PostgreSQL Source Code  git master
xlog.c
Go to the documentation of this file.
1 /*-------------------------------------------------------------------------
2  *
3  * xlog.c
4  * PostgreSQL write-ahead log manager
5  *
6  * The Write-Ahead Log (WAL) functionality is split into several source
7  * files, in addition to this one:
8  *
9  * xloginsert.c - Functions for constructing WAL records
10  * xlogrecovery.c - WAL recovery and standby code
11  * xlogreader.c - Facility for reading WAL files and parsing WAL records
12  * xlogutils.c - Helper functions for WAL redo routines
13  *
14  * This file contains functions for coordinating database startup and
15  * checkpointing, and managing the write-ahead log buffers when the
16  * system is running.
17  *
18  * StartupXLOG() is the main entry point of the startup process. It
19  * coordinates database startup, performing WAL recovery, and the
20  * transition from WAL recovery into normal operations.
21  *
22  * XLogInsertRecord() inserts a WAL record into the WAL buffers. Most
23  * callers should not call this directly, but use the functions in
24  * xloginsert.c to construct the WAL record. XLogFlush() can be used
25  * to force the WAL to disk.
26  *
27  * In addition to those, there are many other functions for interrogating
28  * the current system state, and for starting/stopping backups.
29  *
30  *
31  * Portions Copyright (c) 1996-2023, PostgreSQL Global Development Group
32  * Portions Copyright (c) 1994, Regents of the University of California
33  *
34  * src/backend/access/transam/xlog.c
35  *
36  *-------------------------------------------------------------------------
37  */
38 
39 #include "postgres.h"
40 
41 #include <ctype.h>
42 #include <math.h>
43 #include <time.h>
44 #include <fcntl.h>
45 #include <sys/stat.h>
46 #include <sys/time.h>
47 #include <unistd.h>
48 
49 #include "access/clog.h"
50 #include "access/commit_ts.h"
51 #include "access/heaptoast.h"
52 #include "access/multixact.h"
53 #include "access/rewriteheap.h"
54 #include "access/subtrans.h"
55 #include "access/timeline.h"
56 #include "access/transam.h"
57 #include "access/twophase.h"
58 #include "access/xact.h"
59 #include "access/xlog_internal.h"
60 #include "access/xlogarchive.h"
61 #include "access/xloginsert.h"
62 #include "access/xlogprefetcher.h"
63 #include "access/xlogreader.h"
64 #include "access/xlogrecovery.h"
65 #include "access/xlogutils.h"
66 #include "backup/basebackup.h"
67 #include "catalog/catversion.h"
68 #include "catalog/pg_control.h"
69 #include "catalog/pg_database.h"
71 #include "common/file_utils.h"
72 #include "executor/instrument.h"
73 #include "miscadmin.h"
74 #include "pg_trace.h"
75 #include "pgstat.h"
76 #include "port/atomics.h"
77 #include "port/pg_iovec.h"
78 #include "postmaster/bgwriter.h"
79 #include "postmaster/startup.h"
80 #include "postmaster/walwriter.h"
81 #include "replication/logical.h"
82 #include "replication/origin.h"
83 #include "replication/slot.h"
84 #include "replication/snapbuild.h"
86 #include "replication/walsender.h"
87 #include "storage/bufmgr.h"
88 #include "storage/fd.h"
89 #include "storage/ipc.h"
90 #include "storage/large_object.h"
91 #include "storage/latch.h"
92 #include "storage/pmsignal.h"
93 #include "storage/predicate.h"
94 #include "storage/proc.h"
95 #include "storage/procarray.h"
96 #include "storage/reinit.h"
97 #include "storage/smgr.h"
98 #include "storage/spin.h"
99 #include "storage/sync.h"
100 #include "utils/guc_hooks.h"
101 #include "utils/guc_tables.h"
102 #include "utils/memutils.h"
103 #include "utils/ps_status.h"
104 #include "utils/relmapper.h"
105 #include "utils/pg_rusage.h"
106 #include "utils/snapmgr.h"
107 #include "utils/timeout.h"
108 #include "utils/timestamp.h"
109 #include "utils/varlena.h"
110 
112 
113 /* timeline ID to be used when bootstrapping */
114 #define BootstrapTimeLineID 1
115 
116 /* User-settable parameters */
117 int max_wal_size_mb = 1024; /* 1 GB */
118 int min_wal_size_mb = 80; /* 80 MB */
120 int XLOGbuffers = -1;
123 char *XLogArchiveCommand = NULL;
124 bool EnableHotStandby = false;
125 bool fullPageWrites = true;
126 bool wal_log_hints = false;
130 bool wal_init_zero = true;
131 bool wal_recycle = true;
132 bool log_checkpoints = true;
135 int CommitDelay = 0; /* precommit delay in microseconds */
136 int CommitSiblings = 5; /* # concurrent xacts needed to sleep */
139 int wal_decode_buffer_size = 512 * 1024;
140 bool track_wal_io_timing = false;
141 
142 #ifdef WAL_DEBUG
143 bool XLOG_DEBUG = false;
144 #endif
145 
147 
148 /*
149  * Number of WAL insertion locks to use. A higher value allows more insertions
150  * to happen concurrently, but adds some CPU overhead to flushing the WAL,
151  * which needs to iterate all the locks.
152  */
153 #define NUM_XLOGINSERT_LOCKS 8
154 
155 /*
156  * Max distance from last checkpoint, before triggering a new xlog-based
157  * checkpoint.
158  */
160 
161 /* Estimated distance between checkpoints, in bytes */
162 static double CheckPointDistanceEstimate = 0;
163 static double PrevCheckPointDistance = 0;
164 
165 /*
166  * Track whether there were any deferred checks for custom resource managers
167  * specified in wal_consistency_checking.
168  */
170 
171 /*
172  * GUC support
173  */
174 const struct config_enum_entry sync_method_options[] = {
175  {"fsync", SYNC_METHOD_FSYNC, false},
176 #ifdef HAVE_FSYNC_WRITETHROUGH
177  {"fsync_writethrough", SYNC_METHOD_FSYNC_WRITETHROUGH, false},
178 #endif
179  {"fdatasync", SYNC_METHOD_FDATASYNC, false},
180 #ifdef O_SYNC
181  {"open_sync", SYNC_METHOD_OPEN, false},
182 #endif
183 #ifdef O_DSYNC
184  {"open_datasync", SYNC_METHOD_OPEN_DSYNC, false},
185 #endif
186  {NULL, 0, false}
187 };
188 
189 
190 /*
191  * Although only "on", "off", and "always" are documented,
192  * we accept all the likely variants of "on" and "off".
193  */
194 const struct config_enum_entry archive_mode_options[] = {
195  {"always", ARCHIVE_MODE_ALWAYS, false},
196  {"on", ARCHIVE_MODE_ON, false},
197  {"off", ARCHIVE_MODE_OFF, false},
198  {"true", ARCHIVE_MODE_ON, true},
199  {"false", ARCHIVE_MODE_OFF, true},
200  {"yes", ARCHIVE_MODE_ON, true},
201  {"no", ARCHIVE_MODE_OFF, true},
202  {"1", ARCHIVE_MODE_ON, true},
203  {"0", ARCHIVE_MODE_OFF, true},
204  {NULL, 0, false}
205 };
206 
207 /*
208  * Statistics for current checkpoint are collected in this global struct.
209  * Because only the checkpointer or a stand-alone backend can perform
210  * checkpoints, this will be unused in normal backends.
211  */
213 
214 /*
215  * During recovery, lastFullPageWrites keeps track of full_page_writes that
216  * the replayed WAL records indicate. It's initialized with full_page_writes
217  * that the recovery starting checkpoint record indicates, and then updated
218  * each time XLOG_FPW_CHANGE record is replayed.
219  */
220 static bool lastFullPageWrites;
221 
222 /*
223  * Local copy of the state tracked by SharedRecoveryState in shared memory,
224  * It is false if SharedRecoveryState is RECOVERY_STATE_DONE. True actually
225  * means "not known, need to check the shared state".
226  */
227 static bool LocalRecoveryInProgress = true;
228 
229 /*
230  * Local state for XLogInsertAllowed():
231  * 1: unconditionally allowed to insert XLOG
232  * 0: unconditionally not allowed to insert XLOG
233  * -1: must check RecoveryInProgress(); disallow until it is false
234  * Most processes start with -1 and transition to 1 after seeing that recovery
235  * is not in progress. But we can also force the value for special cases.
236  * The coding in XLogInsertAllowed() depends on the first two of these states
237  * being numerically the same as bool true and false.
238  */
239 static int LocalXLogInsertAllowed = -1;
240 
241 /*
242  * ProcLastRecPtr points to the start of the last XLOG record inserted by the
243  * current backend. It is updated for all inserts. XactLastRecEnd points to
244  * end+1 of the last record, and is reset when we end a top-level transaction,
245  * or start a new one; so it can be used to tell if the current transaction has
246  * created any XLOG records.
247  *
248  * While in parallel mode, this may not be fully up to date. When committing,
249  * a transaction can assume this covers all xlog records written either by the
250  * user backend or by any parallel worker which was present at any point during
251  * the transaction. But when aborting, or when still in parallel mode, other
252  * parallel backends may have written WAL records at later LSNs than the value
253  * stored here. The parallel leader advances its own copy, when necessary,
254  * in WaitForParallelWorkersToFinish.
255  */
259 
260 /*
261  * RedoRecPtr is this backend's local copy of the REDO record pointer
262  * (which is almost but not quite the same as a pointer to the most recent
263  * CHECKPOINT record). We update this from the shared-memory copy,
264  * XLogCtl->Insert.RedoRecPtr, whenever we can safely do so (ie, when we
265  * hold an insertion lock). See XLogInsertRecord for details. We are also
266  * allowed to update from XLogCtl->RedoRecPtr if we hold the info_lck;
267  * see GetRedoRecPtr.
268  *
269  * NB: Code that uses this variable must be prepared not only for the
270  * possibility that it may be arbitrarily out of date, but also for the
271  * possibility that it might be set to InvalidXLogRecPtr. We used to
272  * initialize it as a side effect of the first call to RecoveryInProgress(),
273  * which meant that most code that might use it could assume that it had a
274  * real if perhaps stale value. That's no longer the case.
275  */
277 
278 /*
279  * doPageWrites is this backend's local copy of (fullPageWrites ||
280  * runningBackups > 0). It is used together with RedoRecPtr to decide whether
281  * a full-page image of a page need to be taken.
282  *
283  * NB: Initially this is false, and there's no guarantee that it will be
284  * initialized to any other value before it is first used. Any code that
285  * makes use of it must recheck the value after obtaining a WALInsertLock,
286  * and respond appropriately if it turns out that the previous value wasn't
287  * accurate.
288  */
289 static bool doPageWrites;
290 
291 /*----------
292  * Shared-memory data structures for XLOG control
293  *
294  * LogwrtRqst indicates a byte position that we need to write and/or fsync
295  * the log up to (all records before that point must be written or fsynced).
296  * LogwrtResult indicates the byte positions we have already written/fsynced.
297  * These structs are identical but are declared separately to indicate their
298  * slightly different functions.
299  *
300  * To read XLogCtl->LogwrtResult, you must hold either info_lck or
301  * WALWriteLock. To update it, you need to hold both locks. The point of
302  * this arrangement is that the value can be examined by code that already
303  * holds WALWriteLock without needing to grab info_lck as well. In addition
304  * to the shared variable, each backend has a private copy of LogwrtResult,
305  * which is updated when convenient.
306  *
307  * The request bookkeeping is simpler: there is a shared XLogCtl->LogwrtRqst
308  * (protected by info_lck), but we don't need to cache any copies of it.
309  *
310  * info_lck is only held long enough to read/update the protected variables,
311  * so it's a plain spinlock. The other locks are held longer (potentially
312  * over I/O operations), so we use LWLocks for them. These locks are:
313  *
314  * WALBufMappingLock: must be held to replace a page in the WAL buffer cache.
315  * It is only held while initializing and changing the mapping. If the
316  * contents of the buffer being replaced haven't been written yet, the mapping
317  * lock is released while the write is done, and reacquired afterwards.
318  *
319  * WALWriteLock: must be held to write WAL buffers to disk (XLogWrite or
320  * XLogFlush).
321  *
322  * ControlFileLock: must be held to read/update control file or create
323  * new log file.
324  *
325  *----------
326  */
327 
328 typedef struct XLogwrtRqst
329 {
330  XLogRecPtr Write; /* last byte + 1 to write out */
331  XLogRecPtr Flush; /* last byte + 1 to flush */
333 
334 typedef struct XLogwrtResult
335 {
336  XLogRecPtr Write; /* last byte + 1 written out */
337  XLogRecPtr Flush; /* last byte + 1 flushed */
339 
340 /*
341  * Inserting to WAL is protected by a small fixed number of WAL insertion
342  * locks. To insert to the WAL, you must hold one of the locks - it doesn't
343  * matter which one. To lock out other concurrent insertions, you must hold
344  * of them. Each WAL insertion lock consists of a lightweight lock, plus an
345  * indicator of how far the insertion has progressed (insertingAt).
346  *
347  * The insertingAt values are read when a process wants to flush WAL from
348  * the in-memory buffers to disk, to check that all the insertions to the
349  * region the process is about to write out have finished. You could simply
350  * wait for all currently in-progress insertions to finish, but the
351  * insertingAt indicator allows you to ignore insertions to later in the WAL,
352  * so that you only wait for the insertions that are modifying the buffers
353  * you're about to write out.
354  *
355  * This isn't just an optimization. If all the WAL buffers are dirty, an
356  * inserter that's holding a WAL insert lock might need to evict an old WAL
357  * buffer, which requires flushing the WAL. If it's possible for an inserter
358  * to block on another inserter unnecessarily, deadlock can arise when two
359  * inserters holding a WAL insert lock wait for each other to finish their
360  * insertion.
361  *
362  * Small WAL records that don't cross a page boundary never update the value,
363  * the WAL record is just copied to the page and the lock is released. But
364  * to avoid the deadlock-scenario explained above, the indicator is always
365  * updated before sleeping while holding an insertion lock.
366  *
367  * lastImportantAt contains the LSN of the last important WAL record inserted
368  * using a given lock. This value is used to detect if there has been
369  * important WAL activity since the last time some action, like a checkpoint,
370  * was performed - allowing to not repeat the action if not. The LSN is
371  * updated for all insertions, unless the XLOG_MARK_UNIMPORTANT flag was
372  * set. lastImportantAt is never cleared, only overwritten by the LSN of newer
373  * records. Tracking the WAL activity directly in WALInsertLock has the
374  * advantage of not needing any additional locks to update the value.
375  */
376 typedef struct
377 {
381 } WALInsertLock;
382 
383 /*
384  * All the WAL insertion locks are allocated as an array in shared memory. We
385  * force the array stride to be a power of 2, which saves a few cycles in
386  * indexing, but more importantly also ensures that individual slots don't
387  * cross cache line boundaries. (Of course, we have to also ensure that the
388  * array start address is suitably aligned.)
389  */
390 typedef union WALInsertLockPadded
391 {
395 
396 /*
397  * Session status of running backup, used for sanity checks in SQL-callable
398  * functions to start and stop backups.
399  */
401 
402 /*
403  * Shared state data for WAL insertion.
404  */
405 typedef struct XLogCtlInsert
406 {
407  slock_t insertpos_lck; /* protects CurrBytePos and PrevBytePos */
408 
409  /*
410  * CurrBytePos is the end of reserved WAL. The next record will be
411  * inserted at that position. PrevBytePos is the start position of the
412  * previously inserted (or rather, reserved) record - it is copied to the
413  * prev-link of the next record. These are stored as "usable byte
414  * positions" rather than XLogRecPtrs (see XLogBytePosToRecPtr()).
415  */
416  uint64 CurrBytePos;
417  uint64 PrevBytePos;
418 
419  /*
420  * Make sure the above heavily-contended spinlock and byte positions are
421  * on their own cache line. In particular, the RedoRecPtr and full page
422  * write variables below should be on a different cache line. They are
423  * read on every WAL insertion, but updated rarely, and we don't want
424  * those reads to steal the cache line containing Curr/PrevBytePos.
425  */
427 
428  /*
429  * fullPageWrites is the authoritative value used by all backends to
430  * determine whether to write full-page image to WAL. This shared value,
431  * instead of the process-local fullPageWrites, is required because, when
432  * full_page_writes is changed by SIGHUP, we must WAL-log it before it
433  * actually affects WAL-logging by backends. Checkpointer sets at startup
434  * or after SIGHUP.
435  *
436  * To read these fields, you must hold an insertion lock. To modify them,
437  * you must hold ALL the locks.
438  */
439  XLogRecPtr RedoRecPtr; /* current redo point for insertions */
441 
442  /*
443  * runningBackups is a counter indicating the number of backups currently
444  * in progress. lastBackupStart is the latest checkpoint redo location
445  * used as a starting point for an online backup.
446  */
449 
450  /*
451  * WAL insertion locks.
452  */
455 
456 /*
457  * Total shared-memory state for XLOG.
458  */
459 typedef struct XLogCtlData
460 {
462 
463  /* Protected by info_lck: */
465  XLogRecPtr RedoRecPtr; /* a recent copy of Insert->RedoRecPtr */
466  FullTransactionId ckptFullXid; /* nextXid of latest checkpoint */
467  XLogRecPtr asyncXactLSN; /* LSN of newest async commit/abort */
468  XLogRecPtr replicationSlotMinLSN; /* oldest LSN needed by any slot */
469 
470  XLogSegNo lastRemovedSegNo; /* latest removed/recycled XLOG segment */
471 
472  /* Fake LSN counter, for unlogged relations. Protected by ulsn_lck. */
475 
476  /* Time and LSN of last xlog segment switch. Protected by WALWriteLock. */
479 
480  /*
481  * Protected by info_lck and WALWriteLock (you must hold either lock to
482  * read it, but both to update)
483  */
485 
486  /*
487  * Latest initialized page in the cache (last byte position + 1).
488  *
489  * To change the identity of a buffer (and InitializedUpTo), you need to
490  * hold WALBufMappingLock. To change the identity of a buffer that's
491  * still dirty, the old page needs to be written out first, and for that
492  * you need WALWriteLock, and you need to ensure that there are no
493  * in-progress insertions to the page by calling
494  * WaitXLogInsertionsToFinish().
495  */
497 
498  /*
499  * These values do not change after startup, although the pointed-to pages
500  * and xlblocks values certainly do. xlblocks values are protected by
501  * WALBufMappingLock.
502  */
503  char *pages; /* buffers for unwritten XLOG pages */
504  XLogRecPtr *xlblocks; /* 1st byte ptr-s + XLOG_BLCKSZ */
505  int XLogCacheBlck; /* highest allocated xlog buffer index */
506 
507  /*
508  * InsertTimeLineID is the timeline into which new WAL is being inserted
509  * and flushed. It is zero during recovery, and does not change once set.
510  *
511  * If we create a new timeline when the system was started up,
512  * PrevTimeLineID is the old timeline's ID that we forked off from.
513  * Otherwise it's equal to InsertTimeLineID.
514  */
517 
518  /*
519  * SharedRecoveryState indicates if we're still in crash or archive
520  * recovery. Protected by info_lck.
521  */
523 
524  /*
525  * InstallXLogFileSegmentActive indicates whether the checkpointer should
526  * arrange for future segments by recycling and/or PreallocXlogFiles().
527  * Protected by ControlFileLock. Only the startup process changes it. If
528  * true, anyone can use InstallXLogFileSegment(). If false, the startup
529  * process owns the exclusive right to install segments, by reading from
530  * the archive and possibly replacing existing files.
531  */
533 
534  /*
535  * WalWriterSleeping indicates whether the WAL writer is currently in
536  * low-power mode (and hence should be nudged if an async commit occurs).
537  * Protected by info_lck.
538  */
540 
541  /*
542  * During recovery, we keep a copy of the latest checkpoint record here.
543  * lastCheckPointRecPtr points to start of checkpoint record and
544  * lastCheckPointEndPtr points to end+1 of checkpoint record. Used by the
545  * checkpointer when it wants to create a restartpoint.
546  *
547  * Protected by info_lck.
548  */
552 
553  /*
554  * lastFpwDisableRecPtr points to the start of the last replayed
555  * XLOG_FPW_CHANGE record that instructs full_page_writes is disabled.
556  */
558 
559  slock_t info_lck; /* locks shared variables shown above */
561 
562 static XLogCtlData *XLogCtl = NULL;
563 
564 /* a private copy of XLogCtl->Insert.WALInsertLocks, for convenience */
566 
567 /*
568  * We maintain an image of pg_control in shared memory.
569  */
571 
572 /*
573  * Calculate the amount of space left on the page after 'endptr'. Beware
574  * multiple evaluation!
575  */
576 #define INSERT_FREESPACE(endptr) \
577  (((endptr) % XLOG_BLCKSZ == 0) ? 0 : (XLOG_BLCKSZ - (endptr) % XLOG_BLCKSZ))
578 
579 /* Macro to advance to next buffer index. */
580 #define NextBufIdx(idx) \
581  (((idx) == XLogCtl->XLogCacheBlck) ? 0 : ((idx) + 1))
582 
583 /*
584  * XLogRecPtrToBufIdx returns the index of the WAL buffer that holds, or
585  * would hold if it was in cache, the page containing 'recptr'.
586  */
587 #define XLogRecPtrToBufIdx(recptr) \
588  (((recptr) / XLOG_BLCKSZ) % (XLogCtl->XLogCacheBlck + 1))
589 
590 /*
591  * These are the number of bytes in a WAL page usable for WAL data.
592  */
593 #define UsableBytesInPage (XLOG_BLCKSZ - SizeOfXLogShortPHD)
594 
595 /*
596  * Convert values of GUCs measured in megabytes to equiv. segment count.
597  * Rounds down.
598  */
599 #define ConvertToXSegs(x, segsize) XLogMBVarToSegs((x), (segsize))
600 
601 /* The number of bytes in a WAL segment usable for WAL data. */
603 
604 /*
605  * Private, possibly out-of-date copy of shared LogwrtResult.
606  * See discussion above.
607  */
608 static XLogwrtResult LogwrtResult = {0, 0};
609 
610 /*
611  * openLogFile is -1 or a kernel FD for an open log file segment.
612  * openLogSegNo identifies the segment, and openLogTLI the corresponding TLI.
613  * These variables are only used to write the XLOG, and so will normally refer
614  * to the active segment.
615  *
616  * Note: call Reserve/ReleaseExternalFD to track consumption of this FD.
617  */
618 static int openLogFile = -1;
621 
622 /*
623  * Local copies of equivalent fields in the control file. When running
624  * crash recovery, LocalMinRecoveryPoint is set to InvalidXLogRecPtr as we
625  * expect to replay all the WAL available, and updateMinRecoveryPoint is
626  * switched to false to prevent any updates while replaying records.
627  * Those values are kept consistent as long as crash recovery runs.
