Line data Source code
1 : /*-------------------------------------------------------------------------
2 : *
3 : * postmaster.c
4 : * This program acts as a clearing house for requests to the
5 : * POSTGRES system. Frontend programs connect to the Postmaster,
6 : * and postmaster forks a new backend process to handle the
7 : * connection.
8 : *
9 : * The postmaster also manages system-wide operations such as
10 : * startup and shutdown. The postmaster itself doesn't do those
11 : * operations, mind you --- it just forks off a subprocess to do them
12 : * at the right times. It also takes care of resetting the system
13 : * if a backend crashes.
14 : *
15 : * The postmaster process creates the shared memory and semaphore
16 : * pools during startup, but as a rule does not touch them itself.
17 : * In particular, it is not a member of the PGPROC array of backends
18 : * and so it cannot participate in lock-manager operations. Keeping
19 : * the postmaster away from shared memory operations makes it simpler
20 : * and more reliable. The postmaster is almost always able to recover
21 : * from crashes of individual backends by resetting shared memory;
22 : * if it did much with shared memory then it would be prone to crashing
23 : * along with the backends.
24 : *
25 : * When a request message is received, we now fork() immediately.
26 : * The child process performs authentication of the request, and
27 : * then becomes a backend if successful. This allows the auth code
28 : * to be written in a simple single-threaded style (as opposed to the
29 : * crufty "poor man's multitasking" code that used to be needed).
30 : * More importantly, it ensures that blockages in non-multithreaded
31 : * libraries like SSL or PAM cannot cause denial of service to other
32 : * clients.
33 : *
34 : *
35 : * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
36 : * Portions Copyright (c) 1994, Regents of the University of California
37 : *
38 : *
39 : * IDENTIFICATION
40 : * src/backend/postmaster/postmaster.c
41 : *
42 : * NOTES
43 : *
44 : * Initialization:
45 : * The Postmaster sets up shared memory data structures
46 : * for the backends.
47 : *
48 : * Synchronization:
49 : * The Postmaster shares memory with the backends but should avoid
50 : * touching shared memory, so as not to become stuck if a crashing
51 : * backend screws up locks or shared memory. Likewise, the Postmaster
52 : * should never block on messages from frontend clients.
53 : *
54 : * Garbage Collection:
55 : * The Postmaster cleans up after backends if they have an emergency
56 : * exit and/or core dump.
57 : *
58 : * Error Reporting:
59 : * Use write_stderr() only for reporting "interactive" errors
60 : * (essentially, bogus arguments on the command line). Once the
61 : * postmaster is launched, use ereport().
62 : *
63 : *-------------------------------------------------------------------------
64 : */
65 :
66 : #include "postgres.h"
67 :
68 : #include <unistd.h>
69 : #include <signal.h>
70 : #include <time.h>
71 : #include <sys/wait.h>
72 : #include <ctype.h>
73 : #include <sys/stat.h>
74 : #include <sys/socket.h>
75 : #include <fcntl.h>
76 : #include <sys/param.h>
77 : #include <netdb.h>
78 : #include <limits.h>
79 :
80 : #ifdef USE_BONJOUR
81 : #include <dns_sd.h>
82 : #endif
83 :
84 : #ifdef USE_SYSTEMD
85 : #include <systemd/sd-daemon.h>
86 : #endif
87 :
88 : #ifdef HAVE_PTHREAD_IS_THREADED_NP
89 : #include <pthread.h>
90 : #endif
91 :
92 : #include "access/xlog.h"
93 : #include "access/xlog_internal.h"
94 : #include "access/xlogrecovery.h"
95 : #include "common/file_perm.h"
96 : #include "common/pg_prng.h"
97 : #include "lib/ilist.h"
98 : #include "libpq/libpq.h"
99 : #include "libpq/pqsignal.h"
100 : #include "pgstat.h"
101 : #include "port/pg_bswap.h"
102 : #include "port/pg_getopt_ctx.h"
103 : #include "postmaster/autovacuum.h"
104 : #include "postmaster/bgworker_internals.h"
105 : #include "postmaster/pgarch.h"
106 : #include "postmaster/postmaster.h"
107 : #include "postmaster/syslogger.h"
108 : #include "postmaster/walsummarizer.h"
109 : #include "replication/logicallauncher.h"
110 : #include "replication/slotsync.h"
111 : #include "replication/walsender.h"
112 : #include "storage/aio_subsys.h"
113 : #include "storage/fd.h"
114 : #include "storage/io_worker.h"
115 : #include "storage/ipc.h"
116 : #include "storage/pmsignal.h"
117 : #include "storage/proc.h"
118 : #include "storage/shmem_internal.h"
119 : #include "tcop/backend_startup.h"
120 : #include "tcop/tcopprot.h"
121 : #include "utils/datetime.h"
122 : #include "utils/memutils.h"
123 : #include "utils/pidfile.h"
124 : #include "utils/timestamp.h"
125 : #include "utils/varlena.h"
126 :
127 : #ifdef EXEC_BACKEND
128 : #include "common/file_utils.h"
129 : #include "storage/pg_shmem.h"
130 : #endif
131 :
132 :
133 : /*
134 : * CountChildren and SignalChildren take a bitmask argument to represent
135 : * BackendTypes to count or signal. Define a separate type and functions to
136 : * work with the bitmasks, to avoid accidentally passing a plain BackendType
137 : * in place of a bitmask or vice versa.
138 : */
139 : typedef struct
140 : {
141 : uint32 mask;
142 : } BackendTypeMask;
143 :
144 : StaticAssertDecl(BACKEND_NUM_TYPES < 32, "too many backend types for uint32");
145 :
146 : static const BackendTypeMask BTYPE_MASK_ALL = {(1 << BACKEND_NUM_TYPES) - 1};
147 : static const BackendTypeMask BTYPE_MASK_NONE = {0};
148 :
149 : static inline BackendTypeMask
150 1720 : btmask(BackendType t)
151 : {
152 1720 : BackendTypeMask mask = {.mask = 1 << t};
153 :
154 1720 : return mask;
155 : }
156 :
157 : static inline BackendTypeMask
158 17682 : btmask_add_n(BackendTypeMask mask, int nargs, BackendType *t)
159 : {
160 77958 : for (int i = 0; i < nargs; i++)
161 60276 : mask.mask |= 1 << t[i];
162 17682 : return mask;
163 : }
164 :
165 : #define btmask_add(mask, ...) \
166 : btmask_add_n(mask, \
167 : lengthof(((BackendType[]){__VA_ARGS__})), \
168 : (BackendType[]){__VA_ARGS__} \
169 : )
170 :
171 : static inline BackendTypeMask
172 4896 : btmask_del(BackendTypeMask mask, BackendType t)
173 : {
174 4896 : mask.mask &= ~(1 << t);
175 4896 : return mask;
176 : }
177 :
178 : static inline BackendTypeMask
179 2826 : btmask_all_except_n(int nargs, BackendType *t)
180 : {
181 2826 : BackendTypeMask mask = BTYPE_MASK_ALL;
182 :
183 7722 : for (int i = 0; i < nargs; i++)
184 4896 : mask = btmask_del(mask, t[i]);
185 2826 : return mask;
186 : }
187 :
188 : #define btmask_all_except(...) \
189 : btmask_all_except_n( \
190 : lengthof(((BackendType[]){__VA_ARGS__})), \
191 : (BackendType[]){__VA_ARGS__} \
192 : )
193 :
194 : static inline bool
195 145125 : btmask_contains(BackendTypeMask mask, BackendType t)
196 : {
197 145125 : return (mask.mask & (1 << t)) != 0;
198 : }
199 :
200 :
201 : BackgroundWorker *MyBgworkerEntry = NULL;
202 :
203 : /* The socket number we are listening for connections on */
204 : int PostPortNumber = DEF_PGPORT;
205 :
206 : /* The directory names for Unix socket(s) */
207 : char *Unix_socket_directories;
208 :
209 : /* The TCP listen address(es) */
210 : char *ListenAddresses;
211 :
212 : /*
213 : * SuperuserReservedConnections is the number of backends reserved for
214 : * superuser use, and ReservedConnections is the number of backends reserved
215 : * for use by roles with privileges of the pg_use_reserved_connections
216 : * predefined role. These are taken out of the pool of MaxConnections backend
217 : * slots, so the number of backend slots available for roles that are neither
218 : * superuser nor have privileges of pg_use_reserved_connections is
219 : * (MaxConnections - SuperuserReservedConnections - ReservedConnections).
220 : *
221 : * If the number of remaining slots is less than or equal to
222 : * SuperuserReservedConnections, only superusers can make new connections. If
223 : * the number of remaining slots is greater than SuperuserReservedConnections
224 : * but less than or equal to
225 : * (SuperuserReservedConnections + ReservedConnections), only superusers and
226 : * roles with privileges of pg_use_reserved_connections can make new
227 : * connections. Note that pre-existing superuser and
228 : * pg_use_reserved_connections connections don't count against the limits.
229 : */
230 : int SuperuserReservedConnections;
231 : int ReservedConnections;
232 :
233 : /* The socket(s) we're listening to. */
234 : #define MAXLISTEN 64
235 : static int NumListenSockets = 0;
236 : static pgsocket *ListenSockets = NULL;
237 :
238 : /* still more option variables */
239 : bool EnableSSL = false;
240 :
241 : int PreAuthDelay = 0;
242 : int AuthenticationTimeout = 60;
243 :
244 : bool log_hostname; /* for ps display and logging */
245 :
246 : bool enable_bonjour = false;
247 : char *bonjour_name;
248 : bool restart_after_crash = true;
249 : bool remove_temp_files_after_crash = true;
250 :
251 : /*
252 : * When terminating child processes after fatal errors, like a crash of a
253 : * child process, we normally send SIGQUIT -- and most other comments in this
254 : * file are written on the assumption that we do -- but developers might
255 : * prefer to use SIGABRT to collect per-child core dumps.
256 : */
257 : bool send_abort_for_crash = false;
258 : bool send_abort_for_kill = false;
259 :
260 : /* special child processes; NULL when not running */
261 : static PMChild *StartupPMChild = NULL,
262 : *BgWriterPMChild = NULL,
263 : *CheckpointerPMChild = NULL,
264 : *WalWriterPMChild = NULL,
265 : *WalReceiverPMChild = NULL,
266 : *WalSummarizerPMChild = NULL,
267 : *AutoVacLauncherPMChild = NULL,
268 : *PgArchPMChild = NULL,
269 : *SysLoggerPMChild = NULL,
270 : *SlotSyncWorkerPMChild = NULL;
271 :
272 : /* Startup process's status */
273 : typedef enum
274 : {
275 : STARTUP_NOT_RUNNING,
276 : STARTUP_RUNNING,
277 : STARTUP_SIGNALED, /* we sent it a SIGQUIT or SIGKILL */
278 : STARTUP_CRASHED,
279 : } StartupStatusEnum;
280 :
281 : static StartupStatusEnum StartupStatus = STARTUP_NOT_RUNNING;
282 :
283 : /* Startup/shutdown state */
284 : #define NoShutdown 0
285 : #define SmartShutdown 1
286 : #define FastShutdown 2
287 : #define ImmediateShutdown 3
288 :
289 : static int Shutdown = NoShutdown;
290 :
291 : static bool FatalError = false; /* T if recovering from backend crash */
292 :
293 : /*
294 : * We use a simple state machine to control startup, shutdown, and
295 : * crash recovery (which is rather like shutdown followed by startup).
296 : *
297 : * After doing all the postmaster initialization work, we enter PM_STARTUP
298 : * state and the startup process is launched. The startup process begins by
299 : * reading the control file and other preliminary initialization steps.
300 : * In a normal startup, or after crash recovery, the startup process exits
301 : * with exit code 0 and we switch to PM_RUN state. However, archive recovery
302 : * is handled specially since it takes much longer and we would like to support
303 : * hot standby during archive recovery.
304 : *
305 : * When the startup process is ready to start archive recovery, it signals the
306 : * postmaster, and we switch to PM_RECOVERY state. The background writer and
307 : * checkpointer are launched, while the startup process continues applying WAL.
308 : * If Hot Standby is enabled, then, after reaching a consistent point in WAL
309 : * redo, startup process signals us again, and we switch to PM_HOT_STANDBY
310 : * state and begin accepting connections to perform read-only queries. When
311 : * archive recovery is finished, the startup process exits with exit code 0
312 : * and we switch to PM_RUN state.
313 : *
314 : * Normal child backends can only be launched when we are in PM_RUN or
315 : * PM_HOT_STANDBY state. (connsAllowed can also restrict launching.)
316 : * In other states we handle connection requests by launching "dead-end"
317 : * child processes, which will simply send the client an error message and
318 : * quit. (We track these in the ActiveChildList so that we can know when they
319 : * are all gone; this is important because they're still connected to shared
320 : * memory, and would interfere with an attempt to destroy the shmem segment,
321 : * possibly leading to SHMALL failure when we try to make a new one.)
322 : * In PM_WAIT_DEAD_END state we are waiting for all the dead-end children
323 : * to drain out of the system, and therefore stop accepting connection
324 : * requests at all until the last existing child has quit (which hopefully
325 : * will not be very long).
326 : *
327 : * Notice that this state variable does not distinguish *why* we entered
328 : * states later than PM_RUN --- Shutdown and FatalError must be consulted
329 : * to find that out. FatalError is never true in PM_RECOVERY, PM_HOT_STANDBY,
330 : * or PM_RUN states, nor in PM_WAIT_XLOG_SHUTDOWN states (because we don't
331 : * enter those states when trying to recover from a crash). It can be true in
332 : * PM_STARTUP state, because we don't clear it until we've successfully
333 : * started WAL redo.
334 : */
335 : typedef enum
336 : {
337 : PM_INIT, /* postmaster starting */
338 : PM_STARTUP, /* waiting for startup subprocess */
339 : PM_RECOVERY, /* in archive recovery mode */
340 : PM_HOT_STANDBY, /* in hot standby mode */
341 : PM_RUN, /* normal "database is alive" state */
342 : PM_STOP_BACKENDS, /* need to stop remaining backends */
343 : PM_WAIT_BACKENDS, /* waiting for live backends to exit */
344 : PM_WAIT_XLOG_SHUTDOWN, /* waiting for checkpointer to do shutdown
345 : * ckpt */
346 : PM_WAIT_XLOG_ARCHIVAL, /* waiting for archiver and walsenders to
347 : * finish */
348 : PM_WAIT_IO_WORKERS, /* waiting for io workers to exit */
349 : PM_WAIT_CHECKPOINTER, /* waiting for checkpointer to shut down */
350 : PM_WAIT_DEAD_END, /* waiting for dead-end children to exit */
351 : PM_NO_CHILDREN, /* all important children have exited */
352 : } PMState;
353 :
354 : static PMState pmState = PM_INIT;
355 :
356 : /*
357 : * While performing a "smart shutdown", we restrict new connections but stay
358 : * in PM_RUN or PM_HOT_STANDBY state until all the client backends are gone.
