "init" mode yet */
5698  if (!IsInitProcessingMode())
5699  ereport(ERROR,
5700  (errmsg("invalid processing mode in background worker")));
5701  SetProcessingMode(NormalProcessing);
5702 }
5703 
5704 /*
5705  * Connect background worker to a database using OIDs.
5706  */
5707 void
5708 BackgroundWorkerInitializeConnectionByOid(Oid dboid, Oid useroid, uint32 flags)
5709 {
5710  BackgroundWorker *worker = MyBgworkerEntry;
5711 
5712  /* XXX is this the right errcode? */
5713  if (!(worker->bgw_flags & BGWORKER_BACKEND_DATABASE_CONNECTION))
5714  ereport(FATAL,
5715  (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
5716  errmsg("database connection requirement not indicated during registration")));
5717 
5718  InitPostgres(NULL, dboid, NULL, useroid, NULL, (flags & BGWORKER_BYPASS_ALLOWCONN) != 0);
5719 
5720  /* it had better not gotten out of "init" mode yet */
5721  if (!IsInitProcessingMode())
5722  ereport(ERROR,
5723  (errmsg("invalid processing mode in background worker")));
5724  SetProcessingMode(NormalProcessing);
5725 }
5726 
5727 /*
5728  * Block/unblock signals in a background worker
5729  */
5730 void
5731 BackgroundWorkerBlockSignals(void)
5732 {
5733  PG_SETMASK(&BlockSig);
5734 }
5735 
5736 void
5737 BackgroundWorkerUnblockSignals(void)
5738 {
5739  PG_SETMASK(&UnBlockSig);
5740 }
5741 
5742 #ifdef EXEC_BACKEND
5743 static pid_t
5744 bgworker_forkexec(int shmem_slot)
5745 {
5746  char *av[10];
5747  int ac = 0;
5748  char forkav[MAXPGPATH];
5749 
5750  snprintf(forkav, MAXPGPATH, "--forkbgworker=%d", shmem_slot);
5751 
5752  av[ac++] = "postgres";
5753  av[ac++] = forkav;
5754  av[ac++] = NULL; /* filled in by postmaster_forkexec */
5755  av[ac] = NULL;
5756 
5757  Assert(ac < lengthof(av));
5758 
5759  return postmaster_forkexec(ac, av);
5760 }
5761 #endif
5762 
5763 /*
5764  * Start a new bgworker.
5765  * Starting time conditions must have been checked already.
5766  *
5767  * Returns true on success, false on failure.
5768  * In either case, update the RegisteredBgWorker's state appropriately.
5769  *
5770  * This code is heavily based on autovacuum.c, q.v.
5771  */
5772 static bool
5773 do_start_bgworker(RegisteredBgWorker *rw)
5774 {
5775  pid_t worker_pid;
5776 
5777  Assert(rw->rw_pid == 0);
5778 
5779  /*
5780  * Allocate and assign the Backend element. Note we must do this before
5781  * forking, so that we can handle failures (out of memory or child-process
5782  * slots) cleanly.
5783  *
5784  * Treat failure as though the worker had crashed. That way, the
5785  * postmaster will wait a bit before attempting to start it again; if we
5786  * tried again right away, most likely we'd find ourselves hitting the
5787  * same resource-exhaustion condition.
5788  */
5789  if (!assign_backendlist_entry(rw))
5790  {
5791  rw->rw_crashed_at = GetCurrentTimestamp();
5792  return false;
5793  }
5794 
5795  ereport(DEBUG1,
5796  (errmsg("starting background worker process \"%s\"",
5797  rw->rw_worker.bgw_name)));
5798 
5799 #ifdef EXEC_BACKEND
5800  switch ((worker_pid = bgworker_forkexec(rw->rw_shmem_slot)))
5801 #else
5802  switch ((worker_pid = fork_process()))
5803 #endif
5804  {
5805  case -1:
5806  /* in postmaster, fork failed ... */
5807  ereport(LOG,
5808  (errmsg("could not fork worker process: %m")));
5809  /* undo what assign_backendlist_entry did */
5810  ReleasePostmasterChildSlot(rw->rw_child_slot);
5811  rw->rw_child_slot = 0;
5812  free(rw->rw_backend);
5813  rw->rw_backend = NULL;
5814  /* mark entry as crashed, so we'll try again later */
5815  rw->rw_crashed_at = GetCurrentTimestamp();
5816  break;
5817 
5818 #ifndef EXEC_BACKEND
5819  case 0:
5820  /* in postmaster child ... */
5821  InitPostmasterChild();
5822 
5823  /* Close the postmaster's sockets */
5824  ClosePostmasterPorts(false);
5825 
5826  /*
5827  * Before blowing away PostmasterContext, save this bgworker's
5828  * data where it can find it.
5829  */
5830  MyBgworkerEntry = (BackgroundWorker *)
5831  MemoryContextAlloc(TopMemoryContext, sizeof(BackgroundWorker));
5832  memcpy(MyBgworkerEntry, &rw->rw_worker, sizeof(BackgroundWorker));
5833 
5834  /* Release postmaster's working memory context */
5835  MemoryContextSwitchTo(TopMemoryContext);
5836  MemoryContextDelete(PostmasterContext);
5837  PostmasterContext = NULL;
5838 
5839  StartBackgroundWorker();
5840 
5841  exit(1); /* should not get here */
5842  break;
5843 #endif
5844  default:
5845  /* in postmaster, fork successful ... */
5846  rw->rw_pid = worker_pid;
5847  rw->rw_backend->pid = rw->rw_pid;
5848  ReportBackgroundWorkerPID(rw);
5849  /* add new worker to lists of backends */
5850  dlist_push_head(&BackendList, &rw->rw_backend->elem);
5851 #ifdef EXEC_BACKEND
5852  ShmemBackendArrayAdd(rw->rw_backend);
5853 #endif
5854  return true;
5855  }
5856 
5857  return false;
5858 }
5859 
5860 /*
5861  * Does the current postmaster state require