628  */
631 static bool updateMinRecoveryPoint = true;
632 
633 /* For WALInsertLockAcquire/Release functions */
634 static int MyLockNo = 0;
635 static bool holdingAllLocks = false;
636 
637 #ifdef WAL_DEBUG
638 static MemoryContext walDebugCxt = NULL;
639 #endif
640 
641 static void CleanupAfterArchiveRecovery(TimeLineID EndOfLogTLI,
642  XLogRecPtr EndOfLog,
643  TimeLineID newTLI);
644 static void CheckRequiredParameterValues(void);
645 static void XLogReportParameters(void);
646 static int LocalSetXLogInsertAllowed(void);
647 static void CreateEndOfRecoveryRecord(void);
649  XLogRecPtr pagePtr,
650  TimeLineID newTLI);
651 static void CheckPointGuts(XLogRecPtr checkPointRedo, int flags);
652 static void KeepLogSeg(XLogRecPtr recptr, XLogSegNo *logSegNo);
654 
655 static void AdvanceXLInsertBuffer(XLogRecPtr upto, TimeLineID tli,
656  bool opportunistic);
657 static void XLogWrite(XLogwrtRqst WriteRqst, TimeLineID tli, bool flexible);
658 static bool InstallXLogFileSegment(XLogSegNo *segno, char *tmppath,
659  bool find_free, XLogSegNo max_segno,
660  TimeLineID tli);
661 static void XLogFileClose(void);
662 static void PreallocXlogFiles(XLogRecPtr endptr, TimeLineID tli);
663 static void RemoveTempXlogFiles(void);
664 static void RemoveOldXlogFiles(XLogSegNo segno, XLogRecPtr lastredoptr,
665  XLogRecPtr endptr, TimeLineID insertTLI);
666 static void RemoveXlogFile(const struct dirent *segment_de,
667  XLogSegNo recycleSegNo, XLogSegNo *endlogSegNo,
668  TimeLineID insertTLI);
669 static void UpdateLastRemovedPtr(char *filename);
670 static void ValidateXLOGDirectoryStructure(void);
671 static void CleanupBackupHistory(void);
672 static void UpdateMinRecoveryPoint(XLogRecPtr lsn, bool force);
673 static bool PerformRecoveryXLogAction(void);
674 static void InitControlFile(uint64 sysidentifier);
675 static void WriteControlFile(void);
676 static void ReadControlFile(void);
677 static void UpdateControlFile(void);
678 static char *str_time(pg_time_t tnow);
679 
680 static int get_sync_bit(int method);
681 
682 static void CopyXLogRecordToWAL(int write_len, bool isLogSwitch,
683  XLogRecData *rdata,
684  XLogRecPtr StartPos, XLogRecPtr EndPos,
685  TimeLineID tli);
686 static void ReserveXLogInsertLocation(int size, XLogRecPtr *StartPos,
687  XLogRecPtr *EndPos, XLogRecPtr *PrevPtr);
688 static bool ReserveXLogSwitch(XLogRecPtr *StartPos, XLogRecPtr *EndPos,
689  XLogRecPtr *PrevPtr);
691 static char *GetXLogBuffer(XLogRecPtr ptr, TimeLineID tli);
692 static XLogRecPtr XLogBytePosToRecPtr(uint64 bytepos);
693 static XLogRecPtr XLogBytePosToEndRecPtr(uint64 bytepos);
694 static uint64 XLogRecPtrToBytePos(XLogRecPtr ptr);
695 
696 static void WALInsertLockAcquire(void);
697 static void WALInsertLockAcquireExclusive(void);
698 static void WALInsertLockRelease(void);
699 static void WALInsertLockUpdateInsertingAt(XLogRecPtr insertingAt);
700 
701 /*
702  * Insert an XLOG record represented by an already-constructed chain of data
703  * chunks. This is a low-level routine; to construct the WAL record header
704  * and data, use the higher-level routines in xloginsert.c.
705  *
706  * If 'fpw_lsn' is valid, it is the oldest LSN among the pages that this
707  * WAL record applies to, that were not included in the record as full page
708  * images. If fpw_lsn <= RedoRecPtr, the function does not perform the
709  * insertion and returns InvalidXLogRecPtr. The caller can then recalculate
710  * which pages need a full-page image, and retry. If fpw_lsn is invalid, the
711  * record is always inserted.
712  *
713  * 'flags' gives more in-depth control on the record being inserted. See
714  * XLogSetRecordFlags() for details.
715  *
716  * 'topxid_included' tells whether the top-transaction id is logged along with
717  * current subtransaction. See XLogRecordAssemble().
718  *
719  * The first XLogRecData in the chain must be for the record header, and its
720  * data must be MAXALIGNed. XLogInsertRecord fills in the xl_prev and
721  * xl_crc fields in the header, the rest of the header must already be filled
722  * by the caller.
723  *
724  * Returns XLOG pointer to end of record (beginning of next record).
725  * This can be used as LSN for data pages affected by the logged action.
726  * (LSN is the XLOG point up to which the XLOG must be flushed to disk
727  * before the data page can be written out. This implements the basic
728  * WAL rule "write the log before the data".)
729  */
732  XLogRecPtr fpw_lsn,
733  uint8 flags,
734  int num_fpi,
735  bool topxid_included)
736 {
738  pg_crc32c rdata_crc;
739  bool inserted;
740  XLogRecord *rechdr = (XLogRecord *) rdata->data;
741  uint8 info = rechdr->xl_info & ~XLR_INFO_MASK;
742  bool isLogSwitch = (rechdr->xl_rmid == RM_XLOG_ID &&
743  info == XLOG_SWITCH);
744  XLogRecPtr StartPos;
745  XLogRecPtr EndPos;
746  bool prevDoPageWrites = doPageWrites;
747  TimeLineID insertTLI;
748 
749  /* we assume that all of the record header is in the first chunk */
750  Assert(rdata->len >= SizeOfXLogRecord);
751 
752  /* cross-check on whether we should be here or not */
753  if (!XLogInsertAllowed())
754  elog(ERROR, "cannot make new WAL entries during recovery");
755 
756  /*
757  * Given that we're not in recovery, InsertTimeLineID is set and can't
758  * change, so we can read it without a lock.
759  */
760  insertTLI = XLogCtl->InsertTimeLineID;
761 
762  /*----------
763  *
764  * We have now done all the preparatory work we can without holding a
765  * lock or modifying shared state. From here on, inserting the new WAL
766  * record to the shared WAL buffer cache is a two-step process:
767  *
768  * 1. Reserve the right amount of space from the WAL. The current head of
769  * reserved space is kept in Insert->CurrBytePos, and is protected by
770  * insertpos_lck.
771  *
772  * 2. Copy the record to the reserved WAL space. This involves finding the
773  * correct WAL buffer containing the reserved space, and copying the
774  * record in place. This can be done concurrently in multiple processes.
775  *
776  * To keep track of which insertions are still in-progress, each concurrent
777  * inserter acquires an insertion lock. In addition to just indicating that
778  * an insertion is in progress, the lock tells others how far the inserter
779  * has progressed. There is a small fixed number of insertion locks,
780  * determined by NUM_XLOGINSERT_LOCKS. When an inserter crosses a page
781  * boundary, it updates the value stored in the lock to the how far it has
782  * inserted, to allow the previous buffer to be flushed.
783  *
784  * Holding onto an insertion lock also protects RedoRecPtr and
785  * fullPageWrites from changing until the insertion is finished.
786  *
787  * Step 2 can usually be done completely in parallel. If the required WAL
788  * page is not initialized yet, you have to grab WALBufMappingLock to
789  * initialize it, but the WAL writer tries to do that ahead of insertions
790  * to avoid that from happening in the critical path.
791  *
792  *----------
793  */
795  if (isLogSwitch)
797  else
799 
800  /*
801  * Check to see if my copy of RedoRecPtr is out of date. If so, may have
802  * to go back and have the caller recompute everything. This can only
803  * happen just after a checkpoint, so it's better to be slow in this case
804  * and fast otherwise.
805  *
806  * Also check to see if fullPageWrites was just turned on or there's a
807  * running backup (which forces full-page writes); if we weren't already
808  * doing full-page writes then go back and recompute.
809  *
810  * If we aren't doing full-page writes then RedoRecPtr doesn't actually
811  * affect the contents of the XLOG record, so we'll update our local copy
812  * but not force a recomputation. (If doPageWrites was just turned off,
813  * we could recompute the record without full pages, but we choose not to
814  * bother.)
815  */
816  if (RedoRecPtr != Insert->RedoRecPtr)
817  {
818  Assert(RedoRecPtr < Insert->RedoRecPtr);
819  RedoRecPtr = Insert->RedoRecPtr;
820  }
821  doPageWrites = (Insert->fullPageWrites || Insert->runningBackups > 0);
822 
823  if (doPageWrites &&
824  (!prevDoPageWrites ||
825  (fpw_lsn != InvalidXLogRecPtr && fpw_lsn <= RedoRecPtr)))
826  {
827  /*
828  * Oops, some buffer now needs to be backed up that the caller didn't
829  * back up. Start over.
830  */
833  return InvalidXLogRecPtr;
834  }
835 
836  /*
837  * Reserve space for the record in the WAL. This also sets the xl_prev
838  * pointer.
839  */
840  if (isLogSwitch)
841  inserted = ReserveXLogSwitch(&StartPos, &EndPos, &rechdr->xl_prev);
842  else
843  {
844  ReserveXLogInsertLocation(rechdr->xl_tot_len, &StartPos, &EndPos,
845  &rechdr->xl_prev);
846  inserted = true;
847  }
848 
849  if (inserted)
850  {
851  /*
852  * Now that xl_prev has been filled in, calculate CRC of the record
853  * header.
854  */
855  rdata_crc = rechdr->xl_crc;
856  COMP_CRC32C(rdata_crc, rechdr, offsetof(XLogRecord, xl_crc));
857  FIN_CRC32C(rdata_crc);
858  rechdr->xl_crc = rdata_crc;
859 
860  /*
861  * All the record data, including the header, is now ready to be
862  * inserted. Copy the record in the space reserved.
863  */
864  CopyXLogRecordToWAL(rechdr->xl_tot_len, isLogSwitch, rdata,
865  StartPos, EndPos, insertTLI);
866 
867  /*
868  * Unless record is flagged as not important, update LSN of last
869  * important record in the current slot. When holding all locks, just
870  * update the first one.
871  */
872  if ((flags & XLOG_MARK_UNIMPORTANT) == 0)
873  {
874  int lockno = holdingAllLocks ? 0 : MyLockNo;
875 
876  WALInsertLocks[lockno].l.lastImportantAt = StartPos;
877  }
878  }
879  else
880  {
881  /*
882  * This was an xlog-switch record, but the current insert location was
883  * already exactly at the beginning of a segment, so there was no need
884  * to do anything.
885  */
886  }
887 
888  /*
889  * Done! Let others know that we're finished.
890  */
892 
894 
896 
897  /*
898  * Mark top transaction id is logged (if needed) so that we should not try
899  * to log it again with the next WAL record in the current subtransaction.
900  */
901  if (topxid_included)
903 
904  /*
905  * Update shared LogwrtRqst.Write, if we crossed page boundary.
906  */
907  if (StartPos / XLOG_BLCKSZ != EndPos / XLOG_BLCKSZ)
908  {
910  /* advance global request to include new block(s) */
911  if (XLogCtl->LogwrtRqst.Write < EndPos)
912  XLogCtl->LogwrtRqst.Write = EndPos;
913  /* update local result copy while I have the chance */
916  }
917 
918  /*
919  * If this was an XLOG_SWITCH record, flush the record and the empty
920  * padding space that fills the rest of the segment, and perform
921  * end-of-segment actions (eg, notifying archiver).
922  */
923  if (isLogSwitch)
924  {
925  TRACE_POSTGRESQL_WAL_SWITCH();
926  XLogFlush(EndPos);
927 
928  /*
929  * Even though we reserved the rest of the segment for us, which is
930  * reflected in EndPos, we return a pointer to just the end of the
931  * xlog-switch record.
932  */
933  if (inserted)
934  {
935  EndPos = StartPos + SizeOfXLogRecord;
936  if (StartPos / XLOG_BLCKSZ != EndPos / XLOG_BLCKSZ)
937  {
938  uint64 offset = XLogSegmentOffset(EndPos, wal_segment_size);
939 
940  if (offset == EndPos % XLOG_BLCKSZ)
941  EndPos += SizeOfXLogLongPHD;
942  else
943  EndPos += SizeOfXLogShortPHD;
944  }
945  }
946  }
947 
948 #ifdef WAL_DEBUG
949  if (XLOG_DEBUG)
950  {
951  static XLogReaderState *debug_reader = NULL;
952  XLogRecord *record;
953  DecodedXLogRecord *decoded;
955  StringInfoData recordBuf;
956  char *errormsg = NULL;
957  MemoryContext oldCxt;
958 
959  oldCxt = MemoryContextSwitchTo(walDebugCxt);
960 
962  appendStringInfo(&buf, "INSERT @ %X/%X: ", LSN_FORMAT_ARGS(EndPos));
963 
964  /*
965  * We have to piece together the WAL record data from the XLogRecData
966  * entries, so that we can pass it to the rm_desc function as one
967  * contiguous chunk.
968  */
969  initStringInfo(&recordBuf);
970  for (; rdata != NULL; rdata = rdata->next)
971  appendBinaryStringInfo(&recordBuf, rdata->data, rdata->len);
972 
973  /* We also need temporary space to decode the record. */
974  record = (XLogRecord *) recordBuf.data;
975  decoded = (DecodedXLogRecord *)
977 
978  if (!debug_reader)
979  debug_reader = XLogReaderAllocate(wal_segment_size, NULL,
980  XL_ROUTINE(), NULL);
981 
982  if (!debug_reader)
983  {
984  appendStringInfoString(&buf, "error decoding record: out of memory while allocating a WAL reading processor");
985  }
986  else if (!DecodeXLogRecord(debug_reader,
987  decoded,
988  record,
989  EndPos,
990  &errormsg))
991  {
992  appendStringInfo(&buf, "error decoding record: %s",
993  errormsg ? errormsg : "no error message");
994  }
995  else
996  {
997  appendStringInfoString(&buf, " - ");
998 
999  debug_reader->record = decoded;
1000  xlog_outdesc(&buf, debug_reader);
1001  debug_reader->record = NULL;
1002  }
1003  elog(LOG, "%s", buf.data);
1004 
1005  pfree(decoded);
1006  pfree(buf.data);
1007  pfree(recordBuf.data);
1008  MemoryContextSwitchTo(oldCxt);
1009  }
1010 #endif
1011 
1012  /*
1013  * Update our global variables
1014  */
1015  ProcLastRecPtr = StartPos;
1016  XactLastRecEnd = EndPos;
1017 
1018  /* Report WAL traffic to the instrumentation. */
1019  if (inserted)
1020  {
1021  pgWalUsage.wal_bytes += rechdr->xl_tot_len;
1023  pgWalUsage.wal_fpi += num_fpi;
1024  }
1025 
1026  return EndPos;
1027 }
1028 
1029 /*
1030  * Reserves the right amount of space for a record of given size from the WAL.
1031  * *StartPos is set to the beginning of the reserved section, *EndPos to
1032  * its end+1. *PrevPtr is set to the beginning of the previous record; it is
1033  * used to set the xl_prev of this record.
1034  *
1035  * This is the performance critical part of XLogInsert that must be serialized
1036  * across backends. The rest can happen mostly in parallel. Try to keep this
1037  * section as short as possible, insertpos_lck can be heavily contended on a
1038  * busy system.
1039  *
1040  * NB: The space calculation here must match the code in CopyXLogRecordToWAL,
1041  * where we actually copy the record to the reserved space.
1042  */
1043 static void
1044 ReserveXLogInsertLocation(int size, XLogRecPtr *StartPos, XLogRecPtr *EndPos,
1045  XLogRecPtr *PrevPtr)
1046 {
1048  uint64 startbytepos;
1049  uint64 endbytepos;
1050  uint64 prevbytepos;
1051 
1052  size = MAXALIGN(size);
1053 
1054  /* All (non xlog-switch) records should contain data. */
1055  Assert(size > SizeOfXLogRecord);
1056 
1057  /*
1058  * The duration the spinlock needs to be held is minimized by minimizing
1059  * the calculations that have to be done while holding the lock. The
1060  * current tip of reserved WAL is kept in CurrBytePos, as a byte position
1061  * that only counts "usable" bytes in WAL, that is, it excludes all WAL
1062  * page headers. The mapping between "usable" byte positions and physical
1063  * positions (XLogRecPtrs) can be done outside the locked region, and
1064  * because the usable byte position doesn't include any headers, reserving
1065  * X bytes from WAL is almost as simple as "CurrBytePos += X".
1066  */
1067  SpinLockAcquire(&Insert->insertpos_lck);
1068 
1069  startbytepos = Insert->CurrBytePos;
1070  endbytepos = startbytepos + size;
1071  prevbytepos = Insert->PrevBytePos;
1072  Insert->CurrBytePos = endbytepos;
1073  Insert->PrevBytePos = startbytepos;
1074 
1075  SpinLockRelease(&Insert->insertpos_lck);
1076 
1077  *StartPos = XLogBytePosToRecPtr(startbytepos);
1078  *EndPos = XLogBytePosToEndRecPtr(endbytepos);
1079  *PrevPtr = XLogBytePosToRecPtr(prevbytepos);
1080 
1081  /*
1082  * Check that the conversions between "usable byte positions" and
1083  * XLogRecPtrs work consistently in both directions.
1084  */
1085  Assert(XLogRecPtrToBytePos(*StartPos) == startbytepos);
1086  Assert(XLogRecPtrToBytePos(*EndPos) == endbytepos);
1087  Assert(XLogRecPtrToBytePos(*PrevPtr) == prevbytepos);
1088 }
1089 
1090 /*
1091  * Like ReserveXLogInsertLocation(), but for an xlog-switch record.
1092  *
1093  * A log-switch record is handled slightly differently. The rest of the
1094  * segment will be reserved for this insertion, as indicated by the returned
1095  * *EndPos value. However, if we are already at the beginning of the current
1096  * segment, *StartPos and *EndPos are set to the current location without
1097  * reserving any space, and the function returns false.
1098 */
1099 static bool
1100 ReserveXLogSwitch(XLogRecPtr *StartPos, XLogRecPtr *EndPos, XLogRecPtr *PrevPtr)
1101 {
1103  uint64 startbytepos;
1104  uint64 endbytepos;
1105  uint64 prevbytepos;
1107  XLogRecPtr ptr;
1108  uint32 segleft;
1109 
1110  /*
1111  * These calculations are a bit heavy-weight to be done while holding a
1112  * spinlock, but since we're holding all the WAL insertion locks, there
1113  * are no other inserters competing for it. GetXLogInsertRecPtr() does
1114  * compete for it, but that's not called very frequently.
1115  */
1116  SpinLockAcquire(&Insert->insertpos_lck);
1117 
1118  startbytepos = Insert->CurrBytePos;
1119 
1120  ptr = XLogBytePosToEndRecPtr(startbytepos);
1121  if (XLogSegmentOffset(ptr, wal_segment_size) == 0)
1122  {
1123  SpinLockRelease(&Insert->insertpos_lck);
1124  *EndPos = *StartPos = ptr;
1125  return false;
1126  }
1127 
1128  endbytepos = startbytepos + size;
1129  prevbytepos = Insert->PrevBytePos;
1130 
1131  *StartPos = XLogBytePosToRecPtr(startbytepos);
1132  *EndPos = XLogBytePosToEndRecPtr(endbytepos);
1133 
1134  segleft = wal_segment_size - XLogSegmentOffset(*EndPos, wal_segment_size);
1135  if (segleft != wal_segment_size)
1136  {
1137  /* consume the rest of the segment */
1138  *EndPos += segleft;
1139  endbytepos = XLogRecPtrToBytePos(*EndPos);
1140  }
1141  Insert->CurrBytePos = endbytepos;
1142  Insert->PrevBytePos = startbytepos;
1143 
1144  SpinLockRelease(&Insert->insertpos_lck);
1145 
1146  *PrevPtr = XLogBytePosToRecPtr(prevbytepos);
1147 
1148  Assert(XLogSegmentOffset(*EndPos, wal_segment_size) == 0);
1149  Assert(XLogRecPtrToBytePos(*EndPos) == endbytepos);
1150  Assert(XLogRecPtrToBytePos(*StartPos) == startbytepos);
1151  Assert(XLogRecPtrToBytePos(*PrevPtr) == prevbytepos);
1152 
1153  return true;
1154 }
1155 
1156 /*
1157  * Subroutine of XLogInsertRecord. Copies a WAL record to an already-reserved
1158  * area in the WAL.
1159  */
1160 static void
1161 CopyXLogRecordToWAL(int write_len, bool isLogSwitch, XLogRecData *rdata,
1162  XLogRecPtr StartPos, XLogRecPtr EndPos, TimeLineID tli)
1163 {
1164  char *currpos;
1165  int freespace;
1166  int written;
1167  XLogRecPtr CurrPos;
1168  XLogPageHeader pagehdr;
1169 
1170  /*
1171  * Get a pointer to the right place in the right WAL buffer to start
1172  * inserting to.
1173  */
1174  CurrPos = StartPos;
1175  currpos = GetXLogBuffer(CurrPos, tli);
1176  freespace = INSERT_FREESPACE(CurrPos);
1177 
1178  /*
1179  * there should be enough space for at least the first field (xl_tot_len)
1180  * on this page.
1181  */
1182  Assert(freespace >= sizeof(uint32));
1183 
1184  /* Copy record data */
1185  written = 0;
1186  while (rdata != NULL)
1187  {
1188  char *rdata_data = rdata->data;
1189  int rdata_len = rdata->len;
1190 
1191  while (rdata_len > freespace)
1192  {
1193  /*
1194  * Write what fits on this page, and continue on the next page.
1195  */
1196  Assert(CurrPos % XLOG_BLCKSZ >= SizeOfXLogShortPHD || freespace == 0);
1197  memcpy(currpos, rdata_data, freespace);
1198  rdata_data += freespace;
1199  rdata_len -= freespace;
1200  written += freespace;
1201  CurrPos += freespace;
1202 
1203  /*
1204  * Get pointer to beginning of next page, and set the xlp_rem_len
1205  * in the page header. Set XLP_FIRST_IS_CONTRECORD.
1206  *
1207  * It's safe to set the contrecord flag and xlp_rem_len without a
1208  * lock on the page. All the other flags were already set when the
1209  * page was initialized, in AdvanceXLInsertBuffer, and we're the
1210  * only backend that needs to set the contrecord flag.
1211  */
1212  currpos = GetXLogBuffer(CurrPos, tli);
1213  pagehdr = (XLogPageHeader) currpos;
1214  pagehdr->xlp_rem_len = write_len - written;
1215  pagehdr->xlp_info |= XLP_FIRST_IS_CONTRECORD;
1216 
1217  /* skip over the page header */
1218  if (XLogSegmentOffset(CurrPos, wal_segment_size) == 0)
1219  {
1220  CurrPos += SizeOfXLogLongPHD;
1221  currpos += SizeOfXLogLongPHD;
1222  }
1223  else
1224  {
1225  CurrPos += SizeOfXLogShortPHD;
1226  currpos += SizeOfXLogShortPHD;
1227  }
1228  freespace = INSERT_FREESPACE(CurrPos);
1229  }
1230 
1231  Assert(CurrPos % XLOG_BLCKSZ >= SizeOfXLogShortPHD || rdata_len == 0);
1232  memcpy(currpos, rdata_data, rdata_len);
1233  currpos += rdata_len;
1234  CurrPos += rdata_len;
1235  freespace -= rdata_len;
1236  written += rdata_len;
1237 
1238  rdata = rdata->next;
1239  }
1240  Assert(written == write_len);
1241 
1242  /*
1243  * If this was an xlog-switch, it's not enough to write the switch record,
1244  * we also have to consume all the remaining space in the WAL segment. We
1245  * have already reserved that space, but we need to actually fill it.
1246  */
1247  if (isLogSwitch && XLogSegmentOffset(CurrPos, wal_segment_size) != 0)
1248  {
1249  /* An xlog-switch record doesn't contain any data besides the header */
1250  Assert(write_len == SizeOfXLogRecord);
1251 
1252  /* Assert that we did reserve the right amount of space */
1253  Assert(XLogSegmentOffset(EndPos, wal_segment_size) == 0);
1254 
1255  /* Use up all the remaining space on the current page */
1256  CurrPos += freespace;
1257 
1258  /*
1259  * Cause all remaining pages in the segment to be flushed, leaving the
1260  * XLog position where it should be, at the start of the next segment.
1261  * We do this one page at a time, to make sure we don't deadlock
1262  * against ourselves if wal_buffers < wal_segment_size.
1263  */
1264  while (CurrPos < EndPos)
1265  {
1266  /*
1267  * The minimal action to flush the page would be to call
1268  * WALInsertLockUpdateInsertingAt(CurrPos) followed by
1269  * AdvanceXLInsertBuffer(...). The page would be left initialized
1270  * mostly to zeros, except for the page header (always the short
1271  * variant, as this is never a segment's first page).
1272  *
1273  * The large vistas of zeros are good for compressibility, but the
1274  * headers interrupting them every XLOG_BLCKSZ (with values that
1275  * differ from page to page) are not. The effect varies with
1276  * compression tool, but bzip2 for instance compresses about an
1277  * order of magnitude worse if those headers are left in place.
1278  *
1279  * Rather than complicating AdvanceXLInsertBuffer itself (which is
1280  * called in heavily-loaded circumstances as well as this lightly-
1281  * loaded one) with variant behavior, we just use GetXLogBuffer
1282  * (which itself calls the two methods we need) to get the pointer
1283  * and zero most of the page. Then we just zero the page header.
1284  */
1285  currpos = GetXLogBuffer(CurrPos, tli);
1286  MemSet(currpos, 0, SizeOfXLogShortPHD);
1287 
1288  CurrPos += XLOG_BLCKSZ;
1289  }
1290  }
1291  else
1292  {
1293  /* Align the end position, so that the next record starts aligned */
1294  CurrPos = MAXALIGN64(CurrPos);
1295  }
1296 
1297  if (CurrPos != EndPos)
1298  elog(PANIC, "space reserved for WAL record does not match what was written");
1299 }
1300 
1301 /*
1302  * Acquire a WAL insertion lock, for inserting to WAL.