359 : * connsAllowed is a sub-state indicator showing the active restriction.
360 : * It is of no interest unless pmState is PM_RUN or PM_HOT_STANDBY.
361 : */
362 : static bool connsAllowed = true;
363 :
364 : /* Start time of SIGKILL timeout during immediate shutdown or child crash */
365 : /* Zero means timeout is not running */
366 : static time_t AbortStartTime = 0;
367 :
368 : /* Length of said timeout */
369 : #define SIGKILL_CHILDREN_AFTER_SECS 5
370 :
371 : static bool ReachedNormalRunning = false; /* T if we've reached PM_RUN */
372 :
373 : bool ClientAuthInProgress = false; /* T during new-client
374 : * authentication */
375 :
376 : bool redirection_done = false; /* stderr redirected for syslogger? */
377 :
378 : /* received START_AUTOVAC_LAUNCHER signal */
379 : static bool start_autovac_launcher = false;
380 :
381 : /* the launcher needs to be signaled to communicate some condition */
382 : static bool avlauncher_needs_signal = false;
383 :
384 : /* received START_WALRECEIVER signal */
385 : static bool WalReceiverRequested = false;
386 :
387 : /* set when there's a worker that needs to be started up */
388 : static bool StartWorkerNeeded = true;
389 : static bool HaveCrashedWorker = false;
390 :
391 : /* set when signals arrive */
392 : static volatile sig_atomic_t pending_pm_pmsignal;
393 : static volatile sig_atomic_t pending_pm_child_exit;
394 : static volatile sig_atomic_t pending_pm_reload_request;
395 : static volatile sig_atomic_t pending_pm_shutdown_request;
396 : static volatile sig_atomic_t pending_pm_fast_shutdown_request;
397 : static volatile sig_atomic_t pending_pm_immediate_shutdown_request;
398 :
399 : /* event multiplexing object */
400 : static WaitEventSet *pm_wait_set;
401 :
402 : #ifdef USE_SSL
403 : /* Set when and if SSL has been initialized properly */
404 : bool LoadedSSL = false;
405 : #endif
406 :
407 : #ifdef USE_BONJOUR
408 : static DNSServiceRef bonjour_sdref = NULL;
409 : #endif
410 :
411 : /* State for IO worker management. */
412 : static int io_worker_count = 0;
413 : static PMChild *io_worker_children[MAX_IO_WORKERS];
414 :
415 : /*
416 : * postmaster.c - function prototypes
417 : */
418 : static void CloseServerPorts(int status, Datum arg);
419 : static void unlink_external_pid_file(int status, Datum arg);
420 : static void getInstallationPaths(const char *argv0);
421 : static void checkControlFile(void);
422 : static void handle_pm_pmsignal_signal(SIGNAL_ARGS);
423 : static void handle_pm_child_exit_signal(SIGNAL_ARGS);
424 : static void handle_pm_reload_request_signal(SIGNAL_ARGS);
425 : static void handle_pm_shutdown_request_signal(SIGNAL_ARGS);
426 : static void process_pm_pmsignal(void);
427 : static void process_pm_child_exit(void);
428 : static void process_pm_reload_request(void);
429 : static void process_pm_shutdown_request(void);
430 : static void dummy_handler(SIGNAL_ARGS);
431 : static void CleanupBackend(PMChild *bp, int exitstatus);
432 : static void HandleChildCrash(int pid, int exitstatus, const char *procname);
433 : static void LogChildExit(int lev, const char *procname,
434 : int pid, int exitstatus);
435 : static void PostmasterStateMachine(void);
436 : static void UpdatePMState(PMState newState);
437 :
438 : pg_noreturn static void ExitPostmaster(int status);
439 : static int ServerLoop(void);
440 : static int BackendStartup(ClientSocket *client_sock);
441 : static void report_fork_failure_to_client(ClientSocket *client_sock, int errnum);
442 : static CAC_state canAcceptConnections(BackendType backend_type);
443 : static void signal_child(PMChild *pmchild, int signal);
444 : static bool SignalChildren(int signal, BackendTypeMask targetMask);
445 : static void TerminateChildren(int signal);
446 : static int CountChildren(BackendTypeMask targetMask);
447 : static void LaunchMissingBackgroundProcesses(void);
448 : static void maybe_start_bgworkers(void);
449 : static bool maybe_reap_io_worker(int pid);
450 : static void maybe_adjust_io_workers(void);
451 : static bool CreateOptsFile(int argc, char *argv[], char *fullprogname);
452 : static PMChild *StartChildProcess(BackendType type);
453 : static void StartSysLogger(void);
454 : static void StartAutovacuumWorker(void);
455 : static bool StartBackgroundWorker(RegisteredBgWorker *rw);
456 : static void InitPostmasterDeathWatchHandle(void);
457 :
458 : #ifdef WIN32
459 : #define WNOHANG 0 /* ignored, so any integer value will do */
460 :
461 : static pid_t waitpid(pid_t pid, int *exitstatus, int options);
462 : static void WINAPI pgwin32_deadchild_callback(PVOID lpParameter, BOOLEAN TimerOrWaitFired);
463 :
464 : static HANDLE win32ChildQueue;
465 :
466 : typedef struct
467 : {
468 : HANDLE waitHandle;
469 : HANDLE procHandle;
470 : DWORD procId;
471 : } win32_deadchild_waitinfo;
472 : #endif /* WIN32 */
473 :
474 : /* Macros to check exit status of a child process */
475 : #define EXIT_STATUS_0(st) ((st) == 0)
476 : #define EXIT_STATUS_1(st) (WIFEXITED(st) && WEXITSTATUS(st) == 1)
477 : #define EXIT_STATUS_3(st) (WIFEXITED(st) && WEXITSTATUS(st) == 3)
478 :
479 : #ifndef WIN32
480 : /*
481 : * File descriptors for pipe used to monitor if postmaster is alive.
482 : * First is POSTMASTER_FD_WATCH, second is POSTMASTER_FD_OWN.
483 : */
484 : int postmaster_alive_fds[2] = {-1, -1};
485 : #else
486 : /* Process handle of postmaster used for the same purpose on Windows */
487 : HANDLE PostmasterHandle;
488 : #endif
489 :
490 : /*
491 : * Postmaster main entry point
492 : */
493 : void
494 1001 : PostmasterMain(int argc, char *argv[])
495 : {
496 : pg_getopt_ctx optctx;
497 : int opt;
498 : int status;
499 1001 : char *userDoption = NULL;
500 1001 : bool listen_addr_saved = false;
501 1001 : char *output_config_variable = NULL;
502 :
503 1001 : InitProcessGlobals();
504 :
505 1001 : PostmasterPid = MyProcPid;
506 :
507 1001 : IsPostmasterEnvironment = true;
508 :
509 : /*
510 : * Start our win32 signal implementation
511 : */
512 : #ifdef WIN32
513 : pgwin32_signal_initialize();
514 : #endif
515 :
516 : /*
517 : * We should not be creating any files or directories before we check the
518 : * data directory (see checkDataDir()), but just in case set the umask to
519 : * the most restrictive (owner-only) permissions.
520 : *
521 : * checkDataDir() will reset the umask based on the data directory
522 : * permissions.
523 : */
524 1001 : umask(PG_MODE_MASK_OWNER);
525 :
526 : /*
527 : * By default, palloc() requests in the postmaster will be allocated in
528 : * the PostmasterContext, which is space that can be recycled by backends.
529 : * Allocated data that needs to be available to backends should be
530 : * allocated in TopMemoryContext.
531 : */
532 1001 : PostmasterContext = AllocSetContextCreate(TopMemoryContext,
533 : "Postmaster",
534 : ALLOCSET_DEFAULT_SIZES);
535 1001 : MemoryContextSwitchTo(PostmasterContext);
536 :
537 : /* Initialize paths to installation files */
538 1001 : getInstallationPaths(argv[0]);
539 :
540 : /*
541 : * Set up signal handlers for the postmaster process.
542 : *
543 : * CAUTION: when changing this list, check for side-effects on the signal
544 : * handling setup of child processes. See tcop/postgres.c,
545 : * bootstrap/bootstrap.c, postmaster/bgwriter.c, postmaster/walwriter.c,
546 : * postmaster/autovacuum.c, postmaster/pgarch.c, postmaster/syslogger.c,
547 : * postmaster/bgworker.c and postmaster/checkpointer.c.
548 : */
549 1001 : pqinitmask();
550 1001 : sigprocmask(SIG_SETMASK, &BlockSig, NULL);
551 :
552 1001 : pqsignal(SIGHUP, handle_pm_reload_request_signal);
553 1001 : pqsignal(SIGINT, handle_pm_shutdown_request_signal);
554 1001 : pqsignal(SIGQUIT, handle_pm_shutdown_request_signal);
555 1001 : pqsignal(SIGTERM, handle_pm_shutdown_request_signal);
556 1001 : pqsignal(SIGALRM, SIG_IGN); /* ignored */
557 1001 : pqsignal(SIGPIPE, SIG_IGN); /* ignored */
558 1001 : pqsignal(SIGUSR1, handle_pm_pmsignal_signal);
559 1001 : pqsignal(SIGUSR2, dummy_handler); /* unused, reserve for children */
560 1001 : pqsignal(SIGCHLD, handle_pm_child_exit_signal);
561 :
562 : /* This may configure SIGURG, depending on platform. */
563 1001 : InitializeWaitEventSupport();
564 1001 : InitProcessLocalLatch();
565 :
566 : /*
567 : * No other place in Postgres should touch SIGTTIN/SIGTTOU handling. We
568 : * ignore those signals in a postmaster environment, so that there is no
569 : * risk of a child process freezing up due to writing to stderr. But for
570 : * a standalone backend, their default handling is reasonable. Hence, all
571 : * child processes should just allow the inherited settings to stand.
572 : */
573 : #ifdef SIGTTIN
574 1001 : pqsignal(SIGTTIN, SIG_IGN); /* ignored */
575 : #endif
576 : #ifdef SIGTTOU
577 1001 : pqsignal(SIGTTOU, SIG_IGN); /* ignored */
578 : #endif
579 :
580 : /* ignore SIGXFSZ, so that ulimit violations work like disk full */
581 : #ifdef SIGXFSZ
582 1001 : pqsignal(SIGXFSZ, SIG_IGN); /* ignored */
583 : #endif
584 :
585 : /* Begin accepting signals. */
586 1001 : sigprocmask(SIG_SETMASK, &UnBlockSig, NULL);
587 :
588 : /*
589 : * Options setup
590 : */
591 1001 : InitializeGUCOptions();
592 :
593 : /*
594 : * Parse command-line options. CAUTION: keep this in sync with
595 : * tcop/postgres.c (the option sets should not conflict) and with the
596 : * common help() function in main/main.c.
597 : */
598 1001 : pg_getopt_start(&optctx, argc, argv, "B:bC:c:D:d:EeFf:h:ijk:lN:OPp:r:S:sTt:W:-:");
599 1001 : optctx.opterr = 1;
600 3586 : while ((opt = pg_getopt_next(&optctx)) != -1)
601 : {
602 2589 : switch (opt)
603 : {
604 0 : case 'B':
605 0 : SetConfigOption("shared_buffers", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);
606 0 : break;
607 :
608 55 : case 'b':
609 : /* Undocumented flag used for binary upgrades */
610 55 : IsBinaryUpgrade = true;
611 55 : break;
612 :
613 5 : case 'C':
614 5 : output_config_variable = strdup(optctx.optarg);
615 5 : break;
616 :
617 811 : case '-':
618 :
619 : /*
620 : * Error if the user misplaced a special must-be-first option
621 : * for dispatching to a subprogram. parse_dispatch_option()
622 : * returns DISPATCH_POSTMASTER if it doesn't find a match, so
623 : * error for anything else.
624 : */
625 811 : if (parse_dispatch_option(optctx.optarg) != DISPATCH_POSTMASTER)
626 0 : ereport(ERROR,
627 : (errcode(ERRCODE_SYNTAX_ERROR),
628 : errmsg("--%s must be first argument", optctx.optarg)));
629 :
630 : pg_fallthrough;
631 : case 'c':
632 : {
633 : char *name,
634 : *value;
635 :
636 1259 : ParseLongOption(optctx.optarg, &name, &value);
637 1259 : if (!value)
638 : {
639 1 : if (opt == '-')
640 1 : ereport(ERROR,
641 : (errcode(ERRCODE_SYNTAX_ERROR),
642 : errmsg("--%s requires a value",
643 : optctx.optarg)));
644 : else
645 0 : ereport(ERROR,
646 : (errcode(ERRCODE_SYNTAX_ERROR),
647 : errmsg("-c %s requires a value",
648 : optctx.optarg)));
649 : }
650 :
651 1258 : SetConfigOption(name, value, PGC_POSTMASTER, PGC_S_ARGV);
652 1255 : pfree(name);
653 1255 : pfree(value);
654 1255 : break;
655 : }
656 :
657 997 : case 'D':
658 997 : userDoption = strdup(optctx.optarg);
659 997 : break;
660 :
661 0 : case 'd':
662 0 : set_debug_options(atoi(optctx.optarg), PGC_POSTMASTER, PGC_S_ARGV);
663 0 : break;
664 :
665 0 : case 'E':
666 0 : SetConfigOption("log_statement", "all", PGC_POSTMASTER, PGC_S_ARGV);
667 0 : break;
668 :
669 0 : case 'e':
670 0 : SetConfigOption("datestyle", "euro", PGC_POSTMASTER, PGC_S_ARGV);
671 0 : break;
672 :
673 103 : case 'F':
674 103 : SetConfigOption("fsync", "false", PGC_POSTMASTER, PGC_S_ARGV);
675 103 : break;
676 :
677 0 : case 'f':
678 0 : if (!set_plan_disabling_options(optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV))
679 : {
680 0 : write_stderr("%s: invalid argument for option -f: \"%s\"\n",
681 : progname, optctx.optarg);
682 0 : ExitPostmaster(1);
683 : }
684 0 : break;
685 :
686 0 : case 'h':
687 0 : SetConfigOption("listen_addresses", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);
688 0 : break;
689 :
690 0 : case 'i':
691 0 : SetConfigOption("listen_addresses", "*", PGC_POSTMASTER, PGC_S_ARGV);
692 0 : break;
693 :
694 0 : case 'j':
695 : /* only used by interactive backend */
696 0 : break;
697 :
698 103 : case 'k':
699 103 : SetConfigOption("unix_socket_directories", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);
700 103 : break;
701 :
702 0 : case 'l':
703 0 : SetConfigOption("ssl", "true", PGC_POSTMASTER, PGC_S_ARGV);
704 0 : break;
705 :
706 0 : case 'N':
707 0 : SetConfigOption("max_connections", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);
708 0 : break;
709 :
710 0 : case 'O':
711 0 : SetConfigOption("allow_system_table_mods", "true", PGC_POSTMASTER, PGC_S_ARGV);
712 0 : break;
713 :
714 0 : case 'P':
715 0 : SetConfigOption("ignore_system_indexes", "true", PGC_POSTMASTER, PGC_S_ARGV);
716 0 : break;
717 :
718 67 : case 'p':
719 67 : SetConfigOption("port", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);
720 67 : break;
721 :
722 0 : case 'r':
723 : /* only used by single-user backend */
724 0 : break;
725 :
726 0 : case 'S':
727 0 : SetConfigOption("work_mem", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);
728 0 : break;
729 :
730 0 : case 's':
731 0 : SetConfigOption("log_statement_stats", "true", PGC_POSTMASTER, PGC_S_ARGV);
732 0 : break;
733 :
734 0 : case 'T':
735 :
736 : /*
737 : * This option used to be defined as sending SIGSTOP after a
738 : * backend crash, but sending SIGABRT seems more useful.