1303  */
1304 static void
1306 {
1307  bool immed;
1308 
1309  /*
1310  * It doesn't matter which of the WAL insertion locks we acquire, so try
1311  * the one we used last time. If the system isn't particularly busy, it's
1312  * a good bet that it's still available, and it's good to have some
1313  * affinity to a particular lock so that you don't unnecessarily bounce
1314  * cache lines between processes when there's no contention.
1315  *
1316  * If this is the first time through in this backend, pick a lock
1317  * (semi-)randomly. This allows the locks to be used evenly if you have a
1318  * lot of very short connections.
1319  */
1320  static int lockToTry = -1;
1321 
1322  if (lockToTry == -1)
1323  lockToTry = MyProc->pgprocno % NUM_XLOGINSERT_LOCKS;
1324  MyLockNo = lockToTry;
1325 
1326  /*
1327  * The insertingAt value is initially set to 0, as we don't know our
1328  * insert location yet.
1329  */
1331  if (!immed)
1332  {
1333  /*
1334  * If we couldn't get the lock immediately, try another lock next
1335  * time. On a system with more insertion locks than concurrent
1336  * inserters, this causes all the inserters to eventually migrate to a
1337  * lock that no-one else is using. On a system with more inserters
1338  * than locks, it still helps to distribute the inserters evenly
1339  * across the locks.
1340  */
1341  lockToTry = (lockToTry + 1) % NUM_XLOGINSERT_LOCKS;
1342  }
1343 }
1344 
1345 /*
1346  * Acquire all WAL insertion locks, to prevent other backends from inserting
1347  * to WAL.
1348  */
1349 static void
1351 {
1352  int i;
1353 
1354  /*
1355  * When holding all the locks, all but the last lock's insertingAt
1356  * indicator is set to 0xFFFFFFFFFFFFFFFF, which is higher than any real
1357  * XLogRecPtr value, to make sure that no-one blocks waiting on those.
1358  */
1359  for (i = 0; i < NUM_XLOGINSERT_LOCKS - 1; i++)
1360  {
1362  LWLockUpdateVar(&WALInsertLocks[i].l.lock,
1364  PG_UINT64_MAX);
1365  }
1366  /* Variable value reset to 0 at release */
1368 
1369  holdingAllLocks = true;
1370 }
1371 
1372 /*
1373  * Release our insertion lock (or locks, if we're holding them all).
1374  *
1375  * NB: Reset all variables to 0, so they cause LWLockWaitForVar to block the
1376  * next time the lock is acquired.
1377  */
1378 static void
1380 {
1381  if (holdingAllLocks)
1382  {
1383  int i;
1384 
1385  for (i = 0; i < NUM_XLOGINSERT_LOCKS; i++)
1388  0);
1389 
1390  holdingAllLocks = false;
1391  }
1392  else
1393  {
1396  0);
1397  }
1398 }
1399 
1400 /*
1401  * Update our insertingAt value, to let others know that we've finished
1402  * inserting up to that point.
1403  */
1404 static void
1406 {
1407  if (holdingAllLocks)
1408  {
1409  /*
1410  * We use the last lock to mark our actual position, see comments in
1411  * WALInsertLockAcquireExclusive.
1412  */
1415  insertingAt);
1416  }
1417  else
1420  insertingAt);
1421 }
1422 
1423 /*
1424  * Wait for any WAL insertions < upto to finish.
1425  *
1426  * Returns the location of the oldest insertion that is still in-progress.
1427  * Any WAL prior to that point has been fully copied into WAL buffers, and
1428  * can be flushed out to disk. Because this waits for any insertions older
1429  * than 'upto' to finish, the return value is always >= 'upto'.
1430  *
1431  * Note: When you are about to write out WAL, you must call this function
1432  * *before* acquiring WALWriteLock, to avoid deadlocks. This function might
1433  * need to wait for an insertion to finish (or at least advance to next
1434  * uninitialized page), and the inserter might need to evict an old WAL buffer
1435  * to make room for a new one, which in turn requires WALWriteLock.
1436  */
1437 static XLogRecPtr
1439 {
1440  uint64 bytepos;
1441  XLogRecPtr reservedUpto;
1442  XLogRecPtr finishedUpto;
1444  int i;
1445 
1446  if (MyProc == NULL)
1447  elog(PANIC, "cannot wait without a PGPROC structure");
1448 
1449  /* Read the current insert position */
1450  SpinLockAcquire(&Insert->insertpos_lck);
1451  bytepos = Insert->CurrBytePos;
1452  SpinLockRelease(&Insert->insertpos_lck);
1453  reservedUpto = XLogBytePosToEndRecPtr(bytepos);
1454 
1455  /*
1456  * No-one should request to flush a piece of WAL that hasn't even been
1457  * reserved yet. However, it can happen if there is a block with a bogus
1458  * LSN on disk, for example. XLogFlush checks for that situation and
1459  * complains, but only after the flush. Here we just assume that to mean
1460  * that all WAL that has been reserved needs to be finished. In this
1461  * corner-case, the return value can be smaller than 'upto' argument.
1462  */
1463  if (upto > reservedUpto)
1464  {
1465  ereport(LOG,
1466  (errmsg("request to flush past end of generated WAL; request %X/%X, current position %X/%X",
1467  LSN_FORMAT_ARGS(upto), LSN_FORMAT_ARGS(reservedUpto))));
1468  upto = reservedUpto;
1469  }
1470 
1471  /*
1472  * Loop through all the locks, sleeping on any in-progress insert older
1473  * than 'upto'.
1474  *
1475  * finishedUpto is our return value, indicating the point upto which all
1476  * the WAL insertions have been finished. Initialize it to the head of
1477  * reserved WAL, and as we iterate through the insertion locks, back it
1478  * out for any insertion that's still in progress.
1479  */
1480  finishedUpto = reservedUpto;
1481  for (i = 0; i < NUM_XLOGINSERT_LOCKS; i++)
1482  {
1483  XLogRecPtr insertingat = InvalidXLogRecPtr;
1484 
1485  do
1486  {
1487  /*
1488  * See if this insertion is in progress. LWLockWaitForVar will
1489  * wait for the lock to be released, or for the 'value' to be set
1490  * by a LWLockUpdateVar call. When a lock is initially acquired,
1491  * its value is 0 (InvalidXLogRecPtr), which means that we don't
1492  * know where it's inserting yet. We will have to wait for it. If
1493  * it's a small insertion, the record will most likely fit on the
1494  * same page and the inserter will release the lock without ever
1495  * calling LWLockUpdateVar. But if it has to sleep, it will
1496  * advertise the insertion point with LWLockUpdateVar before
1497  * sleeping.
1498  */
1499  if (LWLockWaitForVar(&WALInsertLocks[i].l.lock,
1501  insertingat, &insertingat))
1502  {
1503  /* the lock was free, so no insertion in progress */
1504  insertingat = InvalidXLogRecPtr;
1505  break;
1506  }
1507 
1508  /*
1509  * This insertion is still in progress. Have to wait, unless the
1510  * inserter has proceeded past 'upto'.
1511  */
1512  } while (insertingat < upto);
1513 
1514  if (insertingat != InvalidXLogRecPtr && insertingat < finishedUpto)
1515  finishedUpto = insertingat;
1516  }
1517  return finishedUpto;
1518 }
1519 
1520 /*
1521  * Get a pointer to the right location in the WAL buffer containing the
1522  * given XLogRecPtr.
1523  *
1524  * If the page is not initialized yet, it is initialized. That might require
1525  * evicting an old dirty buffer from the buffer cache, which means I/O.
1526  *
1527  * The caller must ensure that the page containing the requested location
1528  * isn't evicted yet, and won't be evicted. The way to ensure that is to
1529  * hold onto a WAL insertion lock with the insertingAt position set to
1530  * something <= ptr. GetXLogBuffer() will update insertingAt if it needs
1531  * to evict an old page from the buffer. (This means that once you call
1532  * GetXLogBuffer() with a given 'ptr', you must not access anything before
1533  * that point anymore, and must not call GetXLogBuffer() with an older 'ptr'
1534  * later, because older buffers might be recycled already)
1535  */
1536 static char *
1538 {
1539  int idx;
1540  XLogRecPtr endptr;
1541  static uint64 cachedPage = 0;
1542  static char *cachedPos = NULL;
1543  XLogRecPtr expectedEndPtr;
1544 
1545  /*
1546  * Fast path for the common case that we need to access again the same
1547  * page as last time.
1548  */
1549  if (ptr / XLOG_BLCKSZ == cachedPage)
1550  {
1551  Assert(((XLogPageHeader) cachedPos)->xlp_magic == XLOG_PAGE_MAGIC);
1552  Assert(((XLogPageHeader) cachedPos)->xlp_pageaddr == ptr - (ptr % XLOG_BLCKSZ));
1553  return cachedPos + ptr % XLOG_BLCKSZ;
1554  }
1555 
1556  /*
1557  * The XLog buffer cache is organized so that a page is always loaded to a
1558  * particular buffer. That way we can easily calculate the buffer a given
1559  * page must be loaded into, from the XLogRecPtr alone.
1560  */
1561  idx = XLogRecPtrToBufIdx(ptr);
1562 
1563  /*
1564  * See what page is loaded in the buffer at the moment. It could be the
1565  * page we're looking for, or something older. It can't be anything newer
1566  * - that would imply the page we're looking for has already been written
1567  * out to disk and evicted, and the caller is responsible for making sure
1568  * that doesn't happen.
1569  *
1570  * However, we don't hold a lock while we read the value. If someone has
1571  * just initialized the page, it's possible that we get a "torn read" of
1572  * the XLogRecPtr if 64-bit fetches are not atomic on this platform. In
1573  * that case we will see a bogus value. That's ok, we'll grab the mapping
1574  * lock (in AdvanceXLInsertBuffer) and retry if we see anything else than
1575  * the page we're looking for. But it means that when we do this unlocked
1576  * read, we might see a value that appears to be ahead of the page we're
1577  * looking for. Don't PANIC on that, until we've verified the value while
1578  * holding the lock.
1579  */
1580  expectedEndPtr = ptr;
1581  expectedEndPtr += XLOG_BLCKSZ - ptr % XLOG_BLCKSZ;
1582 
1583  endptr = XLogCtl->xlblocks[idx];
1584  if (expectedEndPtr != endptr)
1585  {
1586  XLogRecPtr initializedUpto;
1587 
1588  /*
1589  * Before calling AdvanceXLInsertBuffer(), which can block, let others
1590  * know how far we're finished with inserting the record.
1591  *
1592  * NB: If 'ptr' points to just after the page header, advertise a
1593  * position at the beginning of the page rather than 'ptr' itself. If
1594  * there are no other insertions running, someone might try to flush
1595  * up to our advertised location. If we advertised a position after
1596  * the page header, someone might try to flush the page header, even
1597  * though page might actually not be initialized yet. As the first
1598  * inserter on the page, we are effectively responsible for making
1599  * sure that it's initialized, before we let insertingAt to move past
1600  * the page header.
1601  */
1602  if (ptr % XLOG_BLCKSZ == SizeOfXLogShortPHD &&
1603  XLogSegmentOffset(ptr, wal_segment_size) > XLOG_BLCKSZ)
1604  initializedUpto = ptr - SizeOfXLogShortPHD;
1605  else if (ptr % XLOG_BLCKSZ == SizeOfXLogLongPHD &&
1606  XLogSegmentOffset(ptr, wal_segment_size) < XLOG_BLCKSZ)
1607  initializedUpto = ptr - SizeOfXLogLongPHD;
1608  else
1609  initializedUpto = ptr;
1610 
1611  WALInsertLockUpdateInsertingAt(initializedUpto);
1612 
1613  AdvanceXLInsertBuffer(ptr, tli, false);
1614  endptr = XLogCtl->xlblocks[idx];
1615 
1616  if (expectedEndPtr != endptr)
1617  elog(PANIC, "could not find WAL buffer for %X/%X",
1618  LSN_FORMAT_ARGS(ptr));
1619  }
1620  else
1621  {
1622  /*
1623  * Make sure the initialization of the page is visible to us, and
1624  * won't arrive later to overwrite the WAL data we write on the page.
1625  */
1627  }
1628 
1629  /*
1630  * Found the buffer holding this page. Return a pointer to the right
1631  * offset within the page.
1632  */
1633  cachedPage = ptr / XLOG_BLCKSZ;
1634  cachedPos = XLogCtl->pages + idx * (Size) XLOG_BLCKSZ;
1635 
1636  Assert(((XLogPageHeader) cachedPos)->xlp_magic == XLOG_PAGE_MAGIC);
1637  Assert(((XLogPageHeader) cachedPos)->xlp_pageaddr == ptr - (ptr % XLOG_BLCKSZ));
1638 
1639  return cachedPos + ptr % XLOG_BLCKSZ;
1640 }
1641 
1642 /*
1643  * Converts a "usable byte position" to XLogRecPtr. A usable byte position
1644  * is the position starting from the beginning of WAL, excluding all WAL
1645  * page headers.
1646  */
1647 static XLogRecPtr
1648 XLogBytePosToRecPtr(uint64 bytepos)
1649 {
1650  uint64 fullsegs;
1651  uint64 fullpages;
1652  uint64 bytesleft;
1653  uint32 seg_offset;
1654  XLogRecPtr result;
1655 
1656  fullsegs = bytepos / UsableBytesInSegment;
1657  bytesleft = bytepos % UsableBytesInSegment;
1658 
1659  if (bytesleft < XLOG_BLCKSZ - SizeOfXLogLongPHD)
1660  {
1661  /* fits on first page of segment */
1662  seg_offset = bytesleft + SizeOfXLogLongPHD;
1663  }
1664  else
1665  {
1666  /* account for the first page on segment with long header */
1667  seg_offset = XLOG_BLCKSZ;
1668  bytesleft -= XLOG_BLCKSZ - SizeOfXLogLongPHD;
1669 
1670  fullpages = bytesleft / UsableBytesInPage;
1671  bytesleft = bytesleft % UsableBytesInPage;
1672 
1673  seg_offset += fullpages * XLOG_BLCKSZ + bytesleft + SizeOfXLogShortPHD;
1674  }
1675 
1676  XLogSegNoOffsetToRecPtr(fullsegs, seg_offset, wal_segment_size, result);
1677 
1678  return result;
1679 }
1680 
1681 /*
1682  * Like XLogBytePosToRecPtr, but if the position is at a page boundary,
1683  * returns a pointer to the beginning of the page (ie. before page header),
1684  * not to where the first xlog record on that page would go to. This is used
1685  * when converting a pointer to the end of a record.
1686  */
1687 static XLogRecPtr
1688 XLogBytePosToEndRecPtr(uint64 bytepos)
1689 {
1690  uint64 fullsegs;
1691  uint64 fullpages;
1692  uint64 bytesleft;
1693  uint32 seg_offset;
1694  XLogRecPtr result;
1695 
1696  fullsegs = bytepos / UsableBytesInSegment;
1697  bytesleft = bytepos % UsableBytesInSegment;
1698 
1699  if (bytesleft < XLOG_BLCKSZ - SizeOfXLogLongPHD)
1700  {
1701  /* fits on first page of segment */
1702  if (bytesleft == 0)
1703  seg_offset = 0;
1704  else
1705  seg_offset = bytesleft + SizeOfXLogLongPHD;
1706  }
1707  else
1708  {
1709  /* account for the first page on segment with long header */
1710  seg_offset = XLOG_BLCKSZ;
1711  bytesleft -= XLOG_BLCKSZ - SizeOfXLogLongPHD;
1712 
1713  fullpages = bytesleft / UsableBytesInPage;
1714  bytesleft = bytesleft % UsableBytesInPage;
1715 
1716  if (bytesleft == 0)
1717  seg_offset += fullpages * XLOG_BLCKSZ + bytesleft;
1718  else
1719  seg_offset += fullpages * XLOG_BLCKSZ + bytesleft + SizeOfXLogShortPHD;
1720  }
1721 
1722  XLogSegNoOffsetToRecPtr(fullsegs, seg_offset, wal_segment_size, result);
1723 
1724  return result;
1725 }
1726 
1727 /*
1728  * Convert an XLogRecPtr to a "usable byte position".
1729  */
1730 static uint64
1732 {
1733  uint64 fullsegs;
1734  uint32 fullpages;
1735  uint32 offset;
1736  uint64 result;
1737 
1738  XLByteToSeg(ptr, fullsegs, wal_segment_size);
1739 
1740  fullpages = (XLogSegmentOffset(ptr, wal_segment_size)) / XLOG_BLCKSZ;
1741  offset = ptr % XLOG_BLCKSZ;
1742 
1743  if (fullpages == 0)
1744  {
1745  result = fullsegs * UsableBytesInSegment;
1746  if (offset > 0)
1747  {
1748  Assert(offset >= SizeOfXLogLongPHD);
1749  result += offset - SizeOfXLogLongPHD;
1750  }
1751  }
1752  else
1753  {
1754  result = fullsegs * UsableBytesInSegment +
1755  (XLOG_BLCKSZ - SizeOfXLogLongPHD) + /* account for first page */
1756  (fullpages - 1) * UsableBytesInPage; /* full pages */
1757  if (offset > 0)
1758  {
1759  Assert(offset >= SizeOfXLogShortPHD);
1760  result += offset - SizeOfXLogShortPHD;
1761  }
1762  }
1763 
1764  return result;
1765 }
1766 
1767 /*
1768  * Initialize XLOG buffers, writing out old buffers if they still contain
1769  * unwritten data, upto the page containing 'upto'. Or if 'opportunistic' is
1770  * true, initialize as many pages as we can without having to write out
1771  * unwritten data. Any new pages are initialized to zeros, with pages headers
1772  * initialized properly.
1773  */
1774 static void
1775 AdvanceXLInsertBuffer(XLogRecPtr upto, TimeLineID tli, bool opportunistic)
1776 {
1778  int nextidx;
1779  XLogRecPtr OldPageRqstPtr;
1780  XLogwrtRqst WriteRqst;
1781  XLogRecPtr NewPageEndPtr = InvalidXLogRecPtr;
1782  XLogRecPtr NewPageBeginPtr;
1783  XLogPageHeader NewPage;
1784  int npages pg_attribute_unused() = 0;
1785 
1786  LWLockAcquire(WALBufMappingLock, LW_EXCLUSIVE);
1787 
1788  /*
1789  * Now that we have the lock, check if someone initialized the page
1790  * already.
1791  */
1792  while (upto >= XLogCtl->InitializedUpTo || opportunistic)
1793  {
1795 
1796  /*
1797  * Get ending-offset of the buffer page we need to replace (this may
1798  * be zero if the buffer hasn't been used yet). Fall through if it's
1799  * already written out.
1800  */
1801  OldPageRqstPtr = XLogCtl->xlblocks[nextidx];
1802  if (LogwrtResult.Write < OldPageRqstPtr)
1803  {
1804  /*
1805  * Nope, got work to do. If we just want to pre-initialize as much
1806  * as we can without flushing, give up now.
1807  */
1808  if (opportunistic)
1809  break;
1810 
1811  /* Before waiting, get info_lck and update LogwrtResult */
1813  if (XLogCtl->LogwrtRqst.Write < OldPageRqstPtr)
1814  XLogCtl->LogwrtRqst.Write = OldPageRqstPtr;
1817 
1818  /*
1819  * Now that we have an up-to-date LogwrtResult value, see if we
1820  * still need to write it or if someone else already did.
1821  */
1822  if (LogwrtResult.Write < OldPageRqstPtr)
1823  {
1824  /*
1825  * Must acquire write lock. Release WALBufMappingLock first,
1826  * to make sure that all insertions that we need to wait for
1827  * can finish (up to this same position). Otherwise we risk
1828  * deadlock.
1829  */
1830  LWLockRelease(WALBufMappingLock);
1831 
1832  WaitXLogInsertionsToFinish(OldPageRqstPtr);
1833 
1834  LWLockAcquire(WALWriteLock, LW_EXCLUSIVE);
1835 
1837  if (LogwrtResult.Write >= OldPageRqstPtr)
1838  {
1839  /* OK, someone wrote it already */
1840  LWLockRelease(WALWriteLock);
1841  }
1842  else
1843  {
1844  /* Have to write it ourselves */
1845  TRACE_POSTGRESQL_WAL_BUFFER_WRITE_DIRTY_START();
1846  WriteRqst.Write = OldPageRqstPtr;
1847  WriteRqst.Flush = 0;
1848  XLogWrite(WriteRqst, tli, false);
1849  LWLockRelease(WALWriteLock);
1851  TRACE_POSTGRESQL_WAL_BUFFER_WRITE_DIRTY_DONE();
1852  }
1853  /* Re-acquire WALBufMappingLock and retry */
1854  LWLockAcquire(WALBufMappingLock, LW_EXCLUSIVE);
1855  continue;
1856  }
1857  }
1858 
1859  /*
1860  * Now the next buffer slot is free and we can set it up to be the
1861  * next output page.
1862  */
1863  NewPageBeginPtr = XLogCtl->InitializedUpTo;
1864  NewPageEndPtr = NewPageBeginPtr + XLOG_BLCKSZ;
1865 
1866  Assert(XLogRecPtrToBufIdx(NewPageBeginPtr) == nextidx);
1867 
1868  NewPage = (XLogPageHeader) (XLogCtl->pages + nextidx * (Size) XLOG_BLCKSZ);
1869 
1870  /*
1871  * Be sure to re-zero the buffer so that bytes beyond what we've
1872  * written will look like zeroes and not valid XLOG records...
1873  */
1874  MemSet((char *) NewPage, 0, XLOG_BLCKSZ);
1875 
1876  /*
1877  * Fill the new page's header
1878  */
1879  NewPage->xlp_magic = XLOG_PAGE_MAGIC;
1880 
1881  /* NewPage->xlp_info = 0; */ /* done by memset */
1882  NewPage->xlp_tli = tli;
1883  NewPage->xlp_pageaddr = NewPageBeginPtr;
1884 
1885  /* NewPage->xlp_rem_len = 0; */ /* done by memset */
1886 
1887  /*
1888  * If online backup is not in progress, mark the header to indicate
1889  * that WAL records beginning in this page have removable backup
1890  * blocks. This allows the WAL archiver to know whether it is safe to
1891  * compress archived WAL data by transforming full-block records into
1892  * the non-full-block format. It is sufficient to record this at the
1893  * page level because we force a page switch (in fact a segment
1894  * switch) when starting a backup, so the flag will be off before any
1895  * records can be written during the backup. At the end of a backup,
1896  * the last page will be marked as all unsafe when perhaps only part
1897  * is unsafe, but at worst the archiver would miss the opportunity to
1898  * compress a few records.
1899  */
1900  if (Insert->runningBackups == 0)
1901  NewPage->xlp_info |= XLP_BKP_REMOVABLE;
1902 
1903  /*
1904  * If first page of an XLOG segment file, make it a long header.
1905  */
1906  if ((XLogSegmentOffset(NewPage->xlp_pageaddr, wal_segment_size)) == 0)
1907  {
1908  XLogLongPageHeader NewLongPage = (XLogLongPageHeader) NewPage;
1909 
1910  NewLongPage->xlp_sysid = ControlFile->system_identifier;
1911  NewLongPage->xlp_seg_size = wal_segment_size;
1912  NewLongPage->xlp_xlog_blcksz = XLOG_BLCKSZ;
1913  NewPage->xlp_info |= XLP_LONG_HEADER;
1914  }
1915 
1916  /*
1917  * Make sure the initialization of the page becomes visible to others
1918  * before the xlblocks update. GetXLogBuffer() reads xlblocks without
1919  * holding a lock.
1920  */
1921  pg_write_barrier();
1922 
1923  *((volatile XLogRecPtr *) &XLogCtl->xlblocks[nextidx]) = NewPageEndPtr;
1924 
1925  XLogCtl->InitializedUpTo = NewPageEndPtr;
1926 
1927  npages++;
1928  }
1929  LWLockRelease(WALBufMappingLock);
1930 
1931 #ifdef WAL_DEBUG
1932  if (XLOG_DEBUG && npages > 0)
1933  {
1934  elog(DEBUG1, "initialized %d pages, up to %X/%X",
1935  npages, LSN_FORMAT_ARGS(NewPageEndPtr));
1936  }
1937 #endif
1938 }
1939 
1940 /*
1941  * Calculate CheckPointSegments based on max_wal_size_mb and
1942  * checkpoint_completion_target.
1943  */
1944 static void
1946 {
1947  double target;
1948 
1949  /*-------
1950  * Calculate the distance at which to trigger a checkpoint, to avoid
1951  * exceeding max_wal_size_mb. This is based on two assumptions:
1952  *
1953  * a) we keep WAL for only one checkpoint cycle (prior to PG11 we kept
1954  * WAL for two checkpoint cycles to allow us to recover from the
1955  * secondary checkpoint if the first checkpoint failed, though we
1956  * only did this on the primary anyway, not on standby. Keeping just
1957  * one checkpoint simplifies processing and reduces disk space in
1958  * many smaller databases.)
1959  * b) during checkpoint, we consume checkpoint_completion_target *
1960  * number of segments consumed between checkpoints.
1961  *-------
1962  */
1963  target = (double) ConvertToXSegs(max_wal_size_mb, wal_segment_size) /
1965 
1966  /* round down */
1967  CheckPointSegments = (int) target;
1968 
1969  if (CheckPointSegments < 1)
1970  CheckPointSegments = 1;
1971 }
1972 
1973 void
1974 assign_max_wal_size(int newval, void *extra)
1975 {
1978 }
1979 
1980 void
1982 {
1985 }
1986 
1987 /*
1988  * At a checkpoint, how many WAL segments to recycle as preallocated future
1989  * XLOG segments? Returns the highest segment that should be preallocated.
1990  */
1991 static XLogSegNo
1993 {
1994  XLogSegNo minSegNo;
1995  XLogSegNo maxSegNo;
1996  double distance;
1997  XLogSegNo recycleSegNo;
1998 
1999  /*
2000  * Calculate the segment numbers that min_wal_size_mb and max_wal_size_mb
2001  * correspond to. Always recycle enough segments to meet the minimum, and
2002  * remove enough segments to stay below the maximum.
2003  */
2004  minSegNo = lastredoptr / wal_segment_size +
2006  maxSegNo = lastredoptr / wal_segment_size +
2008 
2009  /*
2010  * Between those limits, recycle enough segments to get us through to the
2011  * estimated end of next checkpoint.
2012  *
2013  * To estimate where the next checkpoint will finish, assume that the
2014  * system runs steadily consuming CheckPointDistanceEstimate bytes between
2015  * every checkpoint.
2016  */
2018  /* add 10% for good measure. */
2019  distance *= 1.10;
2020 
2021  recycleSegNo = (XLogSegNo) ceil(((double) lastredoptr + distance) /
2023 
2024  if (recycleSegNo < minSegNo)
2025  recycleSegNo = minSegNo;
2026  if (recycleSegNo > maxSegNo)
2027  recycleSegNo = maxSegNo;
2028 
2029  return recycleSegNo;
2030 }
2031 
2032 /*
2033  * Check whether we've consumed enough xlog space that a checkpoint is needed.
2034  *
2035  * new_segno indicates a log file that has just been filled up (or read
2036  * during recovery). We measure the distance from RedoRecPtr to new_segno
2037  * and see if that exceeds CheckPointSegments.
2038  *
2039  * Note: it is caller's responsibility that RedoRecPtr is up-to-date.
2040  */
2041 bool
2043 {
2044  XLogSegNo old_segno;
2045 
2047 
2048  if (new_segno >= old_segno + (uint64) (CheckPointSegments - 1))
2049  return true;
2050  return false;
2051 }
2052 
2053 /*
2054  * Write and/or fsync the log at least as far as WriteRqst indicates.
2055  *
2056  * If flexible == true, we don't have to write as far as WriteRqst, but
2057  * may stop at any convenient boundary (such as a cache or logfile boundary).
2058  * This option allows us to avoid uselessly issuing multiple writes when a
2059  * single one would do.
2060  *
2061  * Must be called with WALWriteLock held. WaitXLogInsertionsToFinish(WriteRqst)
2062  * must be called before grabbing the lock, to make sure the data is ready to
2063  * write.
2064  */
2065 static void
2066 XLogWrite(XLogwrtRqst WriteRqst, TimeLineID tli, bool flexible)
2067 {
2068  bool ispartialpage;
2069  bool last_iteration;
2070  bool finishing_seg;
2071  int curridx;
2072  int npages;
2073  int startidx;
2074  uint32 startoffset;
2075 
2076  /* We should always be inside a critical section here */
2077  Assert(CritSectionCount > 0);
2078 
2079  /*
2080  * Update local LogwrtResult (caller probably did this already, but...)
2081  */
2083 
2084  /*
2085  * Since successive pages in the xlog cache are consecutively allocated,
2086  * we can usually gather multiple pages together and issue just one
2087  * write() call. npages is the number of pages we have determined can be
2088  * written together; startidx is the cache block index of the first one,
2089  * and startoffset is the file offset at which it should go. The latter
2090  * two variables are only valid when npages > 0, but we must initialize
2091  * all of them to keep the compiler quiet.
2092  */
2093  npages = 0;
2094  startidx = 0;
2095  startoffset = 0;
2096 
2097  /*
2098  * Within the loop, curridx is the cache block index of the page to
2099  * consider writing. Begin at the buffer containing the next unwritten
2100  * page, or last partially written page.
2101  */
2103 
2104  while (LogwrtResult.Write < WriteRqst.Write)
2105  {
2106  /*
2107  * Make sure we're not ahead of the insert process. This could happen
2108  * if we're passed a bogus WriteRqst.Write that is past the end of the
2109  * last page that's been initialized by AdvanceXLInsertBuffer.
2110  */
2111  XLogRecPtr EndPtr = XLogCtl->xlblocks[curridx];
2112 
2113  if (LogwrtResult.Write >= EndPtr)
2114  elog(PANIC, "xlog write request %X/%X is past end of log %X/%X",
2116  LSN_FORMAT_ARGS(EndPtr));
2117 
2118  /* Advance LogwrtResult.Write to end of current buffer page */
2119  LogwrtResult.Write = EndPtr;
2120  ispartialpage = WriteRqst.Write < LogwrtResult.Write;
2121 
2124  {
2125  /*
2126  * Switch to new logfile segment. We cannot have any pending
2127  * pages here (since we dump what we have at segment end).
2128  */
2129  Assert(npages == 0);
2130  if (openLogFile >= 0)
2131  XLogFileClose();
2134  openLogTLI = tli;
2135 
2136  /* create/use new log file */
2139  }
2140 
2141  /* Make sure we have the current logfile open */
2142  if (openLogFile < 0)
2143  {
2146  openLogTLI = tli;
2149  }
2150 
2151  /* Add current page to the set of pending pages-to-dump */
2152  if (npages == 0)
2153  {
2154  /* first of group */
2155  startidx = curridx;
2156  startoffset = XLogSegmentOffset(LogwrtResult.Write - XLOG_BLCKSZ,
2158  }
2159  npages++;
2160 
2161  /*
2162  * Dump the set if this will be the last loop iteration, or if we are
2163  * at the last page of the cache area (since the next page won't be
2164  * contiguous in memory), or if we are at the end of the logfile
2165  * segment.
2166  */
2167  last_iteration = WriteRqst.Write <= LogwrtResult.Write;
2168 
2169  finishing_seg = !ispartialpage &&
2170  (startoffset + npages * XLOG_BLCKSZ) >= wal_segment_size;
2171 
2172  if (last_iteration ||
2173  curridx == XLogCtl->XLogCacheBlck ||
2174  finishing_seg)
2175  {
2176  char *from;
2177  Size nbytes;
2178  Size nleft;
2179  int written;
2180  instr_time start;
2181 
2182  /* OK to write the page(s) */
2183  from = XLogCtl->pages + startidx * (Size) XLOG_BLCKSZ;
2184  nbytes = npages * (Size) XLOG_BLCKSZ;
2185  nleft = nbytes;
2186  do
2187  {
2188  errno = 0;
2189 
2190  /* Measure I/O timing to write WAL data */
2191  if (track_wal_io_timing)
2192  INSTR_TIME_SET_CURRENT(start);
2193  else
2194  INSTR_TIME_SET_ZERO(start);
2195 
2197  written = pg_pwrite(openLogFile, from, nleft, startoffset);
2199 
2200  /*
2201  * Increment the I/O timing and the number of times WAL data
2202  * were written out to disk.
2203  */
2204  if (track_wal_io_timing)
2205  {
2207 
2210  }
2211 
2213 
2214  if (written <= 0)
2215  {
2216  char xlogfname[MAXFNAMELEN];
2217  int save_errno;
2218 
2219  if (errno == EINTR)
2220  continue;
2221 
2222  save_errno = errno;
2223  XLogFileName(xlogfname, tli, openLogSegNo,
2225  errno = save_errno;
2226  ereport(PANIC,
2228  errmsg("could not write to log file %s "
2229  "at offset %u, length %zu: %m",
2230  xlogfname, startoffset, nleft)));
2231  }
2232  nleft -= written;
2233  from += written;
2234  startoffset += written;
2235  } while (nleft > 0);
2236 
2237  npages = 0;
2238 
2239  /*
2240  * If we just wrote the whole last page of a logfile segment,
2241  * fsync the segment immediately. This avoids having to go back
2242  * and re-open prior segments when an fsync request comes along
2243  * later. Doing it here ensures that one and only one backend will
2244  * perform this fsync.
2245  *
2246  * This is also the right place to notify the Archiver that the
2247  * segment is ready to copy to archival storage, and to update the
2248  * timer for archive_timeout, and to signal for a checkpoint if
2249  * too many logfile segments have been used since the last
2250  * checkpoint.
2251  */
2252  if (finishing_seg)
2253  {
2255 
2256  /* signal that we need to wakeup walsenders later */
2258 
2259  LogwrtResult.Flush = LogwrtResult.Write; /* end of page */
2260 
2261  if (XLogArchivingActive())
2263 
2264  XLogCtl->lastSegSwitchTime = (pg_time_t) time(NULL);
2266 
2267  /*
2268  * Request a checkpoint if we've consumed too much xlog since
2269  * the last one. For speed, we first check using the local
2270  * copy of RedoRecPtr, which might be out of date; if it looks
2271  * like a checkpoint is needed, forcibly update RedoRecPtr and
2272  * recheck.
2273  */
2275  {
2276  (void) GetRedoRecPtr();
2279  }
2280  }
2281  }
2282 
2283  if (ispartialpage)
2284  {
2285  /* Only asked to write a partial page */
2286  LogwrtResult.Write = WriteRqst.Write;
2287  break;
2288  }
2289  curridx = NextBufIdx(curridx);
2290 
2291  /* If flexible, break out of loop as soon as we wrote something */
2292  if (flexible && npages == 0)
2293  break;
2294  }
2295 
2296  Assert(npages == 0);
2297 
2298  /*
2299  * If asked to flush, do so
2300  */
2301  if (LogwrtResult.Flush < WriteRqst.Flush &&
2303  {
2304  /*
2305  * Could get here without iterating above loop, in which case we might
2306  * have no open file or the wrong one. However, we do not need to
2307  * fsync more than one file.
2308  */
2309  if (sync_method != SYNC_METHOD_OPEN &&
2311  {
2312  if (openLogFile >= 0 &&
2315  XLogFileClose();
2316  if (openLogFile < 0)
2317  {
2320  openLogTLI = tli;
2323  }
2324 
2326  }
2327 
2328  /* signal that we need to wakeup walsenders later */
2330 
2332  }
2333 
2334  /*
2335  * Update shared-memory status
2336  *
2337  * We make sure that the shared 'request' values do not fall behind the
2338  * 'result' values. This is not absolutely essential, but it saves some
2339  * code in a couple of places.
2340  */
2341  {
2349  }
2350 }
2351 
2352 /*
2353  * Record the LSN for an asynchronous transaction commit/abort
2354  * and nudge the WALWriter if there is work for it to do.
2355  * (This should not be called for synchronous commits.)
2356  */
2357 void
2359 {
2360  XLogRecPtr WriteRqstPtr = asyncXactLSN;
2361  bool sleeping;
2362 
2365  sleeping = XLogCtl->WalWriterSleeping;
2366  if (XLogCtl->asyncXactLSN < asyncXactLSN)
2367  XLogCtl->asyncXactLSN = asyncXactLSN;
2369 
2370  /*
2371  * If the WALWriter is sleeping, we should kick it to make it come out of
2372  * low-power mode. Otherwise, determine whether there's a full page of
2373  * WAL available to write.
2374  */
2375  if (!sleeping)
2376  {
2377  /* back off to last completed page boundary */
2378  WriteRqstPtr -= WriteRqstPtr % XLOG_BLCKSZ;
2379 
2380  /* if we have already flushed that far, we're done */
2381  if (WriteRqstPtr <= LogwrtResult.Flush)
2382  return;
2383  }
2384 
2385  /*
2386  * Nudge the WALWriter: it has a full page of WAL to write, or we want it
2387  * to come out of low-power mode so that this async commit will reach disk
2388  * within the expected amount of time.
2389  */
2392 }
2393 
2394 /*
2395  * Record the LSN up to which we can remove WAL because it's not required by
2396  * any replication slot.
2397  */
2398 void
2400 {
2404 }
2405 
2406 
2407 /*
2408  * Return the oldest LSN we must retain to satisfy the needs of some
2409  * replication slot.
2410  */
2411 static XLogRecPtr
2413 {
2414  XLogRecPtr retval;
2415 
2417  retval = XLogCtl->replicationSlotMinLSN;
2419 
2420  return retval;
2421 }
2422 
2423 /*
2424  * Advance minRecoveryPoint in control file.
2425  *
2426  * If we crash during recovery, we must reach this point again before the
2427  * database is consistent.
2428  *
2429  * If 'force' is true, 'lsn' argument is ignored. Otherwise, minRecoveryPoint
2430  * is only updated if it's not already greater than or equal to 'lsn'.
2431  */
2432 static void
2434 {
2435  /* Quick check using our local copy of the variable */
2436  if (!updateMinRecoveryPoint || (!force && lsn <= LocalMinRecoveryPoint))
2437  return;
2438 
2439  /*
2440  * An invalid minRecoveryPoint means that we need to recover all the WAL,
2441  * i.e., we're doing crash recovery. We never modify the control file's
2442  * value in that case, so we can short-circuit future checks here too. The
2443  * local values of minRecoveryPoint and minRecoveryPointTLI should not be
2444  * updated until crash recovery finishes. We only do this for the startup
2445  * process as it should not update its own reference of minRecoveryPoint
2446  * until it has finished crash recovery to make sure that all WAL
2447  * available is replayed in this case. This also saves from extra locks
2448  * taken on the control file from the startup process.
2449  */
2451  {
2452  updateMinRecoveryPoint = false;
2453  return;
2454  }
2455 
2456  LWLockAcquire(ControlFileLock, LW_EXCLUSIVE);
2457 
2458  /* update local copy */
2461 
2463  updateMinRecoveryPoint = false;
2464  else if (force || LocalMinRecoveryPoint < lsn)
2465  {
2466  XLogRecPtr newMinRecoveryPoint;
2467  TimeLineID newMinRecoveryPointTLI;
2468 
2469  /*
2470  * To avoid having to update the control file too often, we update it
2471  * all the way to the last record being replayed, even though 'lsn'
2472  * would suffice for correctness. This also allows the 'force' case
2473  * to not need a valid 'lsn' value.
2474  *
2475  * Another important reason for doing it this way is that the passed
2476  * 'lsn' value could be bogus, i.e., past the end of available WAL, if
2477  * the caller got it from a corrupted heap page. Accepting such a
2478  * value as the min recovery point would prevent us from coming up at
2479  * all. Instead, we just log a warning and continue with recovery.
2480  * (See also the comments about corrupt LSNs in XLogFlush.)
2481  */
2482  newMinRecoveryPoint = GetCurrentReplayRecPtr(&newMinRecoveryPointTLI);
2483  if (!force && newMinRecoveryPoint < lsn)
2484  elog(WARNING,
2485  "xlog min recovery request %X/%X is past current point %X/%X",
2486  LSN_FORMAT_ARGS(lsn), LSN_FORMAT_ARGS(newMinRecoveryPoint));
2487 
2488  /* update control file */
2489  if (ControlFile->minRecoveryPoint < newMinRecoveryPoint)
2490  {
2491  ControlFile->minRecoveryPoint = newMinRecoveryPoint;
2492  ControlFile->minRecoveryPointTLI = newMinRecoveryPointTLI;
2494  LocalMinRecoveryPoint = newMinRecoveryPoint;
2495  LocalMinRecoveryPointTLI = newMinRecoveryPointTLI;
2496 
2497  ereport(DEBUG2,
2498  (errmsg_internal("updated min recovery point to %X/%X on timeline %u",
2499  LSN_FORMAT_ARGS(newMinRecoveryPoint),
2500  newMinRecoveryPointTLI)));
2501  }
2502  }
2503  LWLockRelease(ControlFileLock);
2504 }
2505 
2506 /*
2507  * Ensure that all XLOG data through the given position is flushed to disk.
2508  *
2509  * NOTE: this differs from XLogWrite mainly in that the WALWriteLock is not
2510  * already held, and we try to avoid acquiring it if possible.
2511  */
2512 void
2514 {
2515  XLogRecPtr WriteRqstPtr;
2516  XLogwrtRqst WriteRqst;
2517  TimeLineID insertTLI = XLogCtl->InsertTimeLineID;
2518 
2519  /*
2520  * During REDO, we are reading not writing WAL. Therefore, instead of
2521  * trying to flush the WAL, we should update minRecoveryPoint instead. We
2522  * test XLogInsertAllowed(), not InRecovery, because we need checkpointer
2523  * to act this way too, and because when it tries to write the
2524  * end-of-recovery checkpoint, it should indeed flush.
2525  */
2526  if (!XLogInsertAllowed())
2527  {
2528  UpdateMinRecoveryPoint(record, false);
2529  return;
2530  }
2531 
2532  /* Quick exit if already known flushed */
2533  if (record <= LogwrtResult.Flush)
2534  return;
2535 
2536 #ifdef WAL_DEBUG
2537  if (XLOG_DEBUG)
2538  elog(LOG, "xlog flush request %X/%X; write %X/%X; flush %X/%X",
2539  LSN_FORMAT_ARGS(record),
2542 #endif
2543 
2545 
2546  /*
2547  * Since fsync is usually a horribly expensive operation, we try to
2548  * piggyback as much data as we can on each fsync: if we see any more data
2549  * entered into the xlog buffer, we'll write and fsync that too, so that
2550  * the final value of LogwrtResult.Flush is as large as possible. This
2551  * gives us some chance of avoiding another fsync immediately after.
2552  */
2553 
2554  /* initialize to given target; may increase below */
2555  WriteRqstPtr = record;
2556 
2557  /*
2558  * Now wait until we get the write lock, or someone else does the flush
2559  * for us.
2560  */
2561  for (;;)
2562  {
2563  XLogRecPtr insertpos;
2564 
2565  /* read LogwrtResult and update local state */
2567  if (WriteRqstPtr < XLogCtl->LogwrtRqst.Write)
2568  WriteRqstPtr = XLogCtl->LogwrtRqst.Write;
2571 
2572  /* done already? */
2573  if (record <= LogwrtResult.Flush)
2574  break;
2575 
2576  /*
2577  * Before actually performing the write, wait for all in-flight
2578  * insertions to the pages we're about to write to finish.
2579  */
2580  insertpos = WaitXLogInsertionsToFinish(WriteRqstPtr);
2581 
2582  /*
2583  * Try to get the write lock. If we can't get it immediately, wait
2584  * until it's released, and recheck if we still need to do the flush
2585  * or if the backend that held the lock did it for us already. This
2586  * helps to maintain a good rate of group committing when the system
2587  * is bottlenecked by the speed of fsyncing.
2588  */
2589  if (!LWLockAcquireOrWait(WALWriteLock, LW_EXCLUSIVE))
2590  {
2591  /*
2592  * The lock is now free, but we didn't acquire it yet. Before we
2593  * do, loop back to check if someone else flushed the record for
2594  * us already.
2595  */
2596  continue;
2597  }
2598 
2599  /* Got the lock; recheck whether request is satisfied */
2601  if (record <= LogwrtResult.Flush)
2602  {
2603  LWLockRelease(WALWriteLock);
2604  break;
2605  }
2606 
2607  /*
2608  * Sleep before flush! By adding a delay here, we may give further
2609  * backends the opportunity to join the backlog of group commit
2610  * followers; this can significantly improve transaction throughput,
2611  * at the risk of increasing transaction latency.
2612  *
2613  * We do not sleep if enableFsync is not turned on, nor if there are
2614  * fewer than CommitSiblings other backends with active transactions.
2615  */
2616  if (CommitDelay > 0 && enableFsync &&
2618  {
2620 
2621  /*
2622  * Re-check how far we can now flush the WAL. It's generally not
2623  * safe to call WaitXLogInsertionsToFinish while holding
2624  * WALWriteLock, because an in-progress insertion might need to
2625  * also grab WALWriteLock to make progress. But we know that all
2626  * the insertions up to insertpos have already finished, because
2627  * that's what the earlier WaitXLogInsertionsToFinish() returned.
2628  * We're only calling it again to allow insertpos to be moved
2629  * further forward, not to actually wait for anyone.
2630  */
2631  insertpos = WaitXLogInsertionsToFinish(insertpos);
2632  }
2633 
2634  /* try to write/flush later additions to XLOG as well */
2635  WriteRqst.Write = insertpos;
2636  WriteRqst.Flush = insertpos;
2637 
2638  XLogWrite(WriteRqst, insertTLI, false);
2639 
2640  LWLockRelease(WALWriteLock);
2641  /* done */
2642  break;
2643  }
2644 
2645  END_CRIT_SECTION();
2646 
2647  /* wake up walsenders now that we've released heavily contended locks */
2649 
2650  /*
2651  * If we still haven't flushed to the request point then we have a
2652  * problem; most likely, the requested flush point is past end of XLOG.
2653  * This has been seen to occur when a disk page has a corrupted LSN.
2654  *
2655  * Formerly we treated this as a PANIC condition, but that hurts the
2656  * system's robustness rather than helping it: we do not want to take down
2657  * the whole system due to corruption on one data page. In particular, if
2658  * the bad page is encountered again during recovery then we would be
2659  * unable to restart the database at all! (This scenario actually
2660  * happened in the field several times with 7.1 releases.) As of 8.4, bad
2661  * LSNs encountered during recovery are UpdateMinRecoveryPoint's problem;
2662  * the only time we can reach here during recovery is while flushing the
2663  * end-of-recovery checkpoint record, and we don't expect that to have a
2664  * bad LSN.
2665  *
2666  * Note that for calls from xact.c, the ERROR will be promoted to PANIC
2667  * since xact.c calls this routine inside a critical section. However,
2668  * calls from bufmgr.c are not within critical sections and so we will not
2669  * force a restart for a bad LSN on a data page.
2670  */
2671  if (LogwrtResult.Flush < record)
2672  elog(ERROR,
2673  "xlog flush request %X/%X is not satisfied --- flushed only to %X/%X",
2674  LSN_FORMAT_ARGS(record),
2676 }
2677 
2678 /*
2679  * Write & flush xlog, but without specifying exactly where to.
2680  *
2681  * We normally write only completed blocks; but if there is nothing to do on
2682  * that basis, we check for unwritten async commits in the current incomplete
2683  * block, and write through the latest one of those. Thus, if async commits
2684  * are not being used, we will write complete blocks only.
2685  *
2686  * If, based on the above, there's anything to write we do so immediately. But
2687  * to avoid calling fsync, fdatasync et. al. at a rate that'd impact
2688  * concurrent IO, we only flush WAL every wal_writer_delay ms, or if there's
2689  * more than wal_writer_flush_after unflushed blocks.
2690  *
2691  * We can guarantee that async commits reach disk after at most three
2692  * wal_writer_delay cycles. (When flushing complete blocks, we allow XLogWrite
2693  * to write "flexibly", meaning it can stop at the end of the buffer ring;
2694  * this makes a difference only with very high load or long wal_writer_delay,
2695  * but imposes one extra cycle for the worst case for async commits.)
2696  *
2697  * This routine is invoked periodically by the background walwriter process.
2698  *
2699  * Returns true if there was any work to do, even if we skipped flushing due
2700  * to wal_writer_delay/wal_writer_flush_after.
2701  */
2702 bool
2704 {
2705  XLogwrtRqst WriteRqst;
2706  bool flexible = true;
2707  static TimestampTz lastflush;
2708  TimestampTz now;
2709  int flushbytes;
2710  TimeLineID insertTLI;
2711 
2712  /* XLOG doesn't need flushing during recovery */
2713  if (RecoveryInProgress())
2714  return false;
2715 
2716  /*
2717  * Since we're not in recovery, InsertTimeLineID is set and can't change,
2718  * so we can read it without a lock.