739 : */
740 0 : SetConfigOption("send_abort_for_crash", "true", PGC_POSTMASTER, PGC_S_ARGV);
741 0 : break;
742 :
743 0 : case 't':
744 : {
745 0 : const char *tmp = get_stats_option_name(optctx.optarg);
746 :
747 0 : if (tmp)
748 : {
749 0 : SetConfigOption(tmp, "true", PGC_POSTMASTER, PGC_S_ARGV);
750 : }
751 : else
752 : {
753 0 : write_stderr("%s: invalid argument for option -t: \"%s\"\n",
754 : progname, optctx.optarg);
755 0 : ExitPostmaster(1);
756 : }
757 0 : break;
758 : }
759 :
760 0 : case 'W':
761 0 : SetConfigOption("post_auth_delay", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);
762 0 : break;
763 :
764 0 : default:
765 0 : write_stderr("Try \"%s --help\" for more information.\n",
766 : progname);
767 0 : ExitPostmaster(1);
768 : }
769 : }
770 :
771 : /*
772 : * Postmaster accepts no non-option switch arguments.
773 : */
774 997 : if (optctx.optind < argc)
775 : {
776 0 : write_stderr("%s: invalid argument: \"%s\"\n",
777 0 : progname, argv[optctx.optind]);
778 0 : write_stderr("Try \"%s --help\" for more information.\n",
779 : progname);
780 0 : ExitPostmaster(1);
781 : }
782 :
783 : /*
784 : * Locate the proper configuration files and data directory, and read
785 : * postgresql.conf for the first time.
786 : */
787 997 : if (!SelectConfigFiles(userDoption, progname))
788 0 : ExitPostmaster(2);
789 :
790 996 : if (output_config_variable != NULL)
791 : {
792 : /*
793 : * If this is a runtime-computed GUC, it hasn't yet been initialized,
794 : * and the present value is not useful. However, this is a convenient
795 : * place to print the value for most GUCs because it is safe to run
796 : * postmaster startup to this point even if the server is already
797 : * running. For the handful of runtime-computed GUCs that we cannot
798 : * provide meaningful values for yet, we wait until later in
799 : * postmaster startup to print the value. We won't be able to use -C
800 : * on running servers for those GUCs, but using this option now would
801 : * lead to incorrect results for them.
802 : */
803 2 : int flags = GetConfigOptionFlags(output_config_variable, true);
804 :
805 2 : if ((flags & GUC_RUNTIME_COMPUTED) == 0)
806 : {
807 : /*
808 : * "-C guc" was specified, so print GUC's value and exit. No
809 : * extra permission check is needed because the user is reading
810 : * inside the data dir.
811 : */
812 1 : const char *config_val = GetConfigOption(output_config_variable,
813 : false, false);
814 :
815 1 : puts(config_val ? config_val : "");
816 1 : ExitPostmaster(0);
817 : }
818 :
819 : /*
820 : * A runtime-computed GUC will be printed later on. As we initialize
821 : * a server startup sequence, silence any log messages that may show
822 : * up in the output generated. FATAL and more severe messages are
823 : * useful to show, even if one would only expect at least PANIC. LOG
824 : * entries are hidden.
825 : */
826 1 : SetConfigOption("log_min_messages", "FATAL", PGC_SUSET,
827 : PGC_S_OVERRIDE);
828 : }
829 :
830 : /* Verify that DataDir looks reasonable */
831 995 : checkDataDir();
832 :
833 : /* Check that pg_control exists */
834 995 : checkControlFile();
835 :
836 : /* And switch working directory into it */
837 995 : ChangeToDataDir();
838 :
839 : /*
840 : * Check for invalid combinations of GUC settings.
841 : */
842 995 : if (SuperuserReservedConnections + ReservedConnections >= MaxConnections)
843 : {
844 0 : write_stderr("%s: \"superuser_reserved_connections\" (%d) plus \"reserved_connections\" (%d) must be less than \"max_connections\" (%d)\n",
845 : progname,
846 : SuperuserReservedConnections, ReservedConnections,
847 : MaxConnections);
848 0 : ExitPostmaster(1);
849 : }
850 995 : if (XLogArchiveMode > ARCHIVE_MODE_OFF && wal_level == WAL_LEVEL_MINIMAL)
851 0 : ereport(ERROR,
852 : (errmsg("WAL archival cannot be enabled when \"wal_level\" is \"minimal\"")));
853 995 : if (max_wal_senders > 0 && wal_level == WAL_LEVEL_MINIMAL)
854 0 : ereport(ERROR,
855 : (errmsg("WAL streaming (\"max_wal_senders\" > 0) requires \"wal_level\" to be \"replica\" or \"logical\"")));
856 995 : if (summarize_wal && wal_level == WAL_LEVEL_MINIMAL)
857 0 : ereport(ERROR,
858 : (errmsg("WAL cannot be summarized when \"wal_level\" is \"minimal\"")));
859 995 : if (sync_replication_slots && wal_level == WAL_LEVEL_MINIMAL)
860 0 : ereport(ERROR,
861 : (errmsg("replication slot synchronization (\"sync_replication_slots\" = on) requires \"wal_level\" to be \"replica\" or \"logical\"")));
862 :
863 : /*
864 : * Other one-time internal sanity checks can go here, if they are fast.
865 : * (Put any slow processing further down, after postmaster.pid creation.)
866 : */
867 995 : if (!CheckDateTokenTables())
868 : {
869 0 : write_stderr("%s: invalid datetoken tables, please fix\n", progname);
870 0 : ExitPostmaster(1);
871 : }
872 :
873 : /* For debugging: display postmaster environment */
874 995 : if (message_level_is_interesting(DEBUG3))
875 : {
876 : #if !defined(WIN32)
877 : extern char **environ;
878 : #endif
879 : char **p;
880 : StringInfoData si;
881 :
882 7 : initStringInfo(&si);
883 :
884 7 : appendStringInfoString(&si, "initial environment dump:");
885 296 : for (p = environ; *p; ++p)
886 289 : appendStringInfo(&si, "\n%s", *p);
887 :
888 7 : ereport(DEBUG3, errmsg_internal("%s", si.data));
889 7 : pfree(si.data);
890 : }
891 :
892 : /*
893 : * Create lockfile for data directory.
894 : *
895 : * We want to do this before we try to grab the input sockets, because the
896 : * data directory interlock is more reliable than the socket-file
897 : * interlock (thanks to whoever decided to put socket files in /tmp :-().
898 : * For the same reason, it's best to grab the TCP socket(s) before the
899 : * Unix socket(s).
900 : *
901 : * Also note that this internally sets up the on_proc_exit function that
902 : * is responsible for removing both data directory and socket lockfiles;
903 : * so it must happen before opening sockets so that at exit, the socket
904 : * lockfiles go away after CloseServerPorts runs.
905 : */
906 995 : CreateDataDirLockFile(true);
907 :
908 : /*
909 : * Read the control file (for error checking and config info).
910 : *
911 : * Since we verify the control file's CRC, this has a useful side effect
912 : * on machines where we need a run-time test for CRC support instructions.
913 : * The postmaster will do the test once at startup, and then its child
914 : * processes will inherit the correct function pointer and not need to
915 : * repeat the test.
916 : */
917 994 : LocalProcessControlFile(false);
918 :
919 : /*
920 : * Register the apply launcher. It's probably a good idea to call this
921 : * before any modules had a chance to take the background worker slots.
922 : */
923 994 : ApplyLauncherRegister();
924 :
925 : /*
926 : * Register the shared memory needs of all core subsystems.
927 : */
928 994 : RegisterBuiltinShmemCallbacks();
929 :
930 : /*
931 : * process any libraries that should be preloaded at postmaster start
932 : */
933 994 : process_shared_preload_libraries();
934 :
935 : /*
936 : * Initialize SSL library, if specified.
937 : */
938 : #ifdef USE_SSL
939 994 : if (EnableSSL)
940 : {
941 51 : (void) secure_initialize(true);
942 38 : LoadedSSL = true;
943 : }
944 : #endif
945 :
946 : /*
947 : * Now that loadable modules have had their chance to alter any GUCs,
948 : * calculate MaxBackends and initialize the machinery to track child
949 : * processes.
950 : */
951 981 : InitializeMaxBackends();
952 981 : InitPostmasterChildSlots();
953 :
954 : /*
955 : * Calculate the size of the PGPROC fast-path lock arrays.
956 : */
957 981 : InitializeFastPathLocks();
958 :
959 : /*
960 : * Also call any legacy shmem request hooks that might've been installed
961 : * by preloaded libraries.
962 : *
963 : * Note: this must be done before ShmemCallRequestCallbacks(), because the
964 : * hooks may request LWLocks with RequestNamedLWLockTranche(), which in
965 : * turn affects the size of the LWLock array calculated in lwlock.c.
966 : */
967 981 : process_shmem_requests();
968 :
969 : /*
970 : * Ask all subsystems, including preloaded libraries, to register their
971 : * shared memory needs.
972 : */
973 981 : ShmemCallRequestCallbacks();
974 :
975 : /*
976 : * Now that loadable modules have had their chance to request additional
977 : * shared memory, determine the value of any runtime-computed GUCs that
978 : * depend on the amount of shared memory required.
979 : */
980 981 : InitializeShmemGUCs();
981 :
982 : /*
983 : * Now that modules have been loaded, we can process any custom resource
984 : * managers specified in the wal_consistency_checking GUC.
985 : */
986 981 : InitializeWalConsistencyChecking();
987 :
988 : /*
989 : * If -C was specified with a runtime-computed GUC, we held off printing
990 : * the value earlier, as the GUC was not yet initialized. We handle -C
991 : * for most GUCs before we lock the data directory so that the option may
992 : * be used on a running server. However, a handful of GUCs are runtime-
993 : * computed and do not have meaningful values until after locking the data
994 : * directory, and we cannot safely calculate their values earlier on a
995 : * running server. At this point, such GUCs should be properly
996 : * initialized, and we haven't yet set up shared memory, so this is a good
997 : * time to handle the -C option for these special GUCs.
998 : */
999 981 : if (output_config_variable != NULL)
1000 : {
1001 1 : const char *config_val = GetConfigOption(output_config_variable,
1002 : false, false);
1003 :
1004 1 : puts(config_val ? config_val : "");
1005 1 : ExitPostmaster(0);
1006 : }
1007 :
1008 : /*
1009 : * Set up shared memory and semaphores.
1010 : *
1011 : * Note: if using SysV shmem and/or semas, each postmaster startup will
1012 : * normally choose the same IPC keys. This helps ensure that we will
1013 : * clean up dead IPC objects if the postmaster crashes and is restarted.
1014 : */
1015 980 : CreateSharedMemoryAndSemaphores();
1016 :
1017 : /*
1018 : * Estimate number of openable files. This must happen after setting up
1019 : * semaphores, because on some platforms semaphores count as open files.
1020 : */
1021 979 : set_max_safe_fds();
1022 :
1023 : /*
1024 : * Initialize pipe (or process handle on Windows) that allows children to
1025 : * wake up from sleep on postmaster death.
1026 : */
1027 979 : InitPostmasterDeathWatchHandle();
1028 :
1029 : #ifdef WIN32
1030 :
1031 : /*
1032 : * Initialize I/O completion port used to deliver list of dead children.
1033 : */
1034 : win32ChildQueue = CreateIoCompletionPort(INVALID_HANDLE_VALUE, NULL, 0, 1);
1035 : if (win32ChildQueue == NULL)
1036 : ereport(FATAL,
1037 : (errmsg("could not create I/O completion port for child queue")));
1038 : #endif
1039 :
1040 : #ifdef EXEC_BACKEND
1041 : /* Write out nondefault GUC settings for child processes to use */
1042 : write_nondefault_variables(PGC_POSTMASTER);
1043 :
1044 : /*
1045 : * Clean out the temp directory used to transmit parameters to child
1046 : * processes (see internal_forkexec). We must do this before launching
1047 : * any child processes, else we have a race condition: we could remove a
1048 : * parameter file before the child can read it. It should be safe to do
1049 : * so now, because we verified earlier that there are no conflicting
1050 : * Postgres processes in this data directory.
1051 : */
1052 : RemovePgTempFilesInDir(PG_TEMP_FILES_DIR, true, false);
1053 : #endif
1054 :
1055 : /*
1056 : * Forcibly remove the files signaling a standby promotion request.
1057 : * Otherwise, the existence of those files triggers a promotion too early,
1058 : * whether a user wants that or not.
1059 : *
1060 : * This removal of files is usually unnecessary because they can exist
1061 : * only during a few moments during a standby promotion. However there is
1062 : * a race condition: if pg_ctl promote is executed and creates the files
1063 : * during a promotion, the files can stay around even after the server is
1064 : * brought up to be the primary. Then, if a new standby starts by using
1065 : * the backup taken from the new primary, the files can exist at server
1066 : * startup and must be removed in order to avoid an unexpected promotion.
1067 : *
1068 : * Note that promotion signal files need to be removed before the startup
1069 : * process is invoked. Because, after that, they can be used by
1070 : * postmaster's SIGUSR1 signal handler.