2719  */
2720  insertTLI = XLogCtl->InsertTimeLineID;
2721 
2722  /* read LogwrtResult and update local state */
2725  WriteRqst = XLogCtl->LogwrtRqst;
2727 
2728  /* back off to last completed page boundary */
2729  WriteRqst.Write -= WriteRqst.Write % XLOG_BLCKSZ;
2730 
2731  /* if we have already flushed that far, consider async commit records */
2732  if (WriteRqst.Write <= LogwrtResult.Flush)
2733  {
2735  WriteRqst.Write = XLogCtl->asyncXactLSN;
2737  flexible = false; /* ensure it all gets written */
2738  }
2739 
2740  /*
2741  * If already known flushed, we're done. Just need to check if we are
2742  * holding an open file handle to a logfile that's no longer in use,
2743  * preventing the file from being deleted.
2744  */
2745  if (WriteRqst.Write <= LogwrtResult.Flush)
2746  {
2747  if (openLogFile >= 0)
2748  {
2751  {
2752  XLogFileClose();
2753  }
2754  }
2755  return false;
2756  }
2757 
2758  /*
2759  * Determine how far to flush WAL, based on the wal_writer_delay and
2760  * wal_writer_flush_after GUCs.
2761  */
2763  flushbytes =
2764  WriteRqst.Write / XLOG_BLCKSZ - LogwrtResult.Flush / XLOG_BLCKSZ;
2765 
2766  if (WalWriterFlushAfter == 0 || lastflush == 0)
2767  {
2768  /* first call, or block based limits disabled */
2769  WriteRqst.Flush = WriteRqst.Write;
2770  lastflush = now;
2771  }
2772  else if (TimestampDifferenceExceeds(lastflush, now, WalWriterDelay))
2773  {
2774  /*
2775  * Flush the writes at least every WalWriterDelay ms. This is
2776  * important to bound the amount of time it takes for an asynchronous
2777  * commit to hit disk.
2778  */
2779  WriteRqst.Flush = WriteRqst.Write;
2780  lastflush = now;
2781  }
2782  else if (flushbytes >= WalWriterFlushAfter)
2783  {
2784  /* exceeded wal_writer_flush_after blocks, flush */
2785  WriteRqst.Flush = WriteRqst.Write;
2786  lastflush = now;
2787  }
2788  else
2789  {
2790  /* no flushing, this time round */
2791  WriteRqst.Flush = 0;
2792  }
2793 
2794 #ifdef WAL_DEBUG
2795  if (XLOG_DEBUG)
2796  elog(LOG, "xlog bg flush request write %X/%X; flush: %X/%X, current is write %X/%X; flush %X/%X",
2797  LSN_FORMAT_ARGS(WriteRqst.Write),
2798  LSN_FORMAT_ARGS(WriteRqst.Flush),
2801 #endif
2802 
2804 
2805  /* now wait for any in-progress insertions to finish and get write lock */
2806  WaitXLogInsertionsToFinish(WriteRqst.Write);
2807  LWLockAcquire(WALWriteLock, LW_EXCLUSIVE);
2809  if (WriteRqst.Write > LogwrtResult.Write ||
2810  WriteRqst.Flush > LogwrtResult.Flush)
2811  {
2812  XLogWrite(WriteRqst, insertTLI, flexible);
2813  }
2814  LWLockRelease(WALWriteLock);
2815 
2816  END_CRIT_SECTION();
2817 
2818  /* wake up walsenders now that we've released heavily contended locks */
2820 
2821  /*
2822  * Great, done. To take some work off the critical path, try to initialize
2823  * as many of the no-longer-needed WAL buffers for future use as we can.
2824  */
2825  AdvanceXLInsertBuffer(InvalidXLogRecPtr, insertTLI, true);
2826 
2827  /*
2828  * If we determined that we need to write data, but somebody else
2829  * wrote/flushed already, it should be considered as being active, to
2830  * avoid hibernating too early.
2831  */
2832  return true;
2833 }
2834 
2835 /*
2836  * Test whether XLOG data has been flushed up to (at least) the given position.
2837  *
2838  * Returns true if a flush is still needed. (It may be that someone else
2839  * is already in process of flushing that far, however.)
2840  */
2841 bool
2843 {
2844  /*
2845  * During recovery, we don't flush WAL but update minRecoveryPoint
2846  * instead. So "needs flush" is taken to mean whether minRecoveryPoint
2847  * would need to be updated.
2848  */
2849  if (RecoveryInProgress())
2850  {
2851  /*
2852  * An invalid minRecoveryPoint means that we need to recover all the
2853  * WAL, i.e., we're doing crash recovery. We never modify the control
2854  * file's value in that case, so we can short-circuit future checks
2855  * here too. This triggers a quick exit path for the startup process,
2856  * which cannot update its local copy of minRecoveryPoint as long as
2857  * it has not replayed all WAL available when doing crash recovery.
2858  */
2860  updateMinRecoveryPoint = false;
2861 
2862  /* Quick exit if already known to be updated or cannot be updated */
2864  return false;
2865 
2866  /*
2867  * Update local copy of minRecoveryPoint. But if the lock is busy,
2868  * just return a conservative guess.
2869  */
2870  if (!LWLockConditionalAcquire(ControlFileLock, LW_SHARED))
2871  return true;
2874  LWLockRelease(ControlFileLock);
2875 
2876  /*
2877  * Check minRecoveryPoint for any other process than the startup
2878  * process doing crash recovery, which should not update the control
2879  * file value if crash recovery is still running.
2880  */
2882  updateMinRecoveryPoint = false;
2883 
2884  /* check again */
2886  return false;
2887  else
2888  return true;
2889  }
2890 
2891  /* Quick exit if already known flushed */
2892  if (record <= LogwrtResult.Flush)
2893  return false;
2894 
2895  /* read LogwrtResult and update local state */
2899 
2900  /* check again */
2901  if (record <= LogwrtResult.Flush)
2902  return false;
2903 
2904  return true;
2905 }
2906 
2907 /*
2908  * Try to make a given XLOG file segment exist.
2909  *
2910  * logsegno: identify segment.
2911  *
2912  * *added: on return, true if this call raised the number of extant segments.
2913  *
2914  * path: on return, this char[MAXPGPATH] has the path to the logsegno file.
2915  *
2916  * Returns -1 or FD of opened file. A -1 here is not an error; a caller
2917  * wanting an open segment should attempt to open "path", which usually will
2918  * succeed. (This is weird, but it's efficient for the callers.)
2919  */
2920 static int
2922  bool *added, char *path)
2923 {
2924  char tmppath[MAXPGPATH];
2925  XLogSegNo installed_segno;
2926  XLogSegNo max_segno;
2927  int fd;
2928  int save_errno;
2929  int open_flags = O_RDWR | O_CREAT | O_EXCL | PG_BINARY;
2930 
2931  Assert(logtli != 0);
2932 
2933  XLogFilePath(path, logtli, logsegno, wal_segment_size);
2934 
2935  /*
2936  * Try to use existent file (checkpoint maker may have created it already)
2937  */
2938  *added = false;
2939  fd = BasicOpenFile(path, O_RDWR | PG_BINARY | O_CLOEXEC |
2941  if (fd < 0)
2942  {
2943  if (errno != ENOENT)
2944  ereport(ERROR,
2946  errmsg("could not open file \"%s\": %m", path)));
2947  }
2948  else
2949  return fd;
2950 
2951  /*
2952  * Initialize an empty (all zeroes) segment. NOTE: it is possible that
2953  * another process is doing the same thing. If so, we will end up
2954  * pre-creating an extra log segment. That seems OK, and better than
2955  * holding the lock throughout this lengthy process.
2956  */
2957  elog(DEBUG2, "creating and filling new WAL file");
2958 
2959  snprintf(tmppath, MAXPGPATH, XLOGDIR "/xlogtemp.%d", (int) getpid());
2960 
2961  unlink(tmppath);
2962 
2964  open_flags |= PG_O_DIRECT;
2965 
2966  /* do not use get_sync_bit() here --- want to fsync only at end of fill */
2967  fd = BasicOpenFile(tmppath, open_flags);
2968  if (fd < 0)
2969  ereport(ERROR,
2971  errmsg("could not create file \"%s\": %m", tmppath)));
2972 
2974  save_errno = 0;
2975  if (wal_init_zero)
2976  {
2977  ssize_t rc;
2978 
2979  /*
2980  * Zero-fill the file. With this setting, we do this the hard way to
2981  * ensure that all the file space has really been allocated. On
2982  * platforms that allow "holes" in files, just seeking to the end
2983  * doesn't allocate intermediate space. This way, we know that we
2984  * have all the space and (after the fsync below) that all the
2985  * indirect blocks are down on disk. Therefore, fdatasync(2) or
2986  * O_DSYNC will be sufficient to sync future writes to the log file.
2987  */
2989 
2990  if (rc < 0)
2991  save_errno = errno;
2992  }
2993  else
2994  {
2995  /*
2996  * Otherwise, seeking to the end and writing a solitary byte is
2997  * enough.
2998  */
2999  errno = 0;
3000  if (pg_pwrite(fd, "\0", 1, wal_segment_size - 1) != 1)
3001  {
3002  /* if write didn't set errno, assume no disk space */
3003  save_errno = errno ? errno : ENOSPC;
3004  }
3005  }
3007 
3008  if (save_errno)
3009  {
3010  /*
3011  * If we fail to make the file, delete it to release disk space
3012  */
3013  unlink(tmppath);
3014 
3015  close(fd);
3016 
3017  errno = save_errno;
3018 
3019  ereport(ERROR,
3021  errmsg("could not write to file \"%s\": %m", tmppath)));
3022  }
3023 
3025  if (pg_fsync(fd) != 0)
3026  {
3027  save_errno = errno;
3028  close(fd);
3029  errno = save_errno;
3030  ereport(ERROR,
3032  errmsg("could not fsync file \"%s\": %m", tmppath)));
3033  }
3035 
3036  if (close(fd) != 0)
3037  ereport(ERROR,
3039  errmsg("could not close file \"%s\": %m", tmppath)));
3040 
3041  /*
3042  * Now move the segment into place with its final name. Cope with
3043  * possibility that someone else has created the file while we were
3044  * filling ours: if so, use ours to pre-create a future log segment.
3045  */
3046  installed_segno = logsegno;
3047 
3048  /*
3049  * XXX: What should we use as max_segno? We used to use XLOGfileslop when
3050  * that was a constant, but that was always a bit dubious: normally, at a
3051  * checkpoint, XLOGfileslop was the offset from the checkpoint record, but
3052  * here, it was the offset from the insert location. We can't do the
3053  * normal XLOGfileslop calculation here because we don't have access to
3054  * the prior checkpoint's redo location. So somewhat arbitrarily, just use
3055  * CheckPointSegments.
3056  */
3057  max_segno = logsegno + CheckPointSegments;
3058  if (InstallXLogFileSegment(&installed_segno, tmppath, true, max_segno,
3059  logtli))
3060  {
3061  *added = true;
3062  elog(DEBUG2, "done creating and filling new WAL file");
3063  }
3064  else
3065  {
3066  /*
3067  * No need for any more future segments, or InstallXLogFileSegment()
3068  * failed to rename the file into place. If the rename failed, a
3069  * caller opening the file may fail.
3070  */
3071  unlink(tmppath);
3072  elog(DEBUG2, "abandoned new WAL file");
3073  }
3074 
3075  return -1;
3076 }
3077 
3078 /*
3079  * Create a new XLOG file segment, or open a pre-existing one.
3080  *
3081  * logsegno: identify segment to be created/opened.
3082  *
3083  * Returns FD of opened file.
3084  *
3085  * Note: errors here are ERROR not PANIC because we might or might not be
3086  * inside a critical section (eg, during checkpoint there is no reason to
3087  * take down the system on failure). They will promote to PANIC if we are
3088  * in a critical section.
3089  */
3090 int
3092 {
3093  bool ignore_added;
3094  char path[MAXPGPATH];
3095  int fd;
3096 
3097  Assert(logtli != 0);
3098 
3099  fd = XLogFileInitInternal(logsegno, logtli, &ignore_added, path);
3100  if (fd >= 0)
3101  return fd;
3102 
3103  /* Now open original target segment (might not be file I just made) */
3104  fd = BasicOpenFile(path, O_RDWR | PG_BINARY | O_CLOEXEC |
3106  if (fd < 0)
3107  ereport(ERROR,
3109  errmsg("could not open file \"%s\": %m", path)));
3110  return fd;
3111 }
3112 
3113 /*
3114  * Create a new XLOG file segment by copying a pre-existing one.
3115  *
3116  * destsegno: identify segment to be created.
3117  *
3118  * srcTLI, srcsegno: identify segment to be copied (could be from
3119  * a different timeline)
3120  *
3121  * upto: how much of the source file to copy (the rest is filled with
3122  * zeros)
3123  *
3124  * Currently this is only used during recovery, and so there are no locking
3125  * considerations. But we should be just as tense as XLogFileInit to avoid
3126  * emplacing a bogus file.
3127  */
3128 static void
3129 XLogFileCopy(TimeLineID destTLI, XLogSegNo destsegno,
3130  TimeLineID srcTLI, XLogSegNo srcsegno,
3131  int upto)
3132 {
3133  char path[MAXPGPATH];
3134  char tmppath[MAXPGPATH];
3135  PGAlignedXLogBlock buffer;
3136  int srcfd;
3137  int fd;
3138  int nbytes;
3139 
3140  /*
3141  * Open the source file
3142  */
3143  XLogFilePath(path, srcTLI, srcsegno, wal_segment_size);
3144  srcfd = OpenTransientFile(path, O_RDONLY | PG_BINARY);
3145  if (srcfd < 0)
3146  ereport(ERROR,
3148  errmsg("could not open file \"%s\": %m", path)));
3149 
3150  /*
3151  * Copy into a temp file name.
3152  */
3153  snprintf(tmppath, MAXPGPATH, XLOGDIR "/xlogtemp.%d", (int) getpid());
3154 
3155  unlink(tmppath);
3156 
3157  /* do not use get_sync_bit() here --- want to fsync only at end of fill */
3158  fd = OpenTransientFile(tmppath, O_RDWR | O_CREAT | O_EXCL | PG_BINARY);
3159  if (fd < 0)
3160  ereport(ERROR,
3162  errmsg("could not create file \"%s\": %m", tmppath)));
3163 
3164  /*
3165  * Do the data copying.
3166  */
3167  for (nbytes = 0; nbytes < wal_segment_size; nbytes += sizeof(buffer))
3168  {
3169  int nread;
3170 
3171  nread = upto - nbytes;
3172 
3173  /*
3174  * The part that is not read from the source file is filled with
3175  * zeros.
3176  */
3177  if (nread < sizeof(buffer))
3178  memset(buffer.data, 0, sizeof(buffer));
3179 
3180  if (nread > 0)
3181  {
3182  int r;
3183 
3184  if (nread > sizeof(buffer))
3185  nread = sizeof(buffer);
3187  r = read(srcfd, buffer.data, nread);
3188  if (r != nread)
3189  {
3190  if (r < 0)
3191  ereport(ERROR,
3193  errmsg("could not read file \"%s\": %m",
3194  path)));
3195  else
3196  ereport(ERROR,
3198  errmsg("could not read file \"%s\": read %d of %zu",
3199  path, r, (Size) nread)));
3200  }
3202  }
3203  errno = 0;
3205  if ((int) write(fd, buffer.data, sizeof(buffer)) != (int) sizeof(buffer))
3206  {
3207  int save_errno = errno;
3208 
3209  /*
3210  * If we fail to make the file, delete it to release disk space
3211  */
3212  unlink(tmppath);
3213  /* if write didn't set errno, assume problem is no disk space */
3214  errno = save_errno ? save_errno : ENOSPC;
3215 
3216  ereport(ERROR,
3218  errmsg("could not write to file \"%s\": %m", tmppath)));
3219  }
3221  }
3222 
3224  if (pg_fsync(fd) != 0)
3227  errmsg("could not fsync file \"%s\": %m", tmppath)));
3229 
3230  if (CloseTransientFile(fd) != 0)
3231  ereport(ERROR,
3233  errmsg("could not close file \"%s\": %m", tmppath)));
3234 
3235  if (CloseTransientFile(srcfd) != 0)
3236  ereport(ERROR,
3238  errmsg("could not close file \"%s\": %m", path)));
3239 
3240  /*
3241  * Now move the segment into place with its final name.
3242  */
3243  if (!InstallXLogFileSegment(&destsegno, tmppath, false, 0, destTLI))
3244  elog(ERROR, "InstallXLogFileSegment should not have failed");
3245 }
3246 
3247 /*
3248  * Install a new XLOG segment file as a current or future log segment.
3249  *
3250  * This is used both to install a newly-created segment (which has a temp
3251  * filename while it's being created) and to recycle an old segment.
3252  *
3253  * *segno: identify segment to install as (or first possible target).
3254  * When find_free is true, this is modified on return to indicate the
3255  * actual installation location or last segment searched.
3256  *
3257  * tmppath: initial name of file to install. It will be renamed into place.
3258  *
3259  * find_free: if true, install the new segment at the first empty segno
3260  * number at or after the passed numbers. If false, install the new segment
3261  * exactly where specified, deleting any existing segment file there.
3262  *
3263  * max_segno: maximum segment number to install the new file as. Fail if no
3264  * free slot is found between *segno and max_segno. (Ignored when find_free
3265  * is false.)
3266  *
3267  * tli: The timeline on which the new segment should be installed.
3268  *
3269  * Returns true if the file was installed successfully. false indicates that
3270  * max_segno limit was exceeded, the startup process has disabled this
3271  * function for now, or an error occurred while renaming the file into place.
3272  */
3273 static bool
3274 InstallXLogFileSegment(XLogSegNo *segno, char *tmppath,
3275  bool find_free, XLogSegNo max_segno, TimeLineID tli)
3276 {
3277  char path[MAXPGPATH];
3278  struct stat stat_buf;
3279 
3280  Assert(tli != 0);
3281 
3282  XLogFilePath(path, tli, *segno, wal_segment_size);
3283 
3284  LWLockAcquire(ControlFileLock, LW_EXCLUSIVE);
3286  {
3287  LWLockRelease(ControlFileLock);
3288  return false;
3289  }
3290 
3291  if (!find_free)
3292  {
3293  /* Force installation: get rid of any pre-existing segment file */
3294  durable_unlink(path, DEBUG1);
3295  }
3296  else
3297  {
3298  /* Find a free slot to put it in */
3299  while (stat(path, &stat_buf) == 0)
3300  {
3301  if ((*segno) >= max_segno)
3302  {
3303  /* Failed to find a free slot within specified range */
3304  LWLockRelease(ControlFileLock);
3305  return false;
3306  }
3307  (*segno)++;
3308  XLogFilePath(path, tli, *segno, wal_segment_size);
3309  }
3310  }
3311 
3312  Assert(access(path, F_OK) != 0 && errno == ENOENT);
3313  if (durable_rename(tmppath, path, LOG) != 0)
3314  {
3315  LWLockRelease(ControlFileLock);
3316  /* durable_rename already emitted log message */
3317  return false;
3318  }
3319 
3320  LWLockRelease(ControlFileLock);
3321 
3322  return true;
3323 }
3324 
3325 /*
3326  * Open a pre-existing logfile segment for writing.
3327  */
3328 int
3330 {
3331  char path[MAXPGPATH];
3332  int fd;
3333 
3334  XLogFilePath(path, tli, segno, wal_segment_size);
3335 
3336  fd = BasicOpenFile(path, O_RDWR | PG_BINARY | O_CLOEXEC |
3338  if (fd < 0)
3339  ereport(PANIC,
3341  errmsg("could not open file \"%s\": %m", path)));
3342 
3343  return fd;
3344 }
3345 
3346 /*
3347  * Close the current logfile segment for writing.
3348  */
3349 static void
3351 {
3352  Assert(openLogFile >= 0);
3353 
3354  /*
3355  * WAL segment files will not be re-read in normal operation, so we advise
3356  * the OS to release any cached pages. But do not do so if WAL archiving
3357  * or streaming is active, because archiver and walsender process could
3358  * use the cache to read the WAL segment.
3359  */
3360 #if defined(USE_POSIX_FADVISE) && defined(POSIX_FADV_DONTNEED)
3361  if (!XLogIsNeeded() && (io_direct_flags & IO_DIRECT_WAL) == 0)
3362  (void) posix_fadvise(openLogFile, 0, 0, POSIX_FADV_DONTNEED);
3363 #endif
3364 
3365  if (close(openLogFile) != 0)
3366  {
3367  char xlogfname[MAXFNAMELEN];
3368  int save_errno = errno;
3369 
3371  errno = save_errno;
3372  ereport(PANIC,
3374  errmsg("could not close file \"%s\": %m", xlogfname)));
3375  }
3376 
3377  openLogFile = -1;
3379 }
3380 
3381 /*
3382  * Preallocate log files beyond the specified log endpoint.
3383  *
3384  * XXX this is currently extremely conservative, since it forces only one
3385  * future log segment to exist, and even that only if we are 75% done with
3386  * the current one. This is only appropriate for very low-WAL-volume systems.
3387  * High-volume systems will be OK once they've built up a sufficient set of
3388  * recycled log segments, but the startup transient is likely to include
3389  * a lot of segment creations by foreground processes, which is not so good.
3390  *
3391  * XLogFileInitInternal() can ereport(ERROR). All known causes indicate big
3392  * trouble; for example, a full filesystem is one cause. The checkpoint WAL
3393  * and/or ControlFile updates already completed. If a RequestCheckpoint()
3394  * initiated the present checkpoint and an ERROR ends this function, the
3395  * command that called RequestCheckpoint() fails. That's not ideal, but it's
3396  * not worth contorting more functions to use caller-specified elevel values.
3397  * (With or without RequestCheckpoint(), an ERROR forestalls some inessential
3398  * reporting and resource reclamation.)
3399  */
3400 static void
3402 {
3403  XLogSegNo _logSegNo;
3404  int lf;
3405  bool added;
3406  char path[MAXPGPATH];
3407  uint64 offset;
3408 
3410  return; /* unlocked check says no */
3411 
3412  XLByteToPrevSeg(endptr, _logSegNo, wal_segment_size);
3413  offset = XLogSegmentOffset(endptr - 1, wal_segment_size);
3414  if (offset >= (uint32) (0.75 * wal_segment_size))
3415  {
3416  _logSegNo++;
3417  lf = XLogFileInitInternal(_logSegNo, tli, &added, path);
3418  if (lf >= 0)
3419  close(lf);
3420  if (added)
3422  }
3423 }
3424 
3425 /*
3426  * Throws an error if the given log segment has already been removed or
3427  * recycled. The caller should only pass a segment that it knows to have
3428  * existed while the server has been running, as this function always
3429  * succeeds if no WAL segments have been removed since startup.
3430  * 'tli' is only used in the error message.
3431  *
3432  * Note: this function guarantees to keep errno unchanged on return.
3433  * This supports callers that use this to possibly deliver a better
3434  * error message about a missing file, while still being able to throw
3435  * a normal file-access error afterwards, if this does return.
3436  */
3437 void
3439 {
3440  int save_errno = errno;
3441  XLogSegNo lastRemovedSegNo;
3442 
3444  lastRemovedSegNo = XLogCtl->lastRemovedSegNo;
3446 
3447  if (segno <= lastRemovedSegNo)
3448  {
3449  char filename[MAXFNAMELEN];
3450 
3451  XLogFileName(filename, tli, segno, wal_segment_size);
3452  errno = save_errno;
3453  ereport(ERROR,
3455  errmsg("requested WAL segment %s has already been removed",
3456  filename)));
3457  }
3458  errno = save_errno;
3459 }
3460 
3461 /*
3462  * Return the last WAL segment removed, or 0 if no segment has been removed
3463  * since startup.
3464  *
3465  * NB: the result can be out of date arbitrarily fast, the caller has to deal
3466  * with that.
3467  */
3468 XLogSegNo
3470 {
3471  XLogSegNo lastRemovedSegNo;
3472 
3474  lastRemovedSegNo = XLogCtl->lastRemovedSegNo;
3476 
3477  return lastRemovedSegNo;
3478 }
3479 
3480 
3481 /*
3482  * Update the last removed segno pointer in shared memory, to reflect that the
3483  * given XLOG file has been removed.
3484  */
3485 static void
3487 {
3488  uint32 tli;
3489  XLogSegNo segno;
3490 
3491  XLogFromFileName(filename, &tli, &segno, wal_segment_size);
3492 
3494  if (segno > XLogCtl->lastRemovedSegNo)
3495  XLogCtl->lastRemovedSegNo = segno;
3497 }
3498 
3499 /*
3500  * Remove all temporary log files in pg_wal
3501  *
3502  * This is called at the beginning of recovery after a previous crash,
3503  * at a point where no other processes write fresh WAL data.
3504  */
3505 static void
3507 {
3508  DIR *xldir;
3509  struct dirent *xlde;
3510 
3511  elog(DEBUG2, "removing all temporary WAL segments");
3512 
3513  xldir = AllocateDir(XLOGDIR);
3514  while ((xlde = ReadDir(xldir, XLOGDIR)) != NULL)
3515  {
3516  char path[MAXPGPATH];
3517 
3518  if (strncmp(xlde->d_name, "xlogtemp.", 9) != 0)
3519  continue;
3520 
3521  snprintf(path, MAXPGPATH, XLOGDIR "/%s", xlde->d_name);
3522  unlink(path);
3523  elog(DEBUG2, "removed temporary WAL segment \"%s\"", path);
3524  }
3525  FreeDir(xldir);
3526 }
3527 
3528 /*
3529  * Recycle or remove all log files older or equal to passed segno.
3530  *
3531  * endptr is current (or recent) end of xlog, and lastredoptr is the
3532  * redo pointer of the last checkpoint. These are used to determine
3533  * whether we want to recycle rather than delete no-longer-wanted log files.
3534  *
3535  * insertTLI is the current timeline for XLOG insertion. Any recycled
3536  * segments should be reused for this timeline.
3537  */
3538 static void
3540  TimeLineID insertTLI)
3541 {
3542  DIR *xldir;
3543  struct dirent *xlde;
3544  char lastoff[MAXFNAMELEN];
3545  XLogSegNo endlogSegNo;
3546  XLogSegNo recycleSegNo;
3547 
3548  /* Initialize info about where to try to recycle to */
3549  XLByteToSeg(endptr, endlogSegNo, wal_segment_size);
3550  recycleSegNo = XLOGfileslop(lastredoptr);
3551 
3552  /*
3553  * Construct a filename of the last segment to be kept. The timeline ID
3554  * doesn't matter, we ignore that in the comparison. (During recovery,
3555  * InsertTimeLineID isn't set, so we can't use that.)
3556  */
3557  XLogFileName(lastoff, 0, segno, wal_segment_size);
3558 
3559  elog(DEBUG2, "attempting to remove WAL segments older than log file %s",
3560  lastoff);
3561 
3562  xldir = AllocateDir(XLOGDIR);
3563 
3564  while ((xlde = ReadDir(xldir, XLOGDIR)) != NULL)
3565  {
3566  /* Ignore files that are not XLOG segments */
3567  if (!IsXLogFileName(xlde->d_name) &&
3568  !IsPartialXLogFileName(xlde->d_name))
3569  continue;
3570 
3571  /*
3572  * We ignore the timeline part of the XLOG segment identifiers in
3573  * deciding whether a segment is still needed. This ensures that we
3574  * won't prematurely remove a segment from a parent timeline. We could
3575  * probably be a little more proactive about removing segments of
3576  * non-parent timelines, but that would be a whole lot more
3577  * complicated.
3578  *
3579  * We use the alphanumeric sorting property of the filenames to decide
3580  * which ones are earlier than the lastoff segment.
3581  */
3582  if (strcmp(xlde->d_name + 8, lastoff + 8) <= 0)
3583  {
3584  if (XLogArchiveCheckDone(xlde->d_name))
3585  {
3586  /* Update the last removed location in shared memory first */
3588 
3589  RemoveXlogFile(xlde, recycleSegNo, &endlogSegNo, insertTLI);
3590  }
3591  }
3592  }
3593 
3594  FreeDir(xldir);
3595 }
3596 
3597 /*
3598  * Remove WAL files that are not part of the given timeline's history.
3599  *
3600  * This is called during recovery, whenever we switch to follow a new
3601  * timeline, and at the end of recovery when we create a new timeline. We
3602  * wouldn't otherwise care about extra WAL files lying in pg_wal, but they
3603  * might be leftover pre-allocated or recycled WAL segments on the old timeline
3604  * that we haven't used yet, and contain garbage. If we just leave them in
3605  * pg_wal, they will eventually be archived, and we can't let that happen.
3606  * Files that belong to our timeline history are valid, because we have
3607  * successfully replayed them, but from others we can't be sure.
3608  *
3609  * 'switchpoint' is the current point in WAL where we switch to new timeline,
3610  * and 'newTLI' is the new timeline we switch to.
3611  */
3612 void
3614 {
3615  DIR *xldir;
3616  struct dirent *xlde;
3617  char switchseg[MAXFNAMELEN];
3618  XLogSegNo endLogSegNo;
3619  XLogSegNo switchLogSegNo;
3620  XLogSegNo recycleSegNo;
3621 
3622  /*
3623  * Initialize info about where to begin the work. This will recycle,
3624  * somewhat arbitrarily, 10 future segments.
3625  */
3626  XLByteToPrevSeg(switchpoint, switchLogSegNo, wal_segment_size);
3627  XLByteToSeg(switchpoint, endLogSegNo, wal_segment_size);
3628  recycleSegNo = endLogSegNo + 10;
3629 
3630  /*
3631  * Construct a filename of the last segment to be kept.
3632  */
3633  XLogFileName(switchseg, newTLI, switchLogSegNo, wal_segment_size);
3634 
3635  elog(DEBUG2, "attempting to remove WAL segments newer than log file %s",
3636  switchseg);
3637 
3638  xldir = AllocateDir(XLOGDIR);
3639 
3640  while ((xlde = ReadDir(xldir, XLOGDIR)) != NULL)
3641  {
3642  /* Ignore files that are not XLOG segments */
3643  if (!IsXLogFileName(xlde->d_name))
3644  continue;
3645 
3646  /*
3647  * Remove files that are on a timeline older than the new one we're
3648  * switching to, but with a segment number >= the first segment on the
3649  * new timeline.
3650  */
3651  if (strncmp(xlde->d_name, switchseg, 8) < 0 &&
3652  strcmp(xlde->d_name + 8, switchseg + 8) > 0)
3653  {
3654  /*
3655  * If the file has already been marked as .ready, however, don't
3656  * remove it yet. It should be OK to remove it - files that are
3657  * not part of our timeline history are not required for recovery
3658  * - but seems safer to let them be archived and removed later.
3659  */
3660  if (!XLogArchiveIsReady(xlde->d_name))
3661  RemoveXlogFile(xlde, recycleSegNo, &endLogSegNo, newTLI);
3662  }
3663  }
3664 
3665  FreeDir(xldir);
3666 }
3667 
3668 /*
3669  * Recycle or remove a log file that's no longer needed.
3670  *
3671  * segment_de is the dirent structure of the segment to recycle or remove.
3672  * recycleSegNo is the segment number to recycle up to. endlogSegNo is
3673  * the segment number of the current (or recent) end of WAL.
3674  *
3675  * endlogSegNo gets incremented if the segment is recycled so as it is not
3676  * checked again with future callers of this function.
3677  *
3678  * insertTLI is the current timeline for XLOG insertion. Any recycled segments
3679  * should be used for this timeline.
3680  */
3681 static void
3682 RemoveXlogFile(const struct dirent *segment_de,
3683  XLogSegNo recycleSegNo, XLogSegNo *endlogSegNo,
3684  TimeLineID insertTLI)
3685 {
3686  char path[MAXPGPATH];
3687 #ifdef WIN32
3688  char newpath[MAXPGPATH];
3689 #endif
3690  const char *segname = segment_de->d_name;
3691 
3692  snprintf(path, MAXPGPATH, XLOGDIR "/%s", segname);
3693 
3694  /*
3695  * Before deleting the file, see if it can be recycled as a future log
3696  * segment. Only recycle normal files, because we don't want to recycle
3697  * symbolic links pointing to a separate archive directory.
3698  */
3699  if (wal_recycle &&
3700  *endlogSegNo <= recycleSegNo &&
3701  XLogCtl->InstallXLogFileSegmentActive && /* callee rechecks this */
3702  get_dirent_type(path, segment_de, false, DEBUG2) == PGFILETYPE_REG &&
3703  InstallXLogFileSegment(endlogSegNo, path,
3704  true, recycleSegNo, insertTLI))
3705  {
3706  ereport(DEBUG2,
3707  (errmsg_internal("recycled write-ahead log file \"%s\"",
3708  segname)));
3710  /* Needn't recheck that slot on future iterations */
3711  (*endlogSegNo)++;
3712  }
3713  else
3714  {
3715  /* No need for any more future segments, or recycling failed ... */
3716  int rc;
3717 
3718  ereport(DEBUG2,
3719  (errmsg_internal("removing write-ahead log file \"%s\"",
3720  segname)));
3721 
3722 #ifdef WIN32
3723 
3724  /*
3725  * On Windows, if another process (e.g another backend) holds the file
3726  * open in FILE_SHARE_DELETE mode, unlink will succeed, but the file
3727  * will still show up in directory listing until the last handle is
3728  * closed. To avoid confusing the lingering deleted file for a live
3729  * WAL file that needs to be archived, rename it before deleting it.
3730  *
3731  * If another process holds the file open without FILE_SHARE_DELETE
3732  * flag, rename will fail. We'll try again at the next checkpoint.
3733  */
3734  snprintf(newpath, MAXPGPATH, "%s.deleted", path);
3735  if (rename(path, newpath) != 0)
3736  {
3737  ereport(LOG,
3739  errmsg("could not rename file \"%s\": %m",
3740  path)));
3741  return;
3742  }
3743  rc = durable_unlink(newpath, LOG);
3744 #else
3745  rc = durable_unlink(path, LOG);
3746 #endif
3747  if (rc != 0)
3748  {
3749  /* Message already logged by durable_unlink() */
3750  return;
3751  }
3753  }
3754 
3755  XLogArchiveCleanup(segname);
3756 }
3757 
3758 /*
3759  * Verify whether pg_wal and pg_wal/archive_status exist.
3760  * If the latter does not exist, recreate it.
3761  *
3762  * It is not the goal of this function to verify the contents of these
3763  * directories, but to help in cases where someone has performed a cluster
3764  * copy for PITR purposes but omitted pg_wal from the copy.
3765  *
3766  * We could also recreate pg_wal if it doesn't exist, but a deliberate
3767  * policy decision was made not to. It is fairly common for pg_wal to be
3768  * a symlink, and if that was the DBA's intent then automatically making a
3769  * plain directory would result in degraded performance with no notice.
3770  */
3771 static void
3773 {
3774  char path[MAXPGPATH];
3775  struct stat stat_buf;
3776 
3777  /* Check for pg_wal; if it doesn't exist, error out */
3778  if (stat(XLOGDIR, &stat_buf) != 0 ||
3779  !S_ISDIR(stat_buf.st_mode))
3780  ereport(FATAL,
3781  (errmsg("required WAL directory \"%s\" does not exist",
3782  XLOGDIR)));
3783 
3784  /* Check for archive_status */
3785  snprintf(path, MAXPGPATH, XLOGDIR "/archive_status");
3786  if (stat(path, &stat_buf) == 0)
3787  {
3788  /* Check for weird cases where it exists but isn't a directory */
3789  if (!S_ISDIR(stat_buf.st_mode))
3790  ereport(FATAL,
3791  (errmsg("required WAL directory \"%s\" does not exist",
3792  path)));
3793  }
3794  else
3795  {
3796  ereport(LOG,
3797  (errmsg("creating missing WAL directory \"%s\"", path)));
3798  if (MakePGDirectory(path) < 0)
3799  ereport(FATAL,
3800  (errmsg("could not create missing directory \"%s\": %m",
3801  path)));
3802  }
3803 }
3804 
3805 /*
3806  * Remove previous backup history files. This also retries creation of
3807  * .ready files for any backup history files for which XLogArchiveNotify
3808  * failed earlier.
3809  */
3810 static void
3812 {
3813  DIR *xldir;
3814  struct dirent *xlde;
3815  char path[MAXPGPATH + sizeof(XLOGDIR)];
3816 
3817  xldir = AllocateDir(XLOGDIR);
3818 
3819  while ((xlde = ReadDir(xldir, XLOGDIR)) != NULL)
3820  {
3821  if (IsBackupHistoryFileName(xlde->d_name))
3822  {
3823  if (XLogArchiveCheckDone(xlde->d_name))
3824  {
3825  elog(DEBUG2, "removing WAL backup history file \"%s\"",
3826  xlde->d_name);
3827  snprintf(path, sizeof(path), XLOGDIR "/%s", xlde->d_name);
3828  unlink(path);
3829  XLogArchiveCleanup(xlde->d_name);
3830  }
3831  }
3832  }
3833 
3834  FreeDir(xldir);
3835 }
3836 
3837 /*
3838  * I/O routines for pg_control
3839  *
3840  * *ControlFile is a buffer in shared memory that holds an image of the
3841  * contents of pg_control. WriteControlFile() initializes pg_control
3842  * given a preloaded buffer, ReadControlFile() loads the buffer from
3843  * the pg_control file (during postmaster or standalone-backend startup),
3844  * and UpdateControlFile() rewrites pg_control after we modify xlog state.
3845  * InitControlFile() fills the buffer with initial values.
3846  *
3847  * For simplicity, WriteControlFile() initializes the fields of pg_control
3848  * that are related to checking backend/database compatibility, and
3849  * ReadControlFile() verifies they are correct. We could split out the
3850  * I/O and compatibility-check functions, but there seems no need currently.
3851  */
3852 
3853 static void
3854 InitControlFile(uint64 sysidentifier)
3855 {
3856  char mock_auth_nonce[MOCK_AUTH_NONCE_LEN];
3857 
3858  /*
3859  * Generate a random nonce. This is used for authentication requests that
3860  * will fail because the user does not exist. The nonce is used to create
3861  * a genuine-looking password challenge for the non-existent user, in lieu
3862  * of an actual stored password.
3863  */
3864  if (!pg_strong_random(mock_auth_nonce, MOCK_AUTH_NONCE_LEN))
3865  ereport(PANIC,
3866  (errcode(ERRCODE_INTERNAL_ERROR),
3867  errmsg("could not generate secret authorization token")));
3868 
3869  memset(ControlFile, 0, sizeof(ControlFileData));
3870  /* Initialize pg_control status fields */
3871  ControlFile->system_identifier = sysidentifier;
3872  memcpy(ControlFile->mock_authentication_nonce, mock_auth_nonce, MOCK_AUTH_NONCE_LEN);
3875 
3876  /* Set important parameter values for use when replaying WAL */
3886 }
3887 
3888 static void
3890 {
3891  int fd;
3892  char buffer[PG_CONTROL_FILE_SIZE]; /* need not be aligned */
3893 
3894  /*
3895  * Initialize version and compatibility-check fields
3896  */
3899 
3900  ControlFile->maxAlign = MAXIMUM_ALIGNOF;
3902 
3903  ControlFile->blcksz = BLCKSZ;
3904  ControlFile->relseg_size = RELSEG_SIZE;
3905  ControlFile->xlog_blcksz = XLOG_BLCKSZ;
3907 
3910 
3913 
3915 
3916  /* Contents are protected with a CRC */
3919  (char *) ControlFile,
3920  offsetof(ControlFileData, crc));
3922 
3923  /*
3924  * We write out PG_CONTROL_FILE_SIZE bytes into pg_control, zero-padding
3925  * the excess over sizeof(ControlFileData). This reduces the odds of
3926  * premature-EOF errors when reading pg_control. We'll still fail when we
3927  * check the contents of the file, but hopefully with a more specific
3928  * error than "couldn't read pg_control".
3929  */
3930  memset(buffer, 0, PG_CONTROL_FILE_SIZE);
3931  memcpy(buffer, ControlFile, sizeof(ControlFileData));
3932 
3934  O_RDWR | O_CREAT | O_EXCL | PG_BINARY);
3935  if (fd < 0)
3936  ereport(PANIC,
3938  errmsg("could not create file \"%s\": %m",
3939  XLOG_CONTROL_FILE)));
3940 
3941  errno = 0;
3944  {
3945  /* if write didn't set errno, assume problem is no disk space */
3946  if (errno == 0)
3947  errno = ENOSPC;
3948  ereport(PANIC,
3950  errmsg("could not write to file \"%s\": %m",
3951  XLOG_CONTROL_FILE)));
3952  }
3954 
3956  if (pg_fsync(fd) != 0)
3957  ereport(PANIC,
3959  errmsg("could not fsync file \"%s\": %m",
3960  XLOG_CONTROL_FILE)));
3962 
3963  if (close(fd) != 0)
3964  ereport(PANIC,
3966  errmsg("could not close file \"%s\": %m",
3967  XLOG_CONTROL_FILE)));
3968 }
3969 
3970 static void
3972 {
3973  pg_crc32c crc;
3974  int fd;
3975  static char wal_segsz_str[20];
3976  int r;
3977 
3978  /*
3979  * Read data...
3980  */
3982  O_RDWR | PG_BINARY);
3983  if (fd < 0)
3984  ereport(PANIC,
3986  errmsg("could not open file \"%s\": %m",
3987  XLOG_CONTROL_FILE)));
3988 
3990  r = read(fd, ControlFile, sizeof(ControlFileData));
3991  if (r != sizeof(ControlFileData))
3992  {
3993  if (r < 0)
3994  ereport(PANIC,
3996  errmsg("could not read file \"%s\": %m",
3997  XLOG_CONTROL_FILE)));
3998  else
3999  ereport(PANIC,
4001  errmsg("could not read file \"%s\": read %d of %zu",
4002  XLOG_CONTROL_FILE, r, sizeof(ControlFileData))));
4003  }
4005 
4006  close(fd);
4007 
4008  /*
4009  * Check for expected pg_control format version. If this is wrong, the
4010  * CRC check will likely fail because we'll be checking the wrong number
4011  * of bytes. Complaining about wrong version will probably be more
4012  * enlightening than complaining about wrong CRC.
4013  */
4014 
4016  ereport(FATAL,
4017  (errmsg("database files are incompatible with server"),
4018  errdetail("The database cluster was initialized with PG_CONTROL_VERSION %d (0x%08x),"
4019  " but the server was compiled with PG_CONTROL_VERSION %d (0x%08x).",
4022  errhint("This could be a problem of mismatched byte ordering. It looks like you need to initdb.")));
4023 
4025  ereport(FATAL,
4026  (errmsg("database files are incompatible with server"),
4027  errdetail("The database cluster was initialized with PG_CONTROL_VERSION %d,"
4028  " but the server was compiled with PG_CONTROL_VERSION %d.",
4030  errhint("It looks like you need to initdb.")));
4031 
4032  /* Now check the CRC. */
4033  INIT_CRC32C(crc);
4034  COMP_CRC32C(crc,
4035  (char *) ControlFile,
4036  offsetof(ControlFileData, crc));
4037  FIN_CRC32C(crc);
4038 
4039  if (!EQ_CRC32C(crc, ControlFile->crc))
4040  ereport(FATAL,
4041  (errmsg("incorrect checksum in control file")));
4042 
4043  /*
4044  * Do compatibility checking immediately. If the database isn't
4045  * compatible with the backend executable, we want to abort before we can
4046  * possibly do any damage.
4047  */
4049  ereport(FATAL,
4050  (errmsg("database files are incompatible with server"),
4051  errdetail("The database cluster was initialized with CATALOG_VERSION_NO %d,"
4052  " but the server was compiled with CATALOG_VERSION_NO %d.",
4054  errhint("It looks like you need to initdb.")));
4055  if (ControlFile->maxAlign != MAXIMUM_ALIGNOF)
4056  ereport(FATAL,
4057  (errmsg("database files are incompatible with server"),
4058  errdetail("The database cluster was initialized with MAXALIGN %d,"
4059  " but the server was compiled with MAXALIGN %d.",
4060  ControlFile->maxAlign, MAXIMUM_ALIGNOF),
4061  errhint("It looks like you need to initdb.")));
4063  ereport(FATAL,
4064  (errmsg("database files are incompatible with server"),
4065  errdetail("The database cluster appears to use a different floating-point number format than the server executable."),
4066  errhint("It looks like you need to initdb.")));
4067  if (ControlFile->blcksz != BLCKSZ)
4068  ereport(FATAL,
4069  (errmsg("database files are incompatible with server"),
4070  errdetail("The database cluster was initialized with BLCKSZ %d,"
4071  " but the server was compiled with BLCKSZ %d.",
4072  ControlFile->blcksz, BLCKSZ),
4073  errhint("It looks like you need to recompile or initdb.")));
4074  if (ControlFile->relseg_size != RELSEG_SIZE)
4075  ereport(FATAL,
4076  (errmsg("database files are incompatible with server"),
4077  errdetail("The database cluster was initialized with RELSEG_SIZE %d,"
4078  " but the server was compiled with RELSEG_SIZE %d.",
4079  ControlFile->relseg_size, RELSEG_SIZE),
4080  errhint("It looks like you need to recompile or initdb.")));
4081  if (ControlFile->xlog_blcksz != XLOG_BLCKSZ)
4082  ereport(FATAL,
4083  (errmsg("database files are incompatible with server"),
4084  errdetail("The database cluster was initialized with XLOG_BLCKSZ %d,"
4085  " but the server was compiled with XLOG_BLCKSZ %d.",
4086  ControlFile->xlog_blcksz, XLOG_BLCKSZ),
4087  errhint("It looks like you need to recompile or initdb.")));
4089  ereport(FATAL,
4090  (errmsg("database files are incompatible with server"),
4091  errdetail("The database cluster was initialized with NAMEDATALEN %d,"
4092  " but the server was compiled with NAMEDATALEN %d.",
4094  errhint("It looks like you need to recompile or initdb.")));
4096  ereport(FATAL,
4097  (errmsg("database files are incompatible with server"),
4098  errdetail("The database cluster was initialized with INDEX_MAX_KEYS %d,"
4099  " but the server was compiled with INDEX_MAX_KEYS %d.",
4101  errhint("It looks like you need to recompile or initdb.")));
4103  ereport(FATAL,
4104  (errmsg("database files are incompatible with server"),
4105  errdetail("The database cluster was initialized with TOAST_MAX_CHUNK_SIZE %d,"
4106  " but the server was compiled with TOAST_MAX_CHUNK_SIZE %d.",
4108  errhint("It looks like you need to recompile or initdb.")));
4110  ereport(FATAL,
4111  (errmsg("database files are incompatible with server"),
4112  errdetail("The database cluster was initialized with LOBLKSIZE %d,"
4113  " but the server was compiled with LOBLKSIZE %d.",
4114  ControlFile->loblksize, (int) LOBLKSIZE),
4115  errhint("It looks like you need to recompile or initdb.")));
4116 
4117 #ifdef USE_FLOAT8_BYVAL
4118  if (ControlFile->float8ByVal != true)
4119  ereport(FATAL,
4120  (errmsg("database files are incompatible with server"),
4121  errdetail("The database cluster was initialized without USE_FLOAT8_BYVAL"
4122  " but the server was compiled with USE_FLOAT8_BYVAL."),
4123  errhint("It looks like you need to recompile or initdb.")));
4124 #else
4125  if (ControlFile->float8ByVal != false)
4126  ereport(FATAL,
4127  (errmsg("database files are incompatible with server"),
4128  errdetail("The database cluster was initialized with USE_FLOAT8_BYVAL"
4129  " but the server was compiled without USE_FLOAT8_BYVAL."),
4130  errhint("It looks like you need to recompile or initdb.")));
4131 #endif
4132 
4134 
4136  ereport(ERROR, (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
4137  errmsg_plural("WAL segment size must be a power of two between 1 MB and 1 GB, but the control file specifies %d byte",
4138  "WAL segment size must be a power of two between 1 MB and 1 GB, but the control file specifies %d bytes",
4140  wal_segment_size)));
4141 
4142  snprintf(wal_segsz_str, sizeof(wal_segsz_str), "%d", wal_segment_size);
4143  SetConfigOption("wal_segment_size", wal_segsz_str, PGC_INTERNAL,
4145 
4146  /* check and update variables dependent on wal_segment_size */
4148  ereport(ERROR, (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
4149  errmsg("\"min_wal_size\" must be at least twice \"wal_segment_size\"")));
4150 
4152  ereport(ERROR, (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
4153  errmsg("\"max_wal_size\" must be at least twice \"wal_segment_size\"")));
4154 
4156  (wal_segment_size / XLOG_BLCKSZ * UsableBytesInPage) -
4158 
4160 
4161  /* Make the initdb settings visible as GUC variables, too */
4162  SetConfigOption("data_checksums", DataChecksumsEnabled() ? "yes" : "no",
4164 }
4165 
4166 /*
4167  * Utility wrapper to update the control file. Note that the control
4168  * file gets flushed.
4169  */
4170 static void
4172 {
4174 }
4175 
4176 /*
4177  * Returns the unique system identifier from control file.