1071 : */
1072 979 : RemovePromoteSignalFiles();
1073 :
1074 : /* Do the same for logrotate signal file */
1075 979 : RemoveLogrotateSignalFiles();
1076 :
1077 : /* Remove any outdated file holding the current log filenames. */
1078 979 : if (unlink(LOG_METAINFO_DATAFILE) < 0 && errno != ENOENT)
1079 0 : ereport(LOG,
1080 : (errcode_for_file_access(),
1081 : errmsg("could not remove file \"%s\": %m",
1082 : LOG_METAINFO_DATAFILE)));
1083 :
1084 : /*
1085 : * If enabled, start up syslogger collection subprocess
1086 : */
1087 979 : if (Logging_collector)
1088 1 : StartSysLogger();
1089 :
1090 : /*
1091 : * Reset whereToSendOutput from DestDebug (its starting state) to
1092 : * DestNone. This stops ereport from sending log messages to stderr unless
1093 : * Log_destination permits. We don't do this until the postmaster is
1094 : * fully launched, since startup failures may as well be reported to
1095 : * stderr.
1096 : *
1097 : * If we are in fact disabling logging to stderr, first emit a log message
1098 : * saying so, to provide a breadcrumb trail for users who may not remember
1099 : * that their logging is configured to go somewhere else.
1100 : */
1101 979 : if (!(Log_destination & LOG_DESTINATION_STDERR))
1102 0 : ereport(LOG,
1103 : (errmsg("ending log output to stderr"),
1104 : errhint("Future log output will go to log destination \"%s\".",
1105 : Log_destination_string)));
1106 :
1107 979 : whereToSendOutput = DestNone;
1108 :
1109 : /*
1110 : * Report server startup in log. While we could emit this much earlier,
1111 : * it seems best to do so after starting the log collector, if we intend
1112 : * to use one.
1113 : */
1114 979 : ereport(LOG,
1115 : (errmsg("starting %s", PG_VERSION_STR)));
1116 :
1117 : /*
1118 : * Establish input sockets.
1119 : *
1120 : * First set up an on_proc_exit function that's charged with closing the
1121 : * sockets again at postmaster shutdown.
1122 : */
1123 979 : ListenSockets = palloc(MAXLISTEN * sizeof(pgsocket));
1124 979 : on_proc_exit(CloseServerPorts, 0);
1125 :
1126 979 : if (ListenAddresses)
1127 : {
1128 : char *rawstring;
1129 : List *elemlist;
1130 : ListCell *l;
1131 979 : int success = 0;
1132 :
1133 : /* Need a modifiable copy of ListenAddresses */
1134 979 : rawstring = pstrdup(ListenAddresses);
1135 :
1136 : /* Parse string into list of hostnames */
1137 979 : if (!SplitGUCList(rawstring, ',', &elemlist))
1138 : {
1139 : /* syntax error in list */
1140 0 : ereport(FATAL,
1141 : (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
1142 : errmsg("invalid list syntax in parameter \"%s\"",
1143 : "listen_addresses")));
1144 : }
1145 :
1146 1020 : foreach(l, elemlist)
1147 : {
1148 41 : char *curhost = (char *) lfirst(l);
1149 :
1150 41 : if (strcmp(curhost, "*") == 0)
1151 0 : status = ListenServerPort(AF_UNSPEC, NULL,
1152 0 : (unsigned short) PostPortNumber,
1153 : NULL,
1154 : ListenSockets,
1155 : &NumListenSockets,
1156 : MAXLISTEN);
1157 : else
1158 41 : status = ListenServerPort(AF_UNSPEC, curhost,
1159 41 : (unsigned short) PostPortNumber,
1160 : NULL,
1161 : ListenSockets,
1162 : &NumListenSockets,
1163 : MAXLISTEN);
1164 :
1165 41 : if (status == STATUS_OK)
1166 : {
1167 41 : success++;
1168 : /* record the first successful host addr in lockfile */
1169 41 : if (!listen_addr_saved)
1170 : {
1171 41 : AddToDataDirLockFile(LOCK_FILE_LINE_LISTEN_ADDR, curhost);
1172 41 : listen_addr_saved = true;
1173 : }
1174 : }
1175 : else
1176 0 : ereport(WARNING,
1177 : (errmsg("could not create listen socket for \"%s\"",
1178 : curhost)));
1179 : }
1180 :
1181 979 : if (!success && elemlist != NIL)
1182 0 : ereport(FATAL,
1183 : (errmsg("could not create any TCP/IP sockets")));
1184 :
1185 979 : list_free(elemlist);
1186 979 : pfree(rawstring);
1187 : }
1188 :
1189 : #ifdef USE_BONJOUR
1190 : /* Register for Bonjour only if we opened TCP socket(s) */
1191 : if (enable_bonjour && NumListenSockets > 0)
1192 : {
1193 : DNSServiceErrorType err;
1194 :
1195 : /*
1196 : * We pass 0 for interface_index, which will result in registering on
1197 : * all "applicable" interfaces. It's not entirely clear from the
1198 : * DNS-SD docs whether this would be appropriate if we have bound to
1199 : * just a subset of the available network interfaces.
1200 : */
1201 : err = DNSServiceRegister(&bonjour_sdref,
1202 : 0,
1203 : 0,
1204 : bonjour_name,
1205 : "_postgresql._tcp.",
1206 : NULL,
1207 : NULL,
1208 : pg_hton16(PostPortNumber),
1209 : 0,
1210 : NULL,
1211 : NULL,
1212 : NULL);
1213 : if (err != kDNSServiceErr_NoError)
1214 : ereport(LOG,
1215 : (errmsg("DNSServiceRegister() failed: error code %ld",
1216 : (long) err)));
1217 :
1218 : /*
1219 : * We don't bother to read the mDNS daemon's reply, and we expect that
1220 : * it will automatically terminate our registration when the socket is
1221 : * closed at postmaster termination. So there's nothing more to be
1222 : * done here. However, the bonjour_sdref is kept around so that
1223 : * forked children can close their copies of the socket.
1224 : */
1225 : }
1226 : #endif
1227 :
1228 979 : if (Unix_socket_directories)
1229 : {
1230 : char *rawstring;
1231 : List *elemlist;
1232 : ListCell *l;
1233 979 : int success = 0;
1234 :
1235 : /* Need a modifiable copy of Unix_socket_directories */
1236 979 : rawstring = pstrdup(Unix_socket_directories);
1237 :
1238 : /* Parse string into list of directories */
1239 979 : if (!SplitDirectoriesString(rawstring, ',', &elemlist))
1240 : {
1241 : /* syntax error in list */
1242 0 : ereport(FATAL,
1243 : (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
1244 : errmsg("invalid list syntax in parameter \"%s\"",
1245 : "unix_socket_directories")));
1246 : }
1247 :
1248 1957 : foreach(l, elemlist)
1249 : {
1250 978 : char *socketdir = (char *) lfirst(l);
1251 :
1252 978 : status = ListenServerPort(AF_UNIX, NULL,
1253 978 : (unsigned short) PostPortNumber,
1254 : socketdir,
1255 : ListenSockets,
1256 : &NumListenSockets,
1257 : MAXLISTEN);
1258 :
1259 978 : if (status == STATUS_OK)
1260 : {
1261 978 : success++;
1262 : /* record the first successful Unix socket in lockfile */
1263 978 : if (success == 1)
1264 978 : AddToDataDirLockFile(LOCK_FILE_LINE_SOCKET_DIR, socketdir);
1265 : }
1266 : else
1267 0 : ereport(WARNING,
1268 : (errmsg("could not create Unix-domain socket in directory \"%s\"",
1269 : socketdir)));
1270 : }
1271 :
1272 979 : if (!success && elemlist != NIL)
1273 0 : ereport(FATAL,
1274 : (errmsg("could not create any Unix-domain sockets")));
1275 :
1276 979 : list_free_deep(elemlist);
1277 979 : pfree(rawstring);
1278 : }
1279 :
1280 : /*
1281 : * check that we have some socket to listen on
1282 : */
1283 979 : if (NumListenSockets == 0)
1284 0 : ereport(FATAL,
1285 : (errmsg("no socket created for listening")));
1286 :
1287 : /*
1288 : * If no valid TCP ports, write an empty line for listen address,
1289 : * indicating the Unix socket must be used. Note that this line is not
1290 : * added to the lock file until there is a socket backing it.
1291 : */
1292 979 : if (!listen_addr_saved)
1293 938 : AddToDataDirLockFile(LOCK_FILE_LINE_LISTEN_ADDR, "");
1294 :
1295 : /*
1296 : * Record postmaster options. We delay this till now to avoid recording
1297 : * bogus options (eg, unusable port number).
1298 : */
1299 979 : if (!CreateOptsFile(argc, argv, my_exec_path))
1300 0 : ExitPostmaster(1);
1301 :
1302 : /*
1303 : * Write the external PID file if requested
1304 : */
1305 979 : if (external_pid_file)
1306 : {
1307 0 : FILE *fpidfile = fopen(external_pid_file, "w");
1308 :
1309 0 : if (fpidfile)
1310 : {
1311 0 : fprintf(fpidfile, "%d\n", MyProcPid);
1312 0 : fclose(fpidfile);
1313 :
1314 : /* Make PID file world readable */
1315 0 : if (chmod(external_pid_file, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH) != 0)
1316 0 : write_stderr("%s: could not change permissions of external PID file \"%s\": %m\n",
1317 : progname, external_pid_file);
1318 : }
1319 : else
1320 0 : write_stderr("%s: could not write external PID file \"%s\": %m\n",
1321 : progname, external_pid_file);
1322 :
1323 0 : on_proc_exit(unlink_external_pid_file, 0);
1324 : }
1325 :
1326 : /*
1327 : * Remove old temporary files. At this point there can be no other
1328 : * Postgres processes running in this directory, so this should be safe.
1329 : */
1330 979 : RemovePgTempFiles();
1331 :
1332 : /*
1333 : * Initialize the autovacuum subsystem (again, no process start yet)
1334 : */
1335 979 : autovac_init();
1336 :
1337 : /*
1338 : * Load configuration files for client authentication.
1339 : */
1340 979 : if (!load_hba())
1341 : {
1342 : /*
1343 : * It makes no sense to continue if we fail to load the HBA file,
1344 : * since there is no way to connect to the database in this case.
1345 : */
1346 0 : ereport(FATAL,
1347 : /* translator: %s is a configuration file */
1348 : (errmsg("could not load %s", HbaFileName)));
1349 : }
1350 979 : if (!load_ident())
1351 : {
1352 : /*
1353 : * We can start up without the IDENT file, although it means that you
1354 : * cannot log in using any of the authentication methods that need a
1355 : * user name mapping. load_ident() already logged the details of error
1356 : * to the log.
1357 : */
1358 : }
1359 :
1360 : #ifdef HAVE_PTHREAD_IS_THREADED_NP
1361 :
1362 : /*
1363 : * On macOS, libintl replaces setlocale() with a version that calls
1364 : * CFLocaleCopyCurrent() when its second argument is "" and every relevant
1365 : * environment variable is unset or empty. CFLocaleCopyCurrent() makes
1366 : * the process multithreaded. The postmaster calls sigprocmask() and
1367 : * calls fork() without an immediate exec(), both of which have undefined
1368 : * behavior in a multithreaded program. A multithreaded postmaster is the
1369 : * normal case on Windows, which offers neither fork() nor sigprocmask().
1370 : * Currently, macOS is the only platform having pthread_is_threaded_np(),
1371 : * so we need not worry whether this HINT is appropriate elsewhere.
1372 : */
1373 : if (pthread_is_threaded_np() != 0)
1374 : ereport(FATAL,
1375 : (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
1376 : errmsg("postmaster became multithreaded during startup"),
1377 : errhint("Set the LC_ALL environment variable to a valid locale.")));
1378 : #endif
1379 :
1380 : /*
1381 : * Remember postmaster startup time
1382 : */
1383 979 : PgStartTime = GetCurrentTimestamp();
1384 :
1385 : /*
1386 : * Report postmaster status in the postmaster.pid file, to allow pg_ctl to
1387 : * see what's happening.
1388 : */
1389 979 : AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_STARTING);
1390 :
1391 979 : UpdatePMState(PM_STARTUP);
1392 :
1393 : /* Make sure we can perform I/O while starting up. */
1394 979 : maybe_adjust_io_workers();
1395 :
1396 : /* Start bgwriter and checkpointer so they can help with recovery */
1397 979 : if (CheckpointerPMChild == NULL)
1398 979 : CheckpointerPMChild = StartChildProcess(B_CHECKPOINTER);
1399 979 : if (BgWriterPMChild == NULL)
1400 979 : BgWriterPMChild = StartChildProcess(B_BG_WRITER);
1401 :
1402 : /*
1403 : * We're ready to rock and roll...
1404 : */
1405 979 : StartupPMChild = StartChildProcess(B_STARTUP);
1406 : Assert(StartupPMChild != NULL);
1407 979 : StartupStatus = STARTUP_RUNNING;
1408 :
1409 : /* Some workers may be scheduled to start now */
1410 979 : maybe_start_bgworkers();
1411 :
1412 979 : status = ServerLoop();
1413 :
1414 : /*
1415 : * ServerLoop probably shouldn't ever return, but if it does, close down.
1416 : */
1417 0 : ExitPostmaster(status != STATUS_OK);
1418 :
1419 : abort(); /* not reached */
1420 : }
1421 :
1422 :
1423 : /*
1424 : * on_proc_exit callback to close server's listen sockets
1425 : */
1426 : static void
1427 979 : CloseServerPorts(int status, Datum arg)
1428 : {
1429 : int i;
1430 :
1431 : /*
1432 : * First, explicitly close all the socket FDs. We used to just let this
1433 : * happen implicitly at postmaster exit, but it's better to close them
1434 : * before we remove the postmaster.pid lockfile; otherwise there's a race
1435 : * condition if a new postmaster wants to re-use the TCP port number.
1436 : */
1437 1999 : for (i = 0; i < NumListenSockets; i++)
1438 : {
1439 1020 : if (closesocket(ListenSockets[i]) != 0)
1440 0 : elog(LOG, "could not close listen socket: %m");
1441 : }
1442 979 : NumListenSockets = 0;
1443 :
1444 : /*
1445 : * Next, remove any filesystem entries for Unix sockets. To avoid race
1446 : * conditions against incoming postmasters, this must happen after closing
1447 : * the sockets and before removing lock files.
1448 : */
1449 979 : RemoveSocketFiles();
1450 :
1451 : /*
1452 : * We don't do anything about socket lock files here; those will be
1453 : * removed in a later on_proc_exit callback.