4178  */
4179 uint64
4181 {
4182  Assert(ControlFile != NULL);
4184 }
4185 
4186 /*
4187  * Returns the random nonce from control file.
4188  */
4189 char *
4191 {
4192  Assert(ControlFile != NULL);
4194 }
4195 
4196 /*
4197  * Are checksums enabled for data pages?
4198  */
4199 bool
4201 {
4202  Assert(ControlFile != NULL);
4203  return (ControlFile->data_checksum_version > 0);
4204 }
4205 
4206 /*
4207  * Returns a fake LSN for unlogged relations.
4208  *
4209  * Each call generates an LSN that is greater than any previous value
4210  * returned. The current counter value is saved and restored across clean
4211  * shutdowns, but like unlogged relations, does not survive a crash. This can
4212  * be used in lieu of real LSN values returned by XLogInsert, if you need an
4213  * LSN-like increasing sequence of numbers without writing any WAL.
4214  */
4215 XLogRecPtr
4217 {
4218  XLogRecPtr nextUnloggedLSN;
4219 
4220  /* increment the unloggedLSN counter, need SpinLock */
4222  nextUnloggedLSN = XLogCtl->unloggedLSN++;
4224 
4225  return nextUnloggedLSN;
4226 }
4227 
4228 /*
4229  * Auto-tune the number of XLOG buffers.
4230  *
4231  * The preferred setting for wal_buffers is about 3% of shared_buffers, with
4232  * a maximum of one XLOG segment (there is little reason to think that more
4233  * is helpful, at least so long as we force an fsync when switching log files)
4234  * and a minimum of 8 blocks (which was the default value prior to PostgreSQL
4235  * 9.1, when auto-tuning was added).
4236  *
4237  * This should not be called until NBuffers has received its final value.
4238  */
4239 static int
4241 {
4242  int xbuffers;
4243 
4244  xbuffers = NBuffers / 32;
4245  if (xbuffers > (wal_segment_size / XLOG_BLCKSZ))
4246  xbuffers = (wal_segment_size / XLOG_BLCKSZ);
4247  if (xbuffers < 8)
4248  xbuffers = 8;
4249  return xbuffers;
4250 }
4251 
4252 /*
4253  * GUC check_hook for wal_buffers
4254  */
4255 bool
4257 {
4258  /*
4259  * -1 indicates a request for auto-tune.
4260  */
4261  if (*newval == -1)
4262  {
4263  /*
4264  * If we haven't yet changed the boot_val default of -1, just let it
4265  * be. We'll fix it when XLOGShmemSize is called.
4266  */
4267  if (XLOGbuffers == -1)
4268  return true;
4269 
4270  /* Otherwise, substitute the auto-tune value */
4272  }
4273 
4274  /*
4275  * We clamp manually-set values to at least 4 blocks. Prior to PostgreSQL
4276  * 9.1, a minimum of 4 was enforced by guc.c, but since that is no longer
4277  * the case, we just silently treat such values as a request for the
4278  * minimum. (We could throw an error instead, but that doesn't seem very
4279  * helpful.)
4280  */
4281  if (*newval < 4)
4282  *newval = 4;
4283 
4284  return true;
4285 }
4286 
4287 /*
4288  * GUC check_hook for wal_consistency_checking
4289  */
4290 bool
4292 {
4293  char *rawstring;
4294  List *elemlist;
4295  ListCell *l;
4296  bool newwalconsistency[RM_MAX_ID + 1];
4297 
4298  /* Initialize the array */
4299  MemSet(newwalconsistency, 0, (RM_MAX_ID + 1) * sizeof(bool));
4300 
4301  /* Need a modifiable copy of string */
4302  rawstring = pstrdup(*newval);
4303 
4304  /* Parse string into list of identifiers */
4305  if (!SplitIdentifierString(rawstring, ',', &elemlist))
4306  {
4307  /* syntax error in list */
4308  GUC_check_errdetail("List syntax is invalid.");
4309  pfree(rawstring);
4310  list_free(elemlist);
4311  return false;
4312  }
4313 
4314  foreach(l, elemlist)
4315  {
4316  char *tok = (char *) lfirst(l);
4317  int rmid;
4318 
4319  /* Check for 'all'. */
4320  if (pg_strcasecmp(tok, "all") == 0)
4321  {
4322  for (rmid = 0; rmid <= RM_MAX_ID; rmid++)
4323  if (RmgrIdExists(rmid) && GetRmgr(rmid).rm_mask != NULL)
4324  newwalconsistency[rmid] = true;
4325  }
4326  else
4327  {
4328  /* Check if the token matches any known resource manager. */
4329  bool found = false;
4330 
4331  for (rmid = 0; rmid <= RM_MAX_ID; rmid++)
4332  {
4333  if (RmgrIdExists(rmid) && GetRmgr(rmid).rm_mask != NULL &&
4334  pg_strcasecmp(tok, GetRmgr(rmid).rm_name) == 0)
4335  {
4336  newwalconsistency[rmid] = true;
4337  found = true;
4338  break;
4339  }
4340  }
4341  if (!found)
4342  {
4343  /*
4344  * During startup, it might be a not-yet-loaded custom
4345  * resource manager. Defer checking until
4346  * InitializeWalConsistencyChecking().
4347  */
4349  {
4351  }
4352  else
4353  {
4354  GUC_check_errdetail("Unrecognized key word: \"%s\".", tok);
4355  pfree(rawstring);
4356  list_free(elemlist);
4357  return false;
4358  }
4359  }
4360  }
4361  }
4362 
4363  pfree(rawstring);
4364  list_free(elemlist);
4365 
4366  /* assign new value */
4367  *extra = guc_malloc(ERROR, (RM_MAX_ID + 1) * sizeof(bool));
4368  memcpy(*extra, newwalconsistency, (RM_MAX_ID + 1) * sizeof(bool));
4369  return true;
4370 }
4371 
4372 /*
4373  * GUC assign_hook for wal_consistency_checking
4374  */
4375 void
4376 assign_wal_consistency_checking(const char *newval, void *extra)
4377 {
4378  /*
4379  * If some checks were deferred, it's possible that the checks will fail
4380  * later during InitializeWalConsistencyChecking(). But in that case, the
4381  * postmaster will exit anyway, so it's safe to proceed with the
4382  * assignment.
4383  *
4384  * Any built-in resource managers specified are assigned immediately,
4385  * which affects WAL created before shared_preload_libraries are
4386  * processed. Any custom resource managers specified won't be assigned
4387  * until after shared_preload_libraries are processed, but that's OK
4388  * because WAL for a custom resource manager can't be written before the
4389  * module is loaded anyway.
4390  */
4391  wal_consistency_checking = extra;
4392 }
4393 
4394 /*
4395  * InitializeWalConsistencyChecking: run after loading custom resource managers
4396  *
4397  * If any unknown resource managers were specified in the
4398  * wal_consistency_checking GUC, processing was deferred. Now that
4399  * shared_preload_libraries have been loaded, process wal_consistency_checking
4400  * again.
4401  */
4402 void
4404 {
4406 
4408  {
4409  struct config_generic *guc;
4410 
4411  guc = find_option("wal_consistency_checking", false, false, ERROR);
4412 
4414 
4415  set_config_option_ext("wal_consistency_checking",
4417  guc->scontext, guc->source, guc->srole,
4418  GUC_ACTION_SET, true, ERROR, false);
4419 
4420  /* checking should not be deferred again */
4422  }
4423 }
4424 
4425 /*
4426  * GUC show_hook for archive_command
4427  */
4428 const char *
4430 {
4431  if (XLogArchivingActive())
4432  return XLogArchiveCommand;
4433  else
4434  return "(disabled)";
4435 }
4436 
4437 /*
4438  * GUC show_hook for in_hot_standby
4439  */
4440 const char *
4442 {
4443  /*
4444  * We display the actual state based on shared memory, so that this GUC
4445  * reports up-to-date state if examined intra-query. The underlying
4446  * variable (in_hot_standby_guc) changes only when we transmit a new value
4447  * to the client.
4448  */
4449  return RecoveryInProgress() ? "on" : "off";
4450 }
4451 
4452 /*
4453  * Read the control file, set respective GUCs.
4454  *
4455  * This is to be called during startup, including a crash recovery cycle,
4456  * unless in bootstrap mode, where no control file yet exists. As there's no
4457  * usable shared memory yet (its sizing can depend on the contents of the
4458  * control file!), first store the contents in local memory. XLOGShmemInit()
4459  * will then copy it to shared memory later.
4460  *
4461  * reset just controls whether previous contents are to be expected (in the
4462  * reset case, there's a dangling pointer into old shared memory), or not.
4463  */
4464 void
4466 {
4467  Assert(reset || ControlFile == NULL);
4468  ControlFile = palloc(sizeof(ControlFileData));
4469  ReadControlFile();
4470 }
4471 
4472 /*
4473  * Get the wal_level from the control file. For a standby, this value should be
4474  * considered as its active wal_level, because it may be different from what
4475  * was originally configured on standby.
4476  */
4477 WalLevel
4479 {
4480  return ControlFile->wal_level;
4481 }
4482 
4483 /*
4484  * Initialization of shared memory for XLOG
4485  */
4486 Size
4488 {
4489  Size size;
4490 
4491  /*
4492  * If the value of wal_buffers is -1, use the preferred auto-tune value.
4493  * This isn't an amazingly clean place to do this, but we must wait till
4494  * NBuffers has received its final value, and must do it before using the
4495  * value of XLOGbuffers to do anything important.
4496  *
4497  * We prefer to report this value's source as PGC_S_DYNAMIC_DEFAULT.
4498  * However, if the DBA explicitly set wal_buffers = -1 in the config file,
4499  * then PGC_S_DYNAMIC_DEFAULT will fail to override that and we must force
4500  * the matter with PGC_S_OVERRIDE.
4501  */
4502  if (XLOGbuffers == -1)
4503  {
4504  char buf[32];
4505 
4506  snprintf(buf, sizeof(buf), "%d", XLOGChooseNumBuffers());
4507  SetConfigOption("wal_buffers", buf, PGC_POSTMASTER,
4509  if (XLOGbuffers == -1) /* failed to apply it? */
4510  SetConfigOption("wal_buffers", buf, PGC_POSTMASTER,
4511  PGC_S_OVERRIDE);
4512  }
4513  Assert(XLOGbuffers > 0);
4514 
4515  /* XLogCtl */
4516  size = sizeof(XLogCtlData);
4517 
4518  /* WAL insertion locks, plus alignment */
4519  size = add_size(size, mul_size(sizeof(WALInsertLockPadded), NUM_XLOGINSERT_LOCKS + 1));
4520  /* xlblocks array */
4521  size = add_size(size, mul_size(sizeof(XLogRecPtr), XLOGbuffers));
4522  /* extra alignment padding for XLOG I/O buffers */
4523  size = add_size(size, Max(XLOG_BLCKSZ, PG_IO_ALIGN_SIZE));
4524  /* and the buffers themselves */
4525  size = add_size(size, mul_size(XLOG_BLCKSZ, XLOGbuffers));
4526 
4527  /*
4528  * Note: we don't count ControlFileData, it comes out of the "slop factor"
4529  * added by CreateSharedMemoryAndSemaphores. This lets us use this
4530  * routine again below to compute the actual allocation size.
4531  */
4532 
4533  return size;
4534 }
4535 
4536 void
4538 {
4539  bool foundCFile,
4540  foundXLog;
4541  char *allocptr;
4542  int i;
4543  ControlFileData *localControlFile;
4544 
4545 #ifdef WAL_DEBUG
4546 
4547  /*
4548  * Create a memory context for WAL debugging that's exempt from the normal
4549  * "no pallocs in critical section" rule. Yes, that can lead to a PANIC if
4550  * an allocation fails, but wal_debug is not for production use anyway.
4551  */
4552  if (walDebugCxt == NULL)
4553  {
4555  "WAL Debug",
4557  MemoryContextAllowInCriticalSection(walDebugCxt, true);
4558  }
4559 #endif
4560 
4561 
4562  XLogCtl = (XLogCtlData *)
4563  ShmemInitStruct("XLOG Ctl", XLOGShmemSize(), &foundXLog);
4564 
4565  localControlFile = ControlFile;
4567  ShmemInitStruct("Control File", sizeof(ControlFileData), &foundCFile);
4568 
4569  if (foundCFile || foundXLog)
4570  {
4571  /* both should be present or neither */
4572  Assert(foundCFile && foundXLog);
4573 
4574  /* Initialize local copy of WALInsertLocks */
4576 
4577  if (localControlFile)
4578  pfree(localControlFile);
4579  return;
4580  }
4581  memset(XLogCtl, 0, sizeof(XLogCtlData));
4582 
4583  /*
4584  * Already have read control file locally, unless in bootstrap mode. Move
4585  * contents into shared memory.
4586  */
4587  if (localControlFile)
4588  {
4589  memcpy(ControlFile, localControlFile, sizeof(ControlFileData));
4590  pfree(localControlFile);
4591  }
4592 
4593  /*
4594  * Since XLogCtlData contains XLogRecPtr fields, its sizeof should be a
4595  * multiple of the alignment for same, so no extra alignment padding is
4596  * needed here.
4597  */
4598  allocptr = ((char *) XLogCtl) + sizeof(XLogCtlData);
4599  XLogCtl->xlblocks = (XLogRecPtr *) allocptr;
4600  memset(XLogCtl->xlblocks, 0, sizeof(XLogRecPtr) * XLOGbuffers);
4601  allocptr += sizeof(XLogRecPtr) * XLOGbuffers;
4602 
4603 
4604  /* WAL insertion locks. Ensure they're aligned to the full padded size */
4605  allocptr += sizeof(WALInsertLockPadded) -
4606  ((uintptr_t) allocptr) % sizeof(WALInsertLockPadded);
4608  (WALInsertLockPadded *) allocptr;
4609  allocptr += sizeof(WALInsertLockPadded) * NUM_XLOGINSERT_LOCKS;
4610 
4611  for (i = 0; i < NUM_XLOGINSERT_LOCKS; i++)
4612  {
4616  }
4617 
4618  /*
4619  * Align the start of the page buffers to a full xlog block size boundary.
4620  * This simplifies some calculations in XLOG insertion. It is also
4621  * required for O_DIRECT.
4622  */
4623  allocptr = (char *) TYPEALIGN(XLOG_BLCKSZ, allocptr);
4624  XLogCtl->pages = allocptr;
4625  memset(XLogCtl->pages, 0, (Size) XLOG_BLCKSZ * XLOGbuffers);
4626 
4627  /*
4628  * Do basic initialization of XLogCtl shared data. (StartupXLOG will fill
4629  * in additional info.)
4630  */
4634  XLogCtl->WalWriterSleeping = false;
4635 
4639 }
4640 
4641 /*
4642  * This func must be called ONCE on system install. It creates pg_control
4643  * and the initial XLOG segment.
4644  */
4645 void
4647 {
4648  CheckPoint checkPoint;
4649  char *buffer;
4650  XLogPageHeader page;
4651  XLogLongPageHeader longpage;
4652  XLogRecord *record;
4653  char *recptr;
4654  uint64 sysidentifier;
4655  struct timeval tv;
4656  pg_crc32c crc;
4657 
4658  /* allow ordinary WAL segment creation, like StartupXLOG() would */
4660 
4661  /*
4662  * Select a hopefully-unique system identifier code for this installation.
4663  * We use the result of gettimeofday(), including the fractional seconds
4664  * field, as being about as unique as we can easily get. (Think not to
4665  * use random(), since it hasn't been seeded and there's no portable way
4666  * to seed it other than the system clock value...) The upper half of the
4667  * uint64 value is just the tv_sec part, while the lower half contains the
4668  * tv_usec part (which must fit in 20 bits), plus 12 bits from our current
4669  * PID for a little extra uniqueness. A person knowing this encoding can
4670  * determine the initialization time of the installation, which could
4671  * perhaps be useful sometimes.
4672  */
4673  gettimeofday(&tv, NULL);
4674  sysidentifier = ((uint64) tv.tv_sec) << 32;
4675  sysidentifier |= ((uint64) tv.tv_usec) << 12;
4676  sysidentifier |= getpid() & 0xFFF;
4677 
4678  /* page buffer must be aligned suitably for O_DIRECT */
4679  buffer = (char *) palloc(XLOG_BLCKSZ + XLOG_BLCKSZ);
4680  page = (XLogPageHeader) TYPEALIGN(XLOG_BLCKSZ, buffer);
4681  memset(page, 0, XLOG_BLCKSZ);
4682 
4683  /*
4684  * Set up information for the initial checkpoint record
4685  *
4686  * The initial checkpoint record is written to the beginning of the WAL
4687  * segment with logid=0 logseg=1. The very first WAL segment, 0/0, is not
4688  * used, so that we can use 0/0 to mean "before any valid WAL segment".
4689  */
4690  checkPoint.redo = wal_segment_size + SizeOfXLogLongPHD;
4691  checkPoint.ThisTimeLineID = BootstrapTimeLineID;
4692  checkPoint.PrevTimeLineID = BootstrapTimeLineID;
4693  checkPoint.fullPageWrites = fullPageWrites;
4694  checkPoint.nextXid =
4696  checkPoint.nextOid = FirstGenbkiObjectId;
4697  checkPoint.nextMulti = FirstMultiXactId;
4698  checkPoint.nextMultiOffset = 0;
4699  checkPoint.oldestXid = FirstNormalTransactionId;
4700  checkPoint.oldestXidDB = Template1DbOid;
4701  checkPoint.oldestMulti = FirstMultiXactId;
4702  checkPoint.oldestMultiDB = Template1DbOid;
4705  checkPoint.time = (pg_time_t) time(NULL);
4707 
4708  ShmemVariableCache->nextXid = checkPoint.nextXid;
4709  ShmemVariableCache->nextOid = checkPoint.nextOid;
4711  MultiXactSetNextMXact(checkPoint.nextMulti, checkPoint.nextMultiOffset);
4712  AdvanceOldestClogXid(checkPoint.oldestXid);
4713  SetTransactionIdLimit(checkPoint.oldestXid, checkPoint.oldestXidDB);
4714  SetMultiXactIdLimit(checkPoint.oldestMulti, checkPoint.oldestMultiDB, true);
4716 
4717  /* Set up the XLOG page header */
4718  page->xlp_magic = XLOG_PAGE_MAGIC;
4719  page->xlp_info = XLP_LONG_HEADER;
4720  page->xlp_tli = BootstrapTimeLineID;
4722  longpage = (XLogLongPageHeader) page;
4723  longpage->xlp_sysid = sysidentifier;
4724  longpage->xlp_seg_size = wal_segment_size;
4725  longpage->xlp_xlog_blcksz = XLOG_BLCKSZ;
4726 
4727  /* Insert the initial checkpoint record */
4728  recptr = ((char *) page + SizeOfXLogLongPHD);
4729  record = (XLogRecord *) recptr;
4730  record->xl_prev = 0;
4731  record->xl_xid = InvalidTransactionId;
4732  record->xl_tot_len = SizeOfXLogRecord + SizeOfXLogRecordDataHeaderShort + sizeof(checkPoint);
4734  record->xl_rmid = RM_XLOG_ID;
4735  recptr += SizeOfXLogRecord;
4736  /* fill the XLogRecordDataHeaderShort struct */
4737  *(recptr++) = (char) XLR_BLOCK_ID_DATA_SHORT;
4738  *(recptr++) = sizeof(checkPoint);
4739  memcpy(recptr, &checkPoint, sizeof(checkPoint));
4740  recptr += sizeof(checkPoint);
4741  Assert(recptr - (char *) record == record->xl_tot_len);
4742 
4743  INIT_CRC32C(crc);
4744  COMP_CRC32C(crc, ((char *) record) + SizeOfXLogRecord, record->xl_tot_len - SizeOfXLogRecord);
4745  COMP_CRC32C(crc, (char *) record, offsetof(XLogRecord, xl_crc));
4746  FIN_CRC32C(crc);
4747  record->xl_crc = crc;
4748 
4749  /* Create first XLOG segment file */
4752 
4753  /*
4754  * We needn't bother with Reserve/ReleaseExternalFD here, since we'll
4755  * close the file again in a moment.
4756  */
4757 
4758  /* Write the first page with the initial record */
4759  errno = 0;
4761  if (write(openLogFile, page, XLOG_BLCKSZ) != XLOG_BLCKSZ)
4762  {
4763  /* if write didn't set errno, assume problem is no disk space */
4764  if (errno == 0)
4765  errno = ENOSPC;
4766  ereport(PANIC,
4768  errmsg("could not write bootstrap write-ahead log file: %m")));
4769  }
4771 
4773  if (pg_fsync(openLogFile) != 0)
4774  ereport(PANIC,
4776  errmsg("could not fsync bootstrap write-ahead log file: %m")));
4778 
4779  if (close(openLogFile) != 0)
4780  ereport(PANIC,
4782  errmsg("could not close bootstrap write-ahead log file: %m")));
4783 
4784  openLogFile = -1;
4785 
4786  /* Now create pg_control */
4787  InitControlFile(sysidentifier);
4788  ControlFile->time = checkPoint.time;
4789  ControlFile->checkPoint = checkPoint.redo;
4790  ControlFile->checkPointCopy = checkPoint;
4791 
4792  /* some additional ControlFile fields are set in WriteControlFile() */
4793  WriteControlFile();
4794 
4795  /* Bootstrap the commit log, too */
4796  BootStrapCLOG();
4800 
4801  pfree(buffer);
4802 
4803  /*
4804  * Force control file to be read - in contrast to normal processing we'd
4805  * otherwise never run the checks and GUC related initializations therein.
4806  */
4807  ReadControlFile();
4808 }
4809 
4810 static char *
4812 {
4813  static char buf[128];
4814 
4815  pg_strftime(buf, sizeof(buf),
4816  "%Y-%m-%d %H:%M:%S %Z",
4817  pg_localtime(&tnow, log_timezone));
4818 
4819  return buf;
4820 }
4821 
4822 /*
4823  * Initialize the first WAL segment on new timeline.
4824  */
4825 static void
4827 {
4828  char xlogfname[MAXFNAMELEN];
4829  XLogSegNo endLogSegNo;
4830  XLogSegNo startLogSegNo;
4831 
4832  /* we always switch to a new timeline after archive recovery */
4833  Assert(endTLI != newTLI);
4834 
4835  /*
4836  * Update min recovery point one last time.
4837  */
4839 
4840  /*
4841  * Calculate the last segment on the old timeline, and the first segment
4842  * on the new timeline. If the switch happens in the middle of a segment,
4843  * they are the same, but if the switch happens exactly at a segment
4844  * boundary, startLogSegNo will be endLogSegNo + 1.
4845  */
4846  XLByteToPrevSeg(endOfLog, endLogSegNo, wal_segment_size);
4847  XLByteToSeg(endOfLog, startLogSegNo, wal_segment_size);
4848 
4849  /*
4850  * Initialize the starting WAL segment for the new timeline. If the switch
4851  * happens in the middle of a segment, copy data from the last WAL segment
4852  * of the old timeline up to the switch point, to the starting WAL segment
4853  * on the new timeline.
4854  */
4855  if (endLogSegNo == startLogSegNo)
4856  {
4857  /*
4858  * Make a copy of the file on the new timeline.
4859  *
4860  * Writing WAL isn't allowed yet, so there are no locking
4861  * considerations. But we should be just as tense as XLogFileInit to
4862  * avoid emplacing a bogus file.
4863  */
4864  XLogFileCopy(newTLI, endLogSegNo, endTLI, endLogSegNo,
4865  XLogSegmentOffset(endOfLog, wal_segment_size));
4866  }
4867  else
4868  {
4869  /*
4870  * The switch happened at a segment boundary, so just create the next
4871  * segment on the new timeline.
4872  */
4873  int fd;
4874 
4875  fd = XLogFileInit(startLogSegNo, newTLI);
4876 
4877  if (close(fd) != 0)
4878  {
4879  int save_errno = errno;
4880 
4881  XLogFileName(xlogfname, newTLI, startLogSegNo, wal_segment_size);
4882  errno = save_errno;
4883  ereport(ERROR,
4885  errmsg("could not close file \"%s\": %m", xlogfname)));
4886  }
4887  }
4888 
4889  /*
4890  * Let's just make real sure there are not .ready or .done flags posted
4891  * for the new segment.
4892  */
4893  XLogFileName(xlogfname, newTLI, startLogSegNo, wal_segment_size);
4894  XLogArchiveCleanup(xlogfname);
4895 }
4896 
4897 /*
4898  * Perform cleanup actions at the conclusion of archive recovery.
4899  */
4900 static void
4902  TimeLineID newTLI)
4903 {
4904  /*
4905  * Execute the recovery_end_command, if any.
4906  */
4907  if (recoveryEndCommand && strcmp(recoveryEndCommand, "") != 0)
4909  "recovery_end_command",
4910  true,
4912 
4913  /*
4914  * We switched to a new timeline. Clean up segments on the old timeline.
4915  *
4916  * If there are any higher-numbered segments on the old timeline, remove
4917  * them. They might contain valid WAL, but they might also be
4918  * pre-allocated files containing garbage. In any case, they are not part
4919  * of the new timeline's history so we don't need them.
4920  */
4921  RemoveNonParentXlogFiles(EndOfLog, newTLI);
4922 
4923  /*
4924  * If the switch happened in the middle of a segment, what to do with the
4925  * last, partial segment on the old timeline? If we don't archive it, and
4926  * the server that created the WAL never archives it either (e.g. because
4927  * it was hit by a meteor), it will never make it to the archive. That's
4928  * OK from our point of view, because the new segment that we created with
4929  * the new TLI contains all the WAL from the old timeline up to the switch
4930  * point. But if you later try to do PITR to the "missing" WAL on the old
4931  * timeline, recovery won't find it in the archive. It's physically
4932  * present in the new file with new TLI, but recovery won't look there
4933  * when it's recovering to the older timeline. On the other hand, if we
4934  * archive the partial segment, and the original server on that timeline
4935  * is still running and archives the completed version of the same segment
4936  * later, it will fail. (We used to do that in 9.4 and below, and it
4937  * caused such problems).
4938  *
4939  * As a compromise, we rename the last segment with the .partial suffix,
4940  * and archive it. Archive recovery will never try to read .partial
4941  * segments, so they will normally go unused. But in the odd PITR case,
4942  * the administrator can copy them manually to the pg_wal directory
4943  * (removing the suffix). They can be useful in debugging, too.
4944  *
4945  * If a .done or .ready file already exists for the old timeline, however,
4946  * we had already determined that the segment is complete, so we can let
4947  * it be archived normally. (In particular, if it was restored from the
4948  * archive to begin with, it's expected to have a .done file).
4949  */
4950  if (XLogSegmentOffset(EndOfLog, wal_segment_size) != 0 &&
4952  {
4953  char origfname[MAXFNAMELEN];
4954  XLogSegNo endLogSegNo;
4955 
4956  XLByteToPrevSeg(EndOfLog, endLogSegNo, wal_segment_size);
4957  XLogFileName(origfname, EndOfLogTLI, endLogSegNo, wal_segment_size);
4958 
4959  if (!XLogArchiveIsReadyOrDone(origfname))
4960  {
4961  char origpath[MAXPGPATH];
4962  char partialfname[MAXFNAMELEN];
4963  char partialpath[MAXPGPATH];
4964 
4965  XLogFilePath(origpath, EndOfLogTLI, endLogSegNo, wal_segment_size);
4966  snprintf(partialfname, MAXFNAMELEN, "%s.partial", origfname);
4967  snprintf(partialpath, MAXPGPATH, "%s.partial", origpath);
4968 
4969  /*
4970  * Make sure there's no .done or .ready file for the .partial
4971  * file.
4972  */
4973  XLogArchiveCleanup(partialfname);
4974 
4975  durable_rename(origpath, partialpath, ERROR);
4976  XLogArchiveNotify(partialfname);
4977  }
4978  }
4979 }
4980 
4981 /*
4982  * Check to see if required parameters are set high enough on this server
4983  * for various aspects of recovery operation.
4984  *
4985  * Note that all the parameters which this function tests need to be
4986  * listed in Administrator's Overview section in high-availability.sgml.
4987  * If you change them, don't forget to update the list.
4988  */
4989 static void
4991 {
4992  /*
4993  * For archive recovery, the WAL must be generated with at least 'replica'
4994  * wal_level.
4995  */
4997  {
4998  ereport(FATAL,
4999  (errmsg("WAL was generated with wal_level=minimal, cannot continue recovering"),
5000  errdetail("This happens if you temporarily set wal_level=minimal on the server."),
5001  errhint("Use a backup taken after setting wal_level to higher than minimal.")));
5002  }
5003 
5004  /*
5005  * For Hot Standby, the WAL must be generated with 'replica' mode, and we
5006  * must have at least as many backend slots as the primary.
5007  */
5009  {
5010  /* We ignore autovacuum_max_workers when we make this test. */
5011  RecoveryRequiresIntParameter("max_connections",
5014  RecoveryRequiresIntParameter("max_worker_processes",
5017  RecoveryRequiresIntParameter("max_wal_senders",
5020  RecoveryRequiresIntParameter("max_prepared_transactions",
5023  RecoveryRequiresIntParameter("max_locks_per_transaction",
5026  }
5027 }
5028 
5029 /*
5030  * This must be called ONCE during postmaster or standalone-backend startup
5031  */
5032 void
5034 {
5036  CheckPoint checkPoint;
5037  bool wasShutdown;
5038  bool didCrash;
5039  bool haveTblspcMap;
5040  bool haveBackupLabel;
5041  XLogRecPtr EndOfLog;
5042  TimeLineID EndOfLogTLI;
5043  TimeLineID newTLI;
5044  bool performedWalRecovery;
5045  EndOfWalRecoveryInfo *endOfRecoveryInfo;
5048  TransactionId oldestActiveXID;
5049  bool promoted = false;
5050 
5051  /*
5052  * We should have an aux process resource owner to use, and we should not
5053  * be in a transaction that's installed some other resowner.
5054  */
5056  Assert(CurrentResourceOwner == NULL ||
5059 
5060  /*
5061  * Check that contents look valid.
5062  */
5064  ereport(FATAL,
5065  (errmsg("control file contains invalid checkpoint location")));
5066 
5067  switch (ControlFile->state)
5068  {
5069  case DB_SHUTDOWNED:
5070 
5071  /*
5072  * This is the expected case, so don't be chatty in standalone
5073  * mode
5074  */
5076  (errmsg("database system was shut down at %s",
5077  str_time(ControlFile->time))));
5078  break;
5079 
5081  ereport(LOG,
5082  (errmsg("database system was shut down in recovery at %s",
5083  str_time(ControlFile->time))));
5084  break;
5085 
5086  case DB_SHUTDOWNING:
5087  ereport(LOG,
5088  (errmsg("database system shutdown was interrupted; last known up at %s",
5089  str_time(ControlFile->time))));
5090  break;
5091 
5092  case DB_IN_CRASH_RECOVERY:
5093  ereport(LOG,
5094  (errmsg("database system was interrupted while in recovery at %s",
5096  errhint("This probably means that some data is corrupted and"
5097  " you will have to use the last backup for recovery.")));
5098  break;
5099 
5101  ereport(LOG,
5102  (errmsg("database system was interrupted while in recovery at log time %s",
5104  errhint("If this has occurred more than once some data might be corrupted"
5105  " and you might need to choose an earlier recovery target.")));
5106  break;
5107 
5108  case DB_IN_PRODUCTION:
5109  ereport(LOG,
5110  (errmsg("database system was interrupted; last known up at %s",
5111  str_time(ControlFile->time))));
5112  break;
5113 
5114  default:
5115  ereport(FATAL,
5116  (errmsg("control file contains invalid database cluster state")));
5117  }
5118 
5119  /* This is just to allow attaching to startup process with a debugger */
5120 #ifdef XLOG_REPLAY_DELAY
5122  pg_usleep(60000000L);
5123 #endif
5124 
5125  /*
5126  * Verify that pg_wal and pg_wal/archive_status exist. In cases where
5127  * someone has performed a copy for PITR, these directories may have been
5128  * excluded and need to be re-created.
5129  */
5131 
5132  /* Set up timeout handler needed to report startup progress. */
5136 
5137  /*----------
5138  * If we previously crashed, perform a couple of actions:
5139  *
5140  * - The pg_wal directory may still include some temporary WAL segments
5141  * used when creating a new segment, so perform some clean up to not
5142  * bloat this path. This is done first as there is no point to sync
5143  * this temporary data.
5144  *
5145  * - There might be data which we had written, intending to fsync it, but
5146  * which we had not actually fsync'd yet. Therefore, a power failure in
5147  * the near future might cause earlier unflushed writes to be lost, even
5148  * though more recent data written to disk from here on would be
5149  * persisted. To avoid that, fsync the entire data directory.
5150  */
5151  if (ControlFile->state != DB_SHUTDOWNED &&
5153  {
5156  didCrash = true;
5157  }
5158  else
5159  didCrash = false;
5160 
5161  /*
5162  * Prepare for WAL recovery if needed.
5163  *
5164  * InitWalRecovery analyzes the control file and the backup label file, if
5165  * any. It updates the in-memory ControlFile buffer according to the
5166  * starting checkpoint, and sets InRecovery and ArchiveRecoveryRequested.
5167  * It also applies the tablespace map file, if any.
5168  */
5169  InitWalRecovery(ControlFile, &wasShutdown,
5170  &haveBackupLabel, &haveTblspcMap);
5171  checkPoint = ControlFile->checkPointCopy;
5172 
5173  /* initialize shared memory variables from the checkpoint record */
5174  ShmemVariableCache->nextXid = checkPoint.nextXid;
5175  ShmemVariableCache->nextOid = checkPoint.nextOid;
5177  MultiXactSetNextMXact(checkPoint.nextMulti, checkPoint.nextMultiOffset);
5178  AdvanceOldestClogXid(checkPoint.oldestXid);
5179  SetTransactionIdLimit(checkPoint.oldestXid, checkPoint.oldestXidDB);
5180  SetMultiXactIdLimit(checkPoint.oldestMulti, checkPoint.oldestMultiDB, true);
5182  checkPoint.newestCommitTsXid);
5183  XLogCtl->ckptFullXid = checkPoint.nextXid;
5184 
5185  /*
5186  * Clear out any old relcache cache files. This is *necessary* if we do
5187  * any WAL replay, since that would probably result in the cache files
5188  * being out of sync with database reality. In theory we could leave them
5189  * in place if the database had been cleanly shut down, but it seems
5190  * safest to just remove them always and let them be rebuilt during the
5191  * first backend startup. These files needs to be removed from all
5192  * directories including pg_tblspc, however the symlinks are created only
5193  * after reading tablespace_map file in case of archive recovery from
5194  * backup, so needs to clear old relcache files here after creating
5195  * symlinks.
5196  */
5198 
5199  /*
5200  * Initialize replication slots, before there's a chance to remove
5201  * required resources.
5202  */
5204 
5205  /*
5206  * Startup logical state, needs to be setup now so we have proper data
5207  * during crash recovery.
5208  */
5210 
5211  /*
5212  * Startup CLOG. This must be done after ShmemVariableCache->nextXid has
5213  * been initialized and before we accept connections or begin WAL replay.
5214  */
5215  StartupCLOG();
5216 
5217  /*
5218  * Startup MultiXact. We need to do this early to be able to replay
5219  * truncations.
5220  */
5221  StartupMultiXact();
5222 
5223  /*
5224  * Ditto for commit timestamps. Activate the facility if the setting is
5225  * enabled in the control file, as there should be no tracking of commit
5226  * timestamps done when the setting was disabled. This facility can be
5227  * started or stopped when replaying a XLOG_PARAMETER_CHANGE record.
5228  */
5230  StartupCommitTs();
5231 
5232  /*
5233  * Recover knowledge about replay progress of known replication partners.
5234  */
5236 
5237  /*
5238  * Initialize unlogged LSN. On a clean shutdown, it's restored from the
5239  * control file. On recovery, all unlogged relations are blown away, so
5240  * the unlogged LSN counter can be reset too.
5241  */
5244  else
5246 
5247  /*
5248  * Copy any missing timeline history files between 'now' and the recovery
5249  * target timeline from archive to pg_wal. While we don't need those files
5250  * ourselves - the history file of the recovery target timeline covers all
5251  * the previous timelines in the history too - a cascading standby server
5252  * might be interested in them. Or, if you archive the WAL from this
5253  * server to a different archive than the primary, it'd be good for all
5254  * the history files to get archived there after failover, so that you can
5255  * use one of the old timelines as a PITR target. Timeline history files
5256  * are small, so it's better to copy them unnecessarily than not copy them
5257  * and regret later.
5258  */
5260 
5261  /*
5262  * Before running in recovery, scan pg_twophase and fill in its status to
5263  * be able to work on entries generated by redo. Doing a scan before
5264  * taking any recovery action has the merit to discard any 2PC files that
5265  * are newer than the first record to replay, saving from any conflicts at
5266  * replay. This avoids as well any subsequent scans when doing recovery
5267  * of the on-disk two-phase data.
5268  */
5270 
5271  /*
5272  * When starting with crash recovery, reset pgstat data - it might not be
5273  * valid. Otherwise restore pgstat data. It's safe to do this here,
5274  * because postmaster will not yet have started any other processes.
5275  *
5276  * NB: Restoring replication slot stats relies on slot state to have
5277  * already been restored from disk.
5278  *
5279  * TODO: With a bit of extra work we could just start with a pgstat file
5280  * associated with the checkpoint redo location we're starting from.
5281  */
5282  if (didCrash)
5284  else
5286 
5287  lastFullPageWrites = checkPoint.fullPageWrites;
5288 
5291 
5292  /* REDO */
5293  if (InRecovery)
5294  {
5295  /* Initialize state for RecoveryInProgress() */
5297  if (InArchiveRecovery)
5299  else
5302 
5303  /*
5304  * Update pg_control to show that we are recovering and to show the
5305  * selected checkpoint as the place we are starting from. We also mark
5306  * pg_control with any minimum recovery stop point obtained from a
5307  * backup history file.
5308  *
5309  * No need to hold ControlFileLock yet, we aren't up far enough.
5310  */
5312 
5313  /*
5314  * If there was a backup label file, it's done its job and the info
5315  * has now been propagated into pg_control. We must get rid of the
5316  * label file so that if we crash during recovery, we'll pick up at
5317  * the latest recovery restartpoint instead of going all the way back
5318  * to the backup start point. It seems prudent though to just rename
5319  * the file out of the way rather than delete it completely.
5320  */
5321  if (haveBackupLabel)
5322  {
5323  unlink(BACKUP_LABEL_OLD);
5325  }
5326 
5327  /*
5328  * If there was a tablespace_map file, it's done its job and the
5329  * symlinks have been created. We must get rid of the map file so
5330  * that if we crash during recovery, we don't create symlinks again.
5331  * It seems prudent though to just rename the file out of the way
5332  * rather than delete it completely.
5333  */
5334  if (haveTblspcMap)
5335  {
5336  unlink(TABLESPACE_MAP_OLD);
5338  }
5339 
5340  /*
5341  * Initialize our local copy of minRecoveryPoint. When doing crash
5342  * recovery we want to replay up to the end of WAL. Particularly, in
5343  * the case of a promoted standby minRecoveryPoint value in the
5344  * control file is only updated after the first checkpoint. However,
5345  * if the instance crashes before the first post-recovery checkpoint
5346  * is completed then recovery will use a stale location causing the
5347  * startup process to think that there are still invalid page
5348  * references when checking for data consistency.
5349  */
5350  if (InArchiveRecovery)
5351  {
5354  }
5355  else
5356  {
5359  }
5360 
5361  /* Check that the GUCs used to generate the WAL allow recovery */
5363 
5364  /*
5365  * We're in recovery, so unlogged relations may be trashed and must be
5366  * reset. This should be done BEFORE allowing Hot Standby
5367  * connections, so that read-only backends don't try to read whatever
5368  * garbage is left over from before.
5369  */
5371 
5372  /*
5373  * Likewise, delete any saved transaction snapshot files that got left
5374  * behind by crashed backends.
5375  */
5377 
5378  /*
5379  * Initialize for Hot Standby, if enabled. We won't let backends in
5380  * yet, not until we've reached the min recovery point specified in
5381  * control file and we've established a recovery snapshot from a
5382  * running-xacts WAL record.
5383  */
5385  {
5386  TransactionId *xids;
5387  int nxids;
5388 
5389  ereport(DEBUG1,
5390  (errmsg_internal("initializing for hot standby")));
5391 
5393 
5394  if (wasShutdown)
5395  oldestActiveXID = PrescanPreparedTransactions(&xids, &nxids);
5396  else
5397  oldestActiveXID = checkPoint.oldestActiveXid;
5398  Assert(TransactionIdIsValid(oldestActiveXID));
5399 
5400  /* Tell procarray about the range of xids it has to deal with */
5402 
5403  /*
5404  * Startup subtrans only. CLOG, MultiXact and commit timestamp
5405  * have already been started up and other SLRUs are not maintained
5406  * during recovery and need not be started yet.
5407  */
5408  StartupSUBTRANS(oldestActiveXID);
5409 
5410  /*
5411  * If we're beginning at a shutdown checkpoint, we know that
5412  * nothing was running on the primary at this point. So fake-up an
5413  * empty running-xacts record and use that here and now. Recover
5414  * additional standby state for prepared transactions.
5415  */
5416  if (wasShutdown)
5417  {
5418  RunningTransactionsData running;
5419  TransactionId latestCompletedXid;
5420 
5421  /*
5422  * Construct a RunningTransactions snapshot representing a
5423  * shut down server, with only prepared transactions still
5424  * alive. We're never overflowed at this point because all
5425  * subxids are listed with their parent prepared transactions.
5426  */
5427  running.xcnt = nxids;
5428  running.subxcnt = 0;
5429  running.subxid_overflow = false;
5430  running.nextXid = XidFromFullTransactionId(checkPoint.nextXid);
5431  running.oldestRunningXid = oldestActiveXID;
5432  latestCompletedXid = XidFromFullTransactionId(checkPoint.nextXid);
5433  TransactionIdRetreat(latestCompletedXid);
5434  Assert(TransactionIdIsNormal(latestCompletedXid));
5435  running.latestCompletedXid = latestCompletedXid;
5436  running.xids = xids;
5437 
5438  ProcArrayApplyRecoveryInfo(&running);
5439 
5441  }
5442  }
5443 
5444  /*
5445  * We're all set for replaying the WAL now. Do it.
5446  */
5448  performedWalRecovery = true;
5449  }
5450  else
5451  performedWalRecovery = false;
5452 
5453  /*
5454  * Finish WAL recovery.
5455  */
5456  endOfRecoveryInfo = FinishWalRecovery();
5457  EndOfLog = endOfRecoveryInfo->endOfLog;
5458  EndOfLogTLI = endOfRecoveryInfo->endOfLogTLI;
5459  abortedRecPtr = endOfRecoveryInfo->abortedRecPtr;
5460  missingContrecPtr = endOfRecoveryInfo->missingContrecPtr;
5461 
5462  /*
5463  * Reset ps status display, so as no information related to recovery shows
5464  * up.
5465  */
5466  set_ps_display("");
5467 
5468  /*
5469  * When recovering from a backup (we are in recovery, and archive recovery
5470  * was requested), complain if we did not roll forward far enough to reach
5471  * the point where the database is consistent. For regular online
5472  * backup-from-primary, that means reaching the end-of-backup WAL record
5473  * (at which point we reset backupStartPoint to be Invalid), for
5474  * backup-from-replica (which can't inject records into the WAL stream),
5475  * that point is when we reach the minRecoveryPoint in pg_control (which
5476  * we purposefully copy last when backing up from a replica). For
5477  * pg_rewind (which creates a backup_label with a method of "pg_rewind")
5478  * or snapshot-style backups (which don't), backupEndRequired will be set
5479  * to false.
5480  *
5481  * Note: it is indeed okay to look at the local variable
5482  * LocalMinRecoveryPoint here, even though ControlFile->minRecoveryPoint
5483  * might be further ahead --- ControlFile->minRecoveryPoint cannot have
5484  * been advanced beyond the WAL we processed.
5485  */
5486  if (InRecovery &&
5487  (EndOfLog < LocalMinRecoveryPoint ||
5489  {
5490  /*
5491  * Ran off end of WAL before reaching end-of-backup WAL record, or
5492  * minRecoveryPoint. That's a bad sign, indicating that you tried to
5493  * recover from an online backup but never called pg_backup_stop(), or
5494  * you didn't archive all the WAL needed.
5495  */
5497  {
5499  ereport(FATAL,
5500  (errmsg("WAL ends before end of online backup"),
5501  errhint("All WAL generated while online backup was taken must be available at recovery.")));
5502  else
5503  ereport(FATAL,
5504  (errmsg("WAL ends before consistent recovery point")));
5505  }
5506  }
5507 
5508  /*
5509  * Reset unlogged relations to the contents of their INIT fork. This is
5510  * done AFTER recovery is complete so as to include any unlogged relations
5511  * created during recovery, but BEFORE recovery is marked as having
5512  * completed successfully. Otherwise we'd not retry if any of the post
5513  * end-of-recovery steps fail.
5514  */
5515  if (InRecovery)
5517 
5518  /*
5519  * Pre-scan prepared transactions to find out the range of XIDs present.
5520  * This information is not quite needed yet, but it is positioned here so
5521  * as potential problems are detected before any on-disk change is done.
5522  */
5523  oldestActiveXID = PrescanPreparedTransactions(NULL, NULL);
5524 
5525  /*
5526  * Allow ordinary WAL segment creation before possibly switching to a new
5527  * timeline, which creates a new segment, and after the last ReadRecord().
5528  */
5530 
5531  /*
5532  * Consider whether we need to assign a new timeline ID.
5533  *
5534  * If we did archive recovery, we always assign a new ID. This handles a
5535  * couple of issues. If we stopped short of the end of WAL during
5536  * recovery, then we are clearly generating a new timeline and must assign
5537  * it a unique new ID. Even if we ran to the end, modifying the current
5538  * last segment is problematic because it may result in trying to
5539  * overwrite an already-archived copy of that segment, and we encourage
5540  * DBAs to make their archive_commands reject that. We can dodge the
5541  * problem by making the new active segment have a new timeline ID.
5542  *
5543  * In a normal crash recovery, we can just extend the timeline we were in.
5544  */
5545  newTLI = endOfRecoveryInfo->lastRecTLI;
5547  {
5548  newTLI = findNewestTimeLine(recoveryTargetTLI) + 1;
5549  ereport(LOG,
5550  (errmsg("selected new timeline ID: %u", newTLI)));
5551 
5552  /*
5553  * Make a writable copy of the last WAL segment. (Note that we also
5554  * have a copy of the last block of the old WAL in
5555  * endOfRecovery->lastPage; we will use that below.)
5556  */
5557  XLogInitNewTimeline(EndOfLogTLI, EndOfLog, newTLI);
5558 
5559  /*
5560  * Remove the signal files out of the way, so that we don't
5561  * accidentally re-enter archive recovery mode in a subsequent crash.
5562  */
5563  if (endOfRecoveryInfo->standby_signal_file_found)
5565 
5566  if (endOfRecoveryInfo->recovery_signal_file_found)
5568 
5569  /*
5570  * Write the timeline history file, and have it archived. After this
5571  * point (or rather, as soon as the file is archived), the timeline
5572  * will appear as "taken" in the WAL archive and to any standby
5573  * servers. If we crash before actually switching to the new
5574  * timeline, standby servers will nevertheless think that we switched
5575  * to the new timeline, and will try to connect to the new timeline.
5576  * To minimize the window for that, try to do as little as possible
5577  * between here and writing the end-of-recovery record.
5578  */
5580  EndOfLog, endOfRecoveryInfo->recoveryStopReason);
5581 
5582  ereport(LOG,
5583  (errmsg("archive recovery complete")));
5584  }
5585 
5586  /* Save the selected TimeLineID in shared memory, too */
5587  XLogCtl->InsertTimeLineID = newTLI;
5588  XLogCtl->PrevTimeLineID = endOfRecoveryInfo->lastRecTLI;
5589 
5590  /*
5591  * Actually, if WAL ended in an incomplete record, skip the parts that
5592  * made it through and start writing after the portion that persisted.
5593  * (It's critical to first write an OVERWRITE_CONTRECORD message, which
5594  * we'll do as soon as we're open for writing new WAL.)
5595  */
5597  {
5598  /*
5599  * We should only have a missingContrecPtr if we're not switching to a
5600  * new timeline. When a timeline switch occurs, WAL is copied from the
5601  * old timeline to the new only up to the end of the last complete
5602  * record, so there can't be an incomplete WAL record that we need to
5603  * disregard.
5604  */
5605  Assert(newTLI == endOfRecoveryInfo->lastRecTLI);
5607  EndOfLog = missingContrecPtr;
5608  }
5609 
5610  /*
5611  * Prepare to write WAL starting at EndOfLog location, and init xlog
5612  * buffer cache using the block containing the last record from the
5613  * previous incarnation.
5614  */
5615  Insert = &XLogCtl->Insert;
5616  Insert</