1454 : */
1455 979 : }
1456 :
1457 : /*
1458 : * on_proc_exit callback to delete external_pid_file
1459 : */
1460 : static void
1461 0 : unlink_external_pid_file(int status, Datum arg)
1462 : {
1463 0 : if (external_pid_file)
1464 0 : unlink(external_pid_file);
1465 0 : }
1466 :
1467 :
1468 : /*
1469 : * Compute and check the directory paths to files that are part of the
1470 : * installation (as deduced from the postgres executable's own location)
1471 : */
1472 : static void
1473 1001 : getInstallationPaths(const char *argv0)
1474 : {
1475 : DIR *pdir;
1476 :
1477 : /* Locate the postgres executable itself */
1478 1001 : if (find_my_exec(argv0, my_exec_path) < 0)
1479 0 : ereport(FATAL,
1480 : (errmsg("%s: could not locate my own executable path", argv0)));
1481 :
1482 : #ifdef EXEC_BACKEND
1483 : /* Locate executable backend before we change working directory */
1484 : if (find_other_exec(argv0, "postgres", PG_BACKEND_VERSIONSTR,
1485 : postgres_exec_path) < 0)
1486 : ereport(FATAL,
1487 : (errmsg("%s: could not locate matching postgres executable",
1488 : argv0)));
1489 : #endif
1490 :
1491 : /*
1492 : * Locate the pkglib directory --- this has to be set early in case we try
1493 : * to load any modules from it in response to postgresql.conf entries.
1494 : */
1495 1001 : get_pkglib_path(my_exec_path, pkglib_path);
1496 :
1497 : /*
1498 : * Verify that there's a readable directory there; otherwise the Postgres
1499 : * installation is incomplete or corrupt. (A typical cause of this
1500 : * failure is that the postgres executable has been moved or hardlinked to
1501 : * some directory that's not a sibling of the installation lib/
1502 : * directory.)
1503 : */
1504 1001 : pdir = AllocateDir(pkglib_path);
1505 1001 : if (pdir == NULL)
1506 0 : ereport(ERROR,
1507 : (errcode_for_file_access(),
1508 : errmsg("could not open directory \"%s\": %m",
1509 : pkglib_path),
1510 : errhint("This may indicate an incomplete PostgreSQL installation, or that the file \"%s\" has been moved away from its proper location.",
1511 : my_exec_path)));
1512 1001 : FreeDir(pdir);
1513 :
1514 : /*
1515 : * It's not worth checking the share/ directory. If the lib/ directory is
1516 : * there, then share/ probably is too.
1517 : */
1518 1001 : }
1519 :
1520 : /*
1521 : * Check that pg_control exists in the correct location in the data directory.
1522 : *
1523 : * No attempt is made to validate the contents of pg_control here. This is
1524 : * just a sanity check to see if we are looking at a real data directory.
1525 : */
1526 : static void
1527 995 : checkControlFile(void)
1528 : {
1529 : char path[MAXPGPATH];
1530 : FILE *fp;
1531 :
1532 995 : snprintf(path, sizeof(path), "%s/%s", DataDir, XLOG_CONTROL_FILE);
1533 :
1534 995 : fp = AllocateFile(path, PG_BINARY_R);
1535 995 : if (fp == NULL)
1536 : {
1537 0 : write_stderr("%s: could not find the database system\n"
1538 : "Expected to find it in the directory \"%s\",\n"
1539 : "but could not open file \"%s\": %m\n",
1540 : progname, DataDir, path);
1541 0 : ExitPostmaster(2);
1542 : }
1543 995 : FreeFile(fp);
1544 995 : }
1545 :
1546 : /*
1547 : * Determine how long should we let ServerLoop sleep, in milliseconds.
1548 : *
1549 : * In normal conditions we wait at most one minute, to ensure that the other
1550 : * background tasks handled by ServerLoop get done even when no requests are
1551 : * arriving. However, if there are background workers waiting to be started,
1552 : * we don't actually sleep so that they are quickly serviced. Other exception
1553 : * cases are as shown in the code.
1554 : */
1555 : static int
1556 181226 : DetermineSleepTime(void)
1557 : {
1558 181226 : TimestampTz next_wakeup = 0;
1559 :
1560 : /*
1561 : * Normal case: either there are no background workers at all, or we're in
1562 : * a shutdown sequence (during which we ignore bgworkers altogether).
1563 : */
1564 181226 : if (Shutdown > NoShutdown ||
1565 173786 : (!StartWorkerNeeded && !HaveCrashedWorker))
1566 : {
1567 181226 : if (AbortStartTime != 0)
1568 : {
1569 1646 : time_t curtime = time(NULL);
1570 : int seconds;
1571 :
1572 : /*
1573 : * time left to abort; clamp to 0 if it already expired, or if
1574 : * time goes backwards
1575 : */
1576 1646 : if (curtime < AbortStartTime ||
1577 1646 : curtime - AbortStartTime >= SIGKILL_CHILDREN_AFTER_SECS)
1578 0 : seconds = 0;
1579 : else
1580 1646 : seconds = SIGKILL_CHILDREN_AFTER_SECS -
1581 : (curtime - AbortStartTime);
1582 :
1583 1646 : return seconds * 1000;
1584 : }
1585 : else
1586 179580 : return 60 * 1000;
1587 : }
1588 :
1589 0 : if (StartWorkerNeeded)
1590 0 : return 0;
1591 :
1592 0 : if (HaveCrashedWorker)
1593 : {
1594 : dlist_mutable_iter iter;
1595 :
1596 : /*
1597 : * When there are crashed bgworkers, we sleep just long enough that
1598 : * they are restarted when they request to be. Scan the list to
1599 : * determine the minimum of all wakeup times according to most recent
1600 : * crash time and requested restart interval.
1601 : */
1602 0 : dlist_foreach_modify(iter, &BackgroundWorkerList)
1603 : {
1604 : RegisteredBgWorker *rw;
1605 : TimestampTz this_wakeup;
1606 :
1607 0 : rw = dlist_container(RegisteredBgWorker, rw_lnode, iter.cur);
1608 :
1609 0 : if (rw->rw_crashed_at == 0)
1610 0 : continue;
1611 :
1612 0 : if (rw->rw_worker.bgw_restart_time == BGW_NEVER_RESTART
1613 0 : || rw->rw_terminate)
1614 : {
1615 0 : ForgetBackgroundWorker(rw);
1616 0 : continue;
1617 : }
1618 :
1619 0 : this_wakeup = TimestampTzPlusMilliseconds(rw->rw_crashed_at,
1620 : 1000L * rw->rw_worker.bgw_restart_time);
1621 0 : if (next_wakeup == 0 || this_wakeup < next_wakeup)
1622 0 : next_wakeup = this_wakeup;
1623 : }
1624 : }
1625 :
1626 0 : if (next_wakeup != 0)
1627 : {
1628 : int ms;
1629 :
1630 : /* result of TimestampDifferenceMilliseconds is in [0, INT_MAX] */
1631 0 : ms = (int) TimestampDifferenceMilliseconds(GetCurrentTimestamp(),
1632 : next_wakeup);
1633 0 : return Min(60 * 1000, ms);
1634 : }
1635 :
1636 0 : return 60 * 1000;
1637 : }
1638 :
1639 : /*
1640 : * Activate or deactivate notifications of server socket events. Since we
1641 : * don't currently have a way to remove events from an existing WaitEventSet,
1642 : * we'll just destroy and recreate the whole thing. This is called during
1643 : * shutdown so we can wait for backends to exit without accepting new
1644 : * connections, and during crash reinitialization when we need to start
1645 : * listening for new connections again. The WaitEventSet will be freed in fork
1646 : * children by ClosePostmasterPorts().
1647 : */
1648 : static void
1649 1964 : ConfigurePostmasterWaitSet(bool accept_connections)
1650 : {
1651 1964 : if (pm_wait_set)
1652 985 : FreeWaitEventSet(pm_wait_set);
1653 1964 : pm_wait_set = NULL;
1654 :
1655 3928 : pm_wait_set = CreateWaitEventSet(NULL,
1656 1964 : accept_connections ? (1 + NumListenSockets) : 1);
1657 1964 : AddWaitEventToSet(pm_wait_set, WL_LATCH_SET, PGINVALID_SOCKET, MyLatch,
1658 : NULL);
1659 :
1660 1964 : if (accept_connections)
1661 : {
1662 2009 : for (int i = 0; i < NumListenSockets; i++)
1663 1025 : AddWaitEventToSet(pm_wait_set, WL_SOCKET_ACCEPT, ListenSockets[i],
1664 : NULL, NULL);
1665 : }
1666 1964 : }
1667 :
1668 : /*
1669 : * Main idle loop of postmaster
1670 : */
1671 : static int
1672 979 : ServerLoop(void)
1673 : {
1674 : time_t last_lockfile_recheck_time,
1675 : last_touch_time;
1676 : WaitEvent events[MAXLISTEN];
1677 : int nevents;
1678 :
1679 979 : ConfigurePostmasterWaitSet(true);
1680 979 : last_lockfile_recheck_time = last_touch_time = time(NULL);
1681 :
1682 : for (;;)
1683 180247 : {
1684 : time_t now;
1685 :
1686 181226 : nevents = WaitEventSetWait(pm_wait_set,
1687 181226 : DetermineSleepTime(),
1688 : events,
1689 : lengthof(events),
1690 : 0 /* postmaster posts no wait_events */ );
1691 :
1692 : /*
1693 : * Latch set by signal handler, or new connection pending on any of
1694 : * our sockets? If the latter, fork a child process to deal with it.
1695 : */
1696 361486 : for (int i = 0; i < nevents; i++)
1697 : {
1698 181239 : if (events[i].events & WL_LATCH_SET)
1699 166200 : ResetLatch(MyLatch);
1700 :
1701 : /*
1702 : * The following requests are handled unconditionally, even if we
1703 : * didn't see WL_LATCH_SET. This gives high priority to shutdown
1704 : * and reload requests where the latch happens to appear later in
1705 : * events[] or will be reported by a later call to
1706 : * WaitEventSetWait().
1707 : */
1708 181239 : if (pending_pm_shutdown_request)
1709 972 : process_pm_shutdown_request();
1710 181239 : if (pending_pm_reload_request)
1711 163 : process_pm_reload_request();
1712 181239 : if (pending_pm_child_exit)
1713 25601 : process_pm_child_exit();
1714 180260 : if (pending_pm_pmsignal)
1715 139553 : process_pm_pmsignal();
1716 :
1717 180260 : if (events[i].events & WL_SOCKET_ACCEPT)
1718 : {
1719 : ClientSocket s;
1720 :
1721 15039 : if (AcceptConnection(events[i].fd, &s) == STATUS_OK)
1722 15039 : BackendStartup(&s);
1723 :
1724 : /* We no longer need the open socket in this process */
1725 15039 : if (s.sock != PGINVALID_SOCKET)
1726 : {
1727 15039 : if (closesocket(s.sock) != 0)
1728 0 : elog(LOG, "could not close client socket: %m");
1729 : }
1730 : }
1731 : }
1732 :
1733 : /*
1734 : * If we need to launch any background processes after changing state
1735 : * or because some exited, do so now.
1736 : */
1737 180247 : LaunchMissingBackgroundProcesses();
1738 :
1739 : /* If we need to signal the autovacuum launcher, do so now */
1740 180247 : if (avlauncher_needs_signal)
1741 : {
1742 0 : avlauncher_needs_signal = false;
1743 0 : if (AutoVacLauncherPMChild != NULL)
1744 0 : signal_child(AutoVacLauncherPMChild, SIGUSR2);
1745 : }
1746 :
1747 : #ifdef HAVE_PTHREAD_IS_THREADED_NP
1748 :
1749 : /*
1750 : * With assertions enabled, check regularly for appearance of
1751 : * additional threads. All builds check at start and exit.
1752 : */
1753 : Assert(pthread_is_threaded_np() == 0);
1754 : #endif
1755 :
1756 : /*
1757 : * Lastly, check to see if it's time to do some things that we don't
1758 : * want to do every single time through the loop, because they're a
1759 : * bit expensive. Note that there's up to a minute of slop in when
1760 : * these tasks will be performed, since DetermineSleepTime() will let
1761 : * us sleep at most that long; except for SIGKILL timeout which has
1762 : * special-case logic there.
1763 : */
1764 180247 : now = time(NULL);
1765 :
1766 : /*
1767 : * If we already sent SIGQUIT to children and they are slow to shut
1768 : * down, it's time to send them SIGKILL (or SIGABRT if requested).
1769 : * This doesn't happen normally, but under certain conditions backends
1770 : * can get stuck while shutting down. This is a last measure to get
1771 : * them unwedged.
1772 : *
1773 : * Note we also do this during recovery from a process crash.
1774 : */
1775 180247 : if ((Shutdown >= ImmediateShutdown || FatalError) &&
1776 1652 : AbortStartTime != 0 &&
1777 1646 : (now - AbortStartTime) >= SIGKILL_CHILDREN_AFTER_SECS)
1778 : {
1779 : /* We were gentle with them before. Not anymore */
1780 0 : ereport(LOG,
1781 : /* translator: %s is SIGKILL or SIGABRT */
1782 : (errmsg("issuing %s to recalcitrant children",
1783 : send_abort_for_kill ? "SIGABRT" : "SIGKILL")));
1784 0 : TerminateChildren(send_abort_for_kill ? SIGABRT : SIGKILL);
1785 : /* reset flag so we don't SIGKILL again */
1786 0 : AbortStartTime = 0;
1787 : }
1788 :
1789 : /*
1790 : * Once a minute, verify that postmaster.pid hasn't been removed or
1791 : * overwritten. If it has, we force a shutdown. This avoids having
1792 : * postmasters and child processes hanging around after their database
1793 : * is gone, and maybe causing problems if a new database cluster is
1794 : * created in the same place. It also provides some protection
1795 : * against a DBA foolishly removing postmaster.pid and manually
1796 : * starting a new postmaster. Data corruption is likely to ensue from
1797 : * that anyway, but we can minimize the damage by aborting ASAP.
1798 : */
1799 180247 : if (now - last_lockfile_recheck_time >= 1 * SECS_PER_MINUTE)
1800 : {
1801 24 : if (!RecheckDataDirLockFile())
1802 : {
1803 0 : ereport(LOG,
1804 : (errmsg("performing immediate shutdown because data directory lock file is invalid")));
1805 0 : kill(MyProcPid, SIGQUIT);
1806 : }
1807 24 : last_lockfile_recheck_time = now;
1808 : }
1809 :
1810 : /*
1811 : * Touch Unix socket and lock files every 58 minutes, to ensure that
1812 : * they are not removed by overzealous /tmp-cleaning tasks. We assume
1813 : * no one runs cleaners with cutoff times of less than an hour ...
1814 : */
1815 180247 : if (now - last_touch_time >= 58 * SECS_PER_MINUTE)
1816 : {
1817 0 : TouchSocketFiles();
1818 0 : TouchSocketLockFiles();
1819 0 : last_touch_time = now;
1820 : }
1821 : }
1822 : }
1823 :
1824 : /*
1825 : * canAcceptConnections --- check to see if database state allows connections
1826 : * of the specified type. backend_type can be B_BACKEND or B_AUTOVAC_WORKER.
1827 : * (Note that we don't yet know whether a normal B_BACKEND connection might
1828 : * turn into a walsender.)
1829 : */
1830 : static CAC_state
1831 16457 : canAcceptConnections(BackendType backend_type)
1832 : {
1833 16457 : CAC_state result = CAC_OK;
1834 :
1835 : Assert(backend_type == B_BACKEND || backend_type == B_AUTOVAC_WORKER);
1836 :
1837 : /*
1838 : * Can't start backends when in startup/shutdown/inconsistent recovery
1839 : * state. We treat autovac workers the same as user backends for this
1840 : * purpose.
1841 : */
1842 16457 : if (pmState != PM_RUN && pmState != PM_HOT_STANDBY)
1843 : {
1844 225 : if (Shutdown > NoShutdown)
1845 47 : return CAC_SHUTDOWN; /* shutdown is pending */
1846 178 : else if (!FatalError && pmState == PM_STARTUP)
1847 170 : return CAC_STARTUP; /* normal startup */
1848 8 : else if (!FatalError && pmState == PM_RECOVERY)
1849 7 : return CAC_NOTHOTSTANDBY; /* not yet ready for hot standby */
1850 : else
1851 1 : return CAC_RECOVERY; /* else must be crash recovery */
1852 : }
1853 :
1854 : /*
1855 : * "Smart shutdown" restrictions are applied only to normal connections,
1856 : * not to autovac workers.
1857 : */
1858 16232 : if (!connsAllowed && backend_type == B_BACKEND)
1859 0 : return CAC_SHUTDOWN; /* shutdown is pending */
1860 :
1861 16232 : return result;
1862 : }
1863 :
1864 : /*
1865 : * ClosePostmasterPorts -- close all the postmaster's open sockets
1866 : *
1867 : * This is called during child process startup to release file descriptors
1868 : * that are not needed by that child process. The postmaster still has
1869 : * them open, of course.
1870 : *
1871 : * Note: we pass am_syslogger as a boolean because we don't want to set
1872 : * the global variable yet when this is called.
1873 : */
1874 : void
1875 24916 : ClosePostmasterPorts(bool am_syslogger)
1876 : {
1877 : /* Release resources held by the postmaster's WaitEventSet. */
1878 24916 : if (pm_wait_set)
1879 : {
1880 20833 : FreeWaitEventSetAfterFork(pm_wait_set);
1881 20833 : pm_wait_set = NULL;
1882 : }
1883 :
1884 : #ifndef WIN32
1885 :
1886 : /*
1887 : * Close the write end of postmaster death watch pipe. It's important to
1888 : * do this as early as possible, so that if postmaster dies, others won't
1889 : * think that it's still running because we're holding the pipe open.
1890 : */
1891 24916 : if (close(postmaster_alive_fds[POSTMASTER_FD_OWN]) != 0)
1892 0 : ereport(FATAL,
1893 : (errcode_for_file_access(),
1894 : errmsg_internal("could not close postmaster death monitoring pipe in child process: %m")));
1895 24916 : postmaster_alive_fds[POSTMASTER_FD_OWN] = -1;
1896 : /* Notify fd.c that we released one pipe FD. */
1897 24916 : ReleaseExternalFD();
1898 : #endif
1899 :
1900 : /*
1901 : * Close the postmaster's listen sockets. These aren't tracked by fd.c,
1902 : * so we don't call ReleaseExternalFD() here.
1903 : *
1904 : * The listen sockets are marked as FD_CLOEXEC, so this isn't needed in
1905 : * EXEC_BACKEND mode.
1906 : */
1907 : #ifndef EXEC_BACKEND
1908 24916 : if (ListenSockets)
1909 : {
1910 50518 : for (int i = 0; i < NumListenSockets; i++)
1911 : {
1912 25603 : if (closesocket(ListenSockets[i]) != 0)
1913 0 : elog(LOG, "could not close listen socket: %m");
1914 : }
1915 24915 : pfree(ListenSockets);
1916 : }
1917 24916 : NumListenSockets = 0;
1918 24916 : ListenSockets = NULL;
1919 : #endif
1920 :
1921 : /*
1922 : * If using syslogger, close the read side of the pipe. We don't bother
1923 : * tracking this in fd.c, either.
1924 : */
1925 24916 : if (!am_syslogger)
1926 : {
1927 : #ifndef WIN32
1928 24915 : if (syslogPipe[0] >= 0)
1929 17 : close(syslogPipe[0]);
1930 24915 : syslogPipe[0] = -1;
1931 : #else
1932 : if (syslogPipe[0])
1933 : CloseHandle(syslogPipe[0]);
1934 : syslogPipe[0] = 0;
1935 : #endif
1936 : }
1937 :
1938 : #ifdef USE_BONJOUR
1939 : /* If using Bonjour, close the connection to the mDNS daemon */
1940 : if (bonjour_sdref)
1941 : close(DNSServiceRefSockFD(bonjour_sdref));
1942 : #endif
1943 24916 : }
1944 :
1945 :
1946 : /*
1947 : * InitProcessGlobals -- set MyStartTime[stamp], random seeds
1948 : *
1949 : * Called early in the postmaster and every backend.
1950 : */
1951 : void
1952 26191 : InitProcessGlobals(void)
1953 : {
1954 26191 : MyStartTimestamp = GetCurrentTimestamp();
1955 26191 : MyStartTime = timestamptz_to_time_t(MyStartTimestamp);
1956 :
1957 : /*
1958 : * Set a different global seed in every process. We want something
1959 : * unpredictable, so if possible, use high-quality random bits for the
1960 : * seed. Otherwise, fall back to a seed based on timestamp and PID.
1961 : */
1962 26191 : if (unlikely(!pg_prng_strong_seed(&pg_global_prng_state)))
1963 : {
1964 : uint64 rseed;
1965 :
1966 : /*
1967 : * Since PIDs and timestamps tend to change more frequently in their
1968 : * least significant bits, shift the timestamp left to allow a larger
1969 : * total number of seeds in a given time period. Since that would
1970 : * leave only 20 bits of the timestamp that cycle every ~1 second,
1971 : * also mix in some higher bits.
1972 : */
1973 0 : rseed = ((uint64) MyProcPid) ^
1974 0 : ((uint64) MyStartTimestamp << 12) ^
1975 0 : ((uint64) MyStartTimestamp >> 20);
1976 :
1977 0 : pg_prng_seed(&pg_global_prng_state, rseed);
1978 : }
1979 :
1980 : /*
1981 : * Also make sure that we've set a good seed for random(3). Use of that
1982 : * is deprecated in core Postgres, but extensions might use it.
1983 : */
1984 : #ifndef WIN32
1985 26191 : srandom(pg_prng_uint32(&pg_global_prng_state));
1986 : #endif
1987 26191 : }
1988 :
1989 : /*
1990 : * Child processes use SIGUSR1 to notify us of 'pmsignals'. pg_ctl uses
1991 : * SIGUSR1 to ask postmaster to check for logrotate and promote files.
1992 : */
1993 : static void
1994 139848 : handle_pm_pmsignal_signal(SIGNAL_ARGS)
1995 : {
1996 139848 : pending_pm_pmsignal = true;
1997 139848 : SetLatch(MyLatch);
1998 139848 : }
1999 :
2000 : /*
2001 : * pg_ctl uses SIGHUP to request a reload of the configuration files.
2002 : */
2003 : static void
2004 163 : handle_pm_reload_request_signal(SIGNAL_ARGS)
2005 : {
2006 163 : pending_pm_reload_request = true;
2007 163 : SetLatch(MyLatch);
2008 163 : }
2009 :
2010 : /*
2011 : * Re-read config files, and tell children to do same.
2012 : */
2013 : static void
2014 163 : process_pm_reload_request(void)
2015 : {
2016 163 : pending_pm_reload_request = false;
2017 :
2018 163 : ereport(DEBUG2,
2019 : (errmsg_internal("postmaster received reload request signal")));
2020 :
2021 163 : if (Shutdown <= SmartShutdown)
2022 : {
2023 163 : ereport(LOG,
2024 : (errmsg("received SIGHUP, reloading configuration files")));
2025 163 : ProcessConfigFile(PGC_SIGHUP);
2026 163 : SignalChildren(SIGHUP, btmask_all_except(B_DEAD_END_BACKEND));
2027 :
2028 : /* Reload authentication config files too */
2029 163 : if (!load_hba())
2030 0 : ereport(LOG,
2031 : /* translator: %s is a configuration file */
2032 : (errmsg("%s was not reloaded", HbaFileName)));
2033 :
2034 163 : if (!load_ident())
2035 0 : ereport(LOG,
2036 : (errmsg("%s was not reloaded", IdentFileName)));
2037 :
2038 : #ifdef USE_SSL
2039 : /* Reload SSL configuration as well */
2040 163 : if (EnableSSL)
2041 : {
2042 14 : if (secure_initialize(false) == 0)
2043 12 : LoadedSSL = true;
2044 : else
2045 2 : ereport(LOG,
2046 : (errmsg("SSL configuration was not reloaded")));
2047 : }
2048 : else
2049 : {
2050 149 : secure_destroy();
2051 149 : LoadedSSL = false;
2052 : }
2053 : #endif
2054 :
2055 : #ifdef EXEC_BACKEND
2056 : /* Update the starting-point file for future children */
2057 : write_nondefault_variables(PGC_SIGHUP);
2058 : #endif
2059 : }
2060 163 : }
2061 :
2062 : /*
2063 : * pg_ctl uses SIGTERM, SIGINT and SIGQUIT to request different types of
2064 : * shutdown.
2065 : */
2066 : static void
2067 972 : handle_pm_shutdown_request_signal(SIGNAL_ARGS)
2068 : {
2069 972 : switch (postgres_signal_arg)
2070 : {
2071 48 : case SIGTERM:
2072 : /* smart is implied if the other two flags aren't set */
2073 48 : pending_pm_shutdown_request = true;
2074 48 : break;
2075 578 : case SIGINT:
2076 578 : pending_pm_fast_shutdown_request = true;
2077 578 : pending_pm_shutdown_request = true;
2078 578 : break;
2079 346 : case SIGQUIT:
2080 346 : pending_pm_immediate_shutdown_request = true;
2081 346 : pending_pm_shutdown_request = true;
2082 346 : break;
2083 : }
2084 972 : SetLatch(MyLatch);
2085 972 : }
2086 :
2087 : /*
2088 : * Process shutdown request.
2089 : */
2090 : static void
2091 972 : process_pm_shutdown_request(void)
2092 : {
2093 : int mode;
2094 :
2095 972 : ereport(DEBUG2,
2096 : (errmsg_internal("postmaster received shutdown request signal")));
2097 :
2098 972 : pending_pm_shutdown_request = false;
2099 :
2100 : /*
2101 : * If more than one shutdown request signal arrived since the last server
2102 : * loop, take the one that is the most immediate. That matches the
2103 : * priority that would apply if we processed them one by one in any order.
2104 : */
2105 972 : if (pending_pm_immediate_shutdown_request)
2106 : {
2107 346 : pending_pm_immediate_shutdown_request = false;
2108 346 : pending_pm_fast_shutdown_request = false;
2109 346 : mode = ImmediateShutdown;
2110 : }
2111 626 : else if (pending_pm_fast_shutdown_request)
2112 : {
2113 578 : pending_pm_fast_shutdown_request = false;
2114 578 : mode = FastShutdown;
2115 : }
2116 : else
2117 48 : mode = SmartShutdown;
2118 :
2119 972 : switch (mode)
2120 : {
2121 48 : case SmartShutdown:
2122 :
2123 : /*
2124 : * Smart Shutdown:
2125 : *
2126 : * Wait for children to end their work, then shut down.
2127 : */
2128 48 : if (Shutdown >= SmartShutdown)
2129 0 : break;
2130 48 : Shutdown = SmartShutdown;
2131 48 : ereport(LOG,
2132 : (errmsg("received smart shutdown request")));
2133 :
2134 : /* Report status */
2135 48 : AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_STOPPING);
2136 : #ifdef USE_SYSTEMD
2137 : sd_notify(0, "STOPPING=1");
2138 : #endif
2139 :
2140 : /*
2141 : * If we reached normal running, we go straight to waiting for
2142 : * client backends to exit. If already in PM_STOP_BACKENDS or a
2143 : * later state, do not change it.
2144 : */
2145 48 : if (pmState == PM_RUN || pmState == PM_HOT_STANDBY)
2146 48 : connsAllowed = false;
2147 0 : else if (pmState == PM_STARTUP || pmState == PM_RECOVERY)
2148 : {
2149 : /* There should be no clients, so proceed to stop children */
2150 0 : UpdatePMState(PM_STOP_BACKENDS);
2151 : }
2152 :
2153 : /*
2154 : * Now wait for online backup mode to end and backends to exit. If
2155 : * that is already the case, PostmasterStateMachine will take the
2156 : * next step.
2157 : */
2158 48 : PostmasterStateMachine();
2159 48 : break;
2160 :
2161 578 : case FastShutdown:
2162 :
2163 : /*
2164 : * Fast Shutdown:
2165 : *
2166 : * Abort all children with SIGTERM (rollback active transactions
2167 : * and exit) and shut down when they are gone.
2168 : */
2169 578 : if (Shutdown >= FastShutdown)
2170 0 : break;
2171 578 : Shutdown = FastShutdown;
2172 578 : ereport(LOG,
2173 : (errmsg("received fast shutdown request")));
2174 :
2175 : /* Report status */
2176 578 : AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_STOPPING);
2177 : #ifdef USE_SYSTEMD
2178 : sd_notify(0, "STOPPING=1");
2179 : #endif
2180 :
2181 578 : if (pmState == PM_STARTUP || pmState == PM_RECOVERY)
2182 : {
2183 : /* Just shut down background processes silently */
2184 0 : UpdatePMState(PM_STOP_BACKENDS);
2185 : }
2186 578 : else if (pmState == PM_RUN ||
2187 60 : pmState == PM_HOT_STANDBY)
2188 : {
2189 : /* Report that we're about to zap live client sessions */
2190 578 : ereport(LOG,
2191 : (errmsg("aborting any active transactions")));
2192 578 : UpdatePMState(PM_STOP_BACKENDS);
2193 : }
2194 :
2195 : /*
2196 : * PostmasterStateMachine will issue any necessary signals, or
2197 : * take the next step if no child processes need to be killed.
2198 : */
2199 578 : PostmasterStateMachine();
2200 578 : break;
2201 :
2202 346 : case ImmediateShutdown:
2203 :
2204 : /*
2205 : * Immediate Shutdown:
2206 : *
2207 : * abort all children with SIGQUIT, wait for them to exit,
2208 : * terminate remaining ones with SIGKILL, then exit without
2209 : * attempt to properly shut down the data base system.
2210 : */
2211 346 : if (Shutdown >= ImmediateShutdown)
2212 0 : break;
2213 346 : Shutdown = ImmediateShutdown;
2214 346 : ereport(LOG,
2215 : (errmsg("received immediate shutdown request")));
2216 :
2217 : /* Report status */
2218 346 : AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_STOPPING);
2219 : #ifdef USE_SYSTEMD
2220 : sd_notify(0, "STOPPING=1");
2221 : #endif
2222 :
2223 : /* tell children to shut down ASAP */
2224 : /* (note we don't apply send_abort_for_crash here) */
2225 346 : SetQuitSignalReason(PMQUIT_FOR_STOP);
2226 346 : TerminateChildren(SIGQUIT);
2227 346 : UpdatePMState(PM_WAIT_BACKENDS);
2228 :
2229 : /* set stopwatch for them to die */
2230 346 : AbortStartTime = time(NULL);
2231 :
2232 : /*
2233 : * Now wait for backends to exit. If there are none,
2234 : * PostmasterStateMachine will take the next step.
2235 : */
2236 346 : PostmasterStateMachine();
2237 346 : break;
2238 : }
2239 972 : }
2240 :
2241 : static void
2242 25691 : handle_pm_child_exit_signal(SIGNAL_ARGS)
2243 : {
2244 25691 : pending_pm_child_exit = true;
2245 25691 : SetLatch(MyLatch);
2246 25691 : }
2247 :
2248 : /*
2249 : * Cleanup after a child process dies.
2250 : */
2251 : static void
2252 25601 : process_pm_child_exit(void)
2253 : {
2254 : int pid; /* process id of dead child process */
2255 : int exitstatus; /* its exit status */
2256 :
2257 25601 : pending_pm_child_exit = false;
2258 :
2259 25601 : ereport(DEBUG4,
2260 : (errmsg_internal("reaping dead processes")));
2261 :
2262 53437 : while ((pid = waitpid(-1, &exitstatus, WNOHANG)) > 0)
2263 : {
2264 : PMChild *pmchild;
2265 :
2266 : /*
2267 : * Check if this child was a startup process.
2268 : */
2269 27840 : if (StartupPMChild && pid == StartupPMChild->pid)
2270 : {
2271 984 : ReleasePostmasterChildSlot(StartupPMChild);
2272 984 : StartupPMChild = NULL;
2273 :
2274 : /*
2275 : * Startup process exited in response to a shutdown request (or it
2276 : * completed normally regardless of the shutdown request).
2277 : */
2278 984 : if (Shutdown > NoShutdown &&
2279 106 : (EXIT_STATUS_0(exitstatus) || EXIT_STATUS_1(exitstatus)))
2280 : {
2281 60 : StartupStatus = STARTUP_NOT_RUNNING;
2282 60 : UpdatePMState(PM_WAIT_BACKENDS);
2283 : /* PostmasterStateMachine logic does the rest */
2284 60 : continue;
2285 : }
2286 :
2287 924 : if (EXIT_STATUS_3(exitstatus))
2288 : {
2289 0 : ereport(LOG,
2290 : (errmsg("shutdown at recovery target")));
2291 0 : StartupStatus = STARTUP_NOT_RUNNING;
2292 0 : Shutdown = Max(Shutdown, SmartShutdown);
2293 0 : TerminateChildren(SIGTERM);
2294 0 : UpdatePMState(PM_WAIT_BACKENDS);
2295 : /* PostmasterStateMachine logic does the rest */
2296 0 : continue;
2297 : }
2298 :
2299 : /*
2300 : * Unexpected exit of startup process (including FATAL exit)
2301 : * during PM_STARTUP is treated as catastrophic. There are no
2302 : * other processes running yet, so we can just exit.
2303 : */
2304 924 : if (pmState == PM_STARTUP &&
2305 722 : StartupStatus != STARTUP_SIGNALED &&
2306 722 : !EXIT_STATUS_0(exitstatus))
2307 : {
2308 4 : LogChildExit(LOG, _("startup process"),
2309 : pid, exitstatus);
2310 4 : ereport(LOG,
2311 : (errmsg("aborting startup due to startup process failure")));
2312 4 : ExitPostmaster(1);
2313 : }
2314 :
2315 : /*
2316 : * After PM_STARTUP, any unexpected exit (including FATAL exit) of
2317 : * the startup process is catastrophic, so kill other children,
2318 : * and set StartupStatus so we don't try to reinitialize after
2319 : * they're gone. Exception: if StartupStatus is STARTUP_SIGNALED,
2320 : * then we previously sent the startup process a SIGQUIT; so
2321 : * that's probably the reason it died, and we do want to try to
2322 : * restart in that case.
2323 : *
2324 : * This stanza also handles the case where we sent a SIGQUIT
2325 : * during PM_STARTUP due to some dead-end child crashing: in that
2326 : * situation, if the startup process dies on the SIGQUIT, we need
2327 : * to transition to PM_WAIT_BACKENDS state which will allow
2328 : * PostmasterStateMachine to restart the startup process. (On the
2329 : * other hand, the startup process might complete normally, if we
2330 : * were too late with the SIGQUIT. In that case we'll fall
2331 : * through and commence normal operations.)
2332 : */
2333 920 : if (!EXIT_STATUS_0(exitstatus))
2334 : {
2335 49 : if (StartupStatus == STARTUP_SIGNALED)
2336 : {
2337 46 : StartupStatus = STARTUP_NOT_RUNNING;
2338 46 : if (pmState == PM_STARTUP)
2339 0 : UpdatePMState(PM_WAIT_BACKENDS);
2340 : }
2341 : else
2342 3 : StartupStatus = STARTUP_CRASHED;
2343 49 : HandleChildCrash(pid, exitstatus,
2344 49 : _("startup process"));
2345 49 : continue;
2346 : }
2347 :
2348 : /*
2349 : * Startup succeeded, commence normal operations
2350 : */
2351 871 : StartupStatus = STARTUP_NOT_RUNNING;
2352 871 : FatalError = false;
2353 871 : AbortStartTime = 0;
2354 871 : ReachedNormalRunning = true;
2355 871 : UpdatePMState(PM_RUN);
2356 871 : connsAllowed = true;
2357 :
2358 : /*
2359 : * At the next iteration of the postmaster's main loop, we will
2360 : * crank up the background tasks like the autovacuum launcher and
2361 : * background workers that were not started earlier already.
2362 : */
2363 871 : StartWorkerNeeded = true;
2364 :
2365 : /* at this point we are really open for business */
2366 871 : ereport(LOG,
2367 : (errmsg("database system is ready to accept connections")));
2368 :
2369 : /* Report status */
2370 871 : AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_READY);
2371 : #ifdef USE_SYSTEMD
2372 : sd_notify(0, "READY=1");
2373 : #endif
2374 :
2375 871 : continue;
2376 : }
2377 :
2378 : /*
2379 : * Was it the bgwriter? Normal exit can be ignored; we'll start a new
2380 : * one at the next iteration of the postmaster's main loop, if
2381 : * necessary. Any other exit condition is treated as a crash.
2382 : */
2383 26856 : if (BgWriterPMChild && pid == BgWriterPMChild->pid)
2384 : {
2385 980 : ReleasePostmasterChildSlot(BgWriterPMChild);
2386 980 : BgWriterPMChild = NULL;
2387 980 : if (!EXIT_STATUS_0(exitstatus))
2388 354 : HandleChildCrash(pid, exitstatus,
2389 354 : _("background writer process"));
2390 980 : continue;
2391 : }
2392 :
2393 : /*
2394 : * Was it the checkpointer?
2395 : */
2396 25876 : if (CheckpointerPMChild && pid == CheckpointerPMChild->pid)
2397 : {
2398 980 : ReleasePostmasterChildSlot(CheckpointerPMChild);
2399 980 : CheckpointerPMChild = NULL;
2400 980 : if (EXIT_STATUS_0(exitstatus) && pmState == PM_WAIT_CHECKPOINTER)
2401 626 : {
2402 : /*
2403 : * OK, we saw normal exit of the checkpointer after it's been
2404 : * told to shut down. We know checkpointer wrote a shutdown
2405 : * checkpoint, otherwise we'd still be in
2406 : * PM_WAIT_XLOG_SHUTDOWN state.
2407 : *
2408 : * At this point only dead-end children and logger should be
2409 : * left.
2410 : */
2411 626 : UpdatePMState(PM_WAIT_DEAD_END);
2412 626 : ConfigurePostmasterWaitSet(false);
2413 626 : SignalChildren(SIGTERM, btmask_all_except(B_LOGGER));
2414 : }
2415 : else
2416 : {
2417 : /*
2418 : * Any unexpected exit of the checkpointer (including FATAL
2419 : * exit) is treated as a crash.
2420 : */
2421 354 : HandleChildCrash(pid, exitstatus,
2422 354 : _("checkpointer process"));
2423 : }
2424 :
2425 980 : continue;
2426 : }
2427 :
2428 : /*
2429 : * Was it the wal writer? Normal exit can be ignored; we'll start a
2430 : * new one at the next iteration of the postmaster's main loop, if
2431 : * necessary. Any other exit condition is treated as a crash.
2432 : */
2433 24896 : if (WalWriterPMChild && pid == WalWriterPMChild->pid)
2434 : {
2435 871 : ReleasePostmasterChildSlot(WalWriterPMChild);
2436 871 : WalWriterPMChild = NULL;
2437 871 : if (!EXIT_STATUS_0(exitstatus))
2438 305 : HandleChildCrash(pid, exitstatus,
2439 305 : _("WAL writer process"));
2440 871 : continue;
2441 : }
2442 :
2443 : /*
2444 : * Was it the wal receiver? If exit status is zero (normal) or one
2445 : * (FATAL exit), we assume everything is all right just like normal
2446 : * backends. (If we need a new wal receiver, we'll start one at the
2447 : * next iteration of the postmaster's main loop.)
2448 : */
2449 24025 : if (WalReceiverPMChild && pid == WalReceiverPMChild->pid)
2450 : {
2451 274 : ReleasePostmasterChildSlot(WalReceiverPMChild);
2452 274 : WalReceiverPMChild = NULL;
2453 274 : if (!EXIT_STATUS_0(exitstatus) && !EXIT_STATUS_1(exitstatus))
2454 20 : HandleChildCrash(pid, exitstatus,
2455 20 : _("WAL receiver process"));
2456 274 : continue;
2457 : }
2458 :
2459 : /*
2460 : * Was it the wal summarizer? Normal exit can be ignored; we'll start
2461 : * a new one at the next iteration of the postmaster's main loop, if
2462 : * necessary. Any other exit condition is treated as a crash.
2463 : */
2464 23751 : if (WalSummarizerPMChild && pid == WalSummarizerPMChild->pid)
2465 : {
2466 21 : ReleasePostmasterChildSlot(WalSummarizerPMChild);
2467 21 : WalSummarizerPMChild = NULL;
2468 21 : if (!EXIT_STATUS_0(exitstatus))
2469 18 : HandleChildCrash(pid, exitstatus,
2470 18 : _("WAL summarizer process"));
2471 21 : continue;
2472 : }
2473 :
2474 : /*
2475 : * Was it the autovacuum launcher? Normal exit can be ignored; we'll
2476 : * start a new one at the next iteration of the postmaster's main
2477 : * loop, if necessary. Any other exit condition is treated as a
2478 : * crash.
2479 : */
2480 23730 : if (AutoVacLauncherPMChild && pid == AutoVacLauncherPMChild->pid)
2481 : {
2482 733 : ReleasePostmasterChildSlot(AutoVacLauncherPMChild);
2483 733 : AutoVacLauncherPMChild = NULL;
2484 733 : if (!EXIT_STATUS_0(exitstatus))
2485 258 : HandleChildCrash(pid, exitstatus,
2486 258 : _("autovacuum launcher process"));
2487 733 : continue;
2488 : }
2489 :
2490 : /*
2491 : * Was it the archiver? If exit status is zero (normal) or one (FATAL
2492 : * exit), we assume everything is all right just like normal backends
2493 : * and just try to start a new one on the next cycle of the
2494 : * postmaster's main loop, to retry archiving remaining files.
2495 : */
2496 22997 : if (PgArchPMChild && pid == PgArchPMChild->pid)
2497 : {
2498 57 : ReleasePostmasterChildSlot(PgArchPMChild);
2499 57 : PgArchPMChild = NULL;
2500 57 : if (!EXIT_STATUS_0(exitstatus) && !EXIT_STATUS_1(exitstatus))
2501 40 : HandleChildCrash(pid, exitstatus,
2502 40 : _("archiver process"));
2503 57 : continue;
2504 : }
2505 :
2506 : /* Was it the system logger? If so, try to start a new one */
2507 22940 : if (SysLoggerPMChild && pid == SysLoggerPMChild->pid)
2508 : {
2509 0 : ReleasePostmasterChildSlot(SysLoggerPMChild);
2510 0 : SysLoggerPMChild = NULL;
2511 :
2512 : /* for safety's sake, launch new logger *first* */
2513 0 : if (Logging_collector)
2514 0 : StartSysLogger();
2515 :
2516 0 : if (!EXIT_STATUS_0(exitstatus))
2517 0 : LogChildExit(LOG, _("system logger process"),
2518 : pid, exitstatus);
2519 0 : continue;
2520 : }
2521 :
2522 : /*
2523 : * Was it the slot sync worker? Normal exit or FATAL exit can be
2524 : * ignored (FATAL can be caused by libpqwalreceiver on receiving
2525 : * shutdown request by the startup process during promotion); we'll
2526 : * start a new one at the next iteration of the postmaster's main
2527 : * loop, if necessary. Any other exit condition is treated as a crash.
2528 : */
2529 22940 : if (SlotSyncWorkerPMChild && pid == SlotSyncWorkerPMChild->pid)
2530 : {
2531 6 : ReleasePostmasterChildSlot(SlotSyncWorkerPMChild);
2532 6 : SlotSyncWorkerPMChild = NULL;
2533 6 : if (!EXIT_STATUS_0(exitstatus) && !EXIT_STATUS_1(exitstatus))
2534 0 : HandleChildCrash(pid, exitstatus,
2535 0 : _("slot sync worker process"));
2536 6 : continue;
2537 : }
2538 :
2539 : /* Was it an IO worker? */
2540 22934 : if (maybe_reap_io_worker(pid))
2541 : {
2542 2967 : if (!EXIT_STATUS_0(exitstatus) && !EXIT_STATUS_1(exitstatus))
2543 1062 : HandleChildCrash(pid, exitstatus, _("io worker"));
2544 :
2545 2967 : maybe_adjust_io_workers();
2546 2967 : continue;
2547 : }
2548 :
2549 : /*
2550 : * Was it a backend or a background worker?
2551 : */
2552 19967 : pmchild = FindPostmasterChildByPid(pid);
2553 19967 : if (pmchild)
2554 : {
2555 19967 : CleanupBackend(pmchild, exitstatus);
2556 : }
2557 :
2558 : /*
2559 : * We don't know anything about this child process. That's highly
2560 : * unexpected, as we do track all the child processes that we fork.
2561 : */
2562 : else
2563 : {
2564 0 : if (!EXIT_STATUS_0(exitstatus) && !EXIT_STATUS_1(exitstatus))
2565 0 : HandleChildCrash(pid, exitstatus, _("untracked child process"));
2566 : else
2567 0 : LogChildExit(LOG, _("untracked child process"), pid, exitstatus);
2568 : }
2569 : } /* loop over pending child-death reports */
2570 :
2571 : /*
2572 : * After cleaning out the SIGCHLD queue, see if we have any state changes
2573 : * or actions to make.
2574 : */
2575 25597 : PostmasterStateMachine();
2576 24622 : }
2577 :
2578 : /*
2579 : * CleanupBackend -- cleanup after terminated backend or background worker.
2580 : *
2581 : * Remove all local state associated with the child process and release its
2582 : * PMChild slot.
2583 : */
2584 : static void
2585 19967 : CleanupBackend(PMChild *bp,
2586 : int exitstatus) /* child's exit status. */
2587 : {
2588 : char namebuf[MAXPGPATH];
2589 : const char *procname;
2590 19967 : bool crashed = false;
2591 19967 : bool logged = false;
2592 : pid_t bp_pid;
2593 : bool bp_bgworker_notify;
2594 : BackendType bp_bkend_type;
2595 : RegisteredBgWorker *rw;
2596 :
2597 : /* Construct a process name for the log message */
2598 19967 : if (bp->bkend_type == B_BG_WORKER)
2599 : {
2600 3510 : snprintf(namebuf, MAXPGPATH, _("background worker \"%s\""),
2601 3510 : bp->rw->rw_worker.bgw_type);
2602 3510 : procname = namebuf;
2603 : }
2604 : else
2605 16457 : procname = _(GetBackendTypeDesc(bp->bkend_type));
2606 :
2607 : /*
2608 : * If a backend dies in an ugly way then we must signal all other backends
2609 : * to quickdie. If exit status is zero (normal) or one (FATAL exit), we
2610 : * assume everything is all right and proceed to remove the backend from
2611 : * the active child list.
2612 : */
2613 19967 : if (!EXIT_STATUS_0(exitstatus) && !EXIT_STATUS_1(exitstatus))
2614 614 : crashed = true;
2615 :
2616 : #ifdef WIN32
2617 :
2618 : /*
2619 : * On win32, also treat ERROR_WAIT_NO_CHILDREN (128) as nonfatal case,
2620 : * since that sometimes happens under load when the process fails to start
2621 : * properly (long before it starts using shared memory). Microsoft reports
2622 : * it is related to mutex failure:
2623 : * http://archives.postgresql.org/pgsql-hackers/2010-09/msg00790.php
2624 : */
2625 : if (exitstatus == ERROR_WAIT_NO_CHILDREN)
2626 : {
2627 : LogChildExit(LOG, procname, bp->pid, exitstatus);
2628 : logged = true;
2629 : crashed = false;
2630 : }
2631 : #endif
2632 :
2633 : /*
2634 : * Release the PMChild entry.
2635 : *
2636 : * If the process attached to shared memory, this also checks that it
2637 : * detached cleanly.
2638 : */
2639 19967 : bp_pid = bp->pid;
2640 19967 : bp_bgworker_notify = bp->bgworker_notify;
2641 19967 : bp_bkend_type = bp->bkend_type;
2642 19967 : rw = bp->rw;
2643 19967 : if (!ReleasePostmasterChildSlot(bp))
2644 : {
2645 : /*
2646 : * Uh-oh, the child failed to clean itself up. Treat as a crash after
2647 : * all.
2648 : */
2649 384 : crashed = true;
2650 : }
2651 19967 : bp = NULL;
2652 :
2653 : /*
2654 : * In a crash case, exit immediately without resetting background worker
2655 : * state. However, if restart_after_crash is enabled, the background
2656 : * worker state (e.g., rw_pid) still needs be reset so the worker can
2657 : * restart after crash recovery. This reset is handled in
2658 : * ResetBackgroundWorkerCrashTimes(), not here.
2659 : */
2660 19967 : if (crashed)
2661 : {
2662 614 : HandleChildCrash(bp_pid, exitstatus, procname);
2663 614 : return;
2664 : }
2665 :
2666 : /*
2667 : * This backend may have been slated to receive SIGUSR1 when some
2668 : * background worker started or stopped. Cancel those notifications, as
2669 : * we don't want to signal PIDs that are not PostgreSQL backends. This
2670 : * gets skipped in the (probably very common) case where the backend has
2671 : * never requested any such notifications.
2672 : */
2673 19353 : if (bp_bgworker_notify)
2674 344 : BackgroundWorkerStopNotifications(bp_pid);
2675 :
2676 : /*
2677 : * If it was an autovacuum worker, wake up the launcher so that it can
2678 : * immediately launch a new worker or rebalance to cost limit setting of
2679 : * the remaining workers.
2680 : */
2681 19353 : if (bp_bkend_type == B_AUTOVAC_WORKER && AutoVacLauncherPMChild != NULL)
2682 1414 : signal_child(AutoVacLauncherPMChild, SIGUSR2);
2683 :
2684 : /*
2685 : * If it was a background worker, also update its RegisteredBgWorker
2686 : * entry.
2687 : */
2688 19353 : if (bp_bkend_type == B_BG_WORKER)
2689 : {
2690 3187 : if (!EXIT_STATUS_0(exitstatus))
2691 : {
2692 : /* Record timestamp, so we know when to restart the worker. */
2693 816 : rw->rw_crashed_at = GetCurrentTimestamp();
2694 : }
2695 : else
2696 : {
2697 : /* Zero exit status means terminate */
2698 2371 : rw->rw_crashed_at = 0;
2699 2371 : rw->rw_terminate = true;
2700 : }
2701 :
2702 3187 : rw->rw_pid = 0;
2703 3187 : ReportBackgroundWorkerExit(rw); /* report child death */
2704 :
2705 3187 : if (!logged)
2706 : {
2707 3187 : LogChildExit(EXIT_STATUS_0(exitstatus) ? DEBUG1 : LOG,
2708 : procname, bp_pid, exitstatus);
2709 3187 : logged = true;
2710 : }
2711 :
2712 : /* have it be restarted */
2713 3187 : HaveCrashedWorker = true;
2714 : }
2715 :
2716 19353 : if (!logged)
2717 16166 : LogChildExit(DEBUG2, procname, bp_pid, exitstatus);
2718 : }
2719 :
2720 : /*
2721 : * Transition into FatalError state, in response to something bad having
2722 : * happened. Commonly the caller will have logged the reason for entering
2723 : * FatalError state.
2724 : *
2725 : * This should only be called when not already in FatalError or
2726 : * ImmediateShutdown state.
2727 : */
2728 : static void
2729 8 : HandleFatalError(QuitSignalReason reason, bool consider_sigabrt)
2730 : {
2731 : int sigtosend;
2732 :
2733 : Assert(!FatalError);
2734 : Assert(Shutdown != ImmediateShutdown);
2735 :
2736 8 : SetQuitSignalReason(reason);
2737 :
2738 8 : if (consider_sigabrt && send_abort_for_crash)
2739 0 : sigtosend = SIGABRT;
2740 : else
2741 8 : sigtosend = SIGQUIT;
2742 :
2743 : /*
2744 : * Signal all other child processes to exit.
2745 : *
2746 : * We could exclude dead-end children here, but at least when sending
2747 : * SIGABRT it seems better to include them.
2748 : */
2749 8 : TerminateChildren(sigtosend);
2750 :
2751 8 : FatalError = true;
2752 :
2753 : /*
2754 : * Choose the appropriate new state to react to the fatal error. Unless we
2755 : * were already in the process of shutting down, we go through
2756 : * PM_WAIT_BACKENDS. For errors during the shutdown sequence, we directly
2757 : * switch to PM_WAIT_DEAD_END.
2758 : */
2759 8 : switch (pmState)
2760 : {
2761 0 : case PM_INIT:
2762 : /* shouldn't have any children */
2763 : Assert(false);
2764 0 : break;
2765 0 : case PM_STARTUP:
2766 : /* should have been handled in process_pm_child_exit */
2767 : Assert(false);
2768 0 : break;
2769 :
2770 : /* wait for children to die */
2771 8 : case PM_RECOVERY:
2772 : case PM_HOT_STANDBY:
2773 : case PM_RUN:
2774 : case PM_STOP_BACKENDS:
2775 8 : UpdatePMState(PM_WAIT_BACKENDS);
2776 8 : break;
2777 :
2778 0 : case PM_WAIT_BACKENDS:
2779 : /* there might be more backends to wait for */
2780 0 : break;
2781 :
2782 0 : case PM_WAIT_XLOG_SHUTDOWN:
2783 : case PM_WAIT_XLOG_ARCHIVAL:
2784 : case PM_WAIT_CHECKPOINTER:
2785 : case PM_WAIT_IO_WORKERS:
2786 :
2787 : /*
2788 : * NB: Similar code exists in PostmasterStateMachine()'s handling
2789 : * of FatalError in PM_STOP_BACKENDS/PM_WAIT_BACKENDS states.
2790 : */
2791 0 : ConfigurePostmasterWaitSet(false);
2792 0 : UpdatePMState(PM_WAIT_DEAD_END);
2793 0 : break;
2794 :
2795 0 : case PM_WAIT_DEAD_END:
2796 : case PM_NO_CHILDREN:
2797 0 : break;
2798 : }
2799 :
2800 : /*
2801 : * .. and if this doesn't happen quickly enough, now the clock is ticking
2802 : * for us to kill them without mercy.
2803 : */
2804 8 : if (AbortStartTime == 0)
2805 8 : AbortStartTime = time(NULL);
2806 8 : }
2807 :
2808 : /*
2809 : * HandleChildCrash -- cleanup after failed backend, bgwriter, checkpointer,
2810 : * walwriter, autovacuum, archiver, slot sync worker, or background worker.
2811 : *
2812 : * The objectives here are to clean up our local state about the child
2813 : * process, and to signal all other remaining children to quickdie.
2814 : *
2815 : * The caller has already released its PMChild slot.
2816 : */
2817 : static void
2818 3074 : HandleChildCrash(int pid, int exitstatus, const char *procname)
2819 : {
2820 : /*
2821 : * We only log messages and send signals if this is the first process
2822 : * crash and we're not doing an immediate shutdown; otherwise, we're only
2823 : * here to update postmaster's idea of live processes. If we have already
2824 : * signaled children, nonzero exit status is to be expected, so don't
2825 : * clutter log.
2826 : */
2827 3074 : if (FatalError || Shutdown == ImmediateShutdown)
2828 3066 : return;
2829 :
2830 8 : LogChildExit(LOG, procname, pid, exitstatus);
2831 8 : ereport(LOG,
2832 : (errmsg("terminating any other active server processes")));
2833 :
2834 : /*
2835 : * Switch into error state. The crashed process has already been removed
2836 : * from ActiveChildList.
2837 : */
2838 8 : HandleFatalError(PMQUIT_FOR_CRASH, true);
2839 : }
2840 :
2841 : /*
2842 : * Log the death of a child process.
2843 : */
2844 : static void
2845 19365 : LogChildExit(int lev, const char *procname, int pid, int exitstatus)
2846 : {
2847 : /*
2848 : * size of activity_buffer is arbitrary, but set equal to default
2849 : * track_activity_query_size
2850 : */
2851 : char activity_buffer[1024];
2852 19365 : const char *activity = NULL;
2853 :
2854 19365 : if (!EXIT_STATUS_0(exitstatus))
2855 1193 : activity = pgstat_get_crashed_backend_activity(pid,
2856 : activity_buffer,
2857 : sizeof(activity_buffer));
2858 :
2859 19365 : if (WIFEXITED(exitstatus))
2860 19361 : ereport(lev,
2861 :
2862 : /*------
2863 : translator: %s is a noun phrase describing a child process, such as
2864 : "server process" */
2865 : (errmsg("%s (PID %d) exited with exit code %d",
2866 : procname, pid, WEXITSTATUS(exitstatus)),
2867 : activity ? errdetail("Failed process was running: %s", activity) : 0));
2868 4 : else if (WIFSIGNALED(exitstatus))
2869 : {
2870 : #if defined(WIN32)
2871 : ereport(lev,
2872 :
2873 : /*------
2874 : translator: %s is a noun phrase describing a child process, such as
2875 : "server process" */
2876 : (errmsg("%s (PID %d) was terminated by exception 0x%X",
2877 : procname, pid, WTERMSIG(exitstatus)),
2878 : errhint("See C include file \"ntstatus.h\" for a description of the hexadecimal value."),
2879 : activity ? errdetail("Failed process was running: %s", activity) : 0));
2880 : #else
2881 4 : ereport(lev,
2882 :
2883 : /*------
2884 : translator: %s is a noun phrase describing a child process, such as
2885 : "server process" */
2886 : (errmsg("%s (PID %d) was terminated by signal %d: %s",
2887 : procname, pid, WTERMSIG(exitstatus),
2888 : pg_strsignal(WTERMSIG(exitstatus))),
2889 : activity ? errdetail("Failed process was running: %s", activity) : 0));
2890 : #endif
2891 : }
2892 : else
2893 0 : ereport(lev,
2894 :
2895 : /*------
2896 : translator: %s is a noun phrase describing a child process, such as
2897 : "server process" */
2898 : (errmsg("%s (PID %d) exited with unrecognized status %d",
2899 : procname, pid, exitstatus),
2900 : activity ? errdetail("Failed process was running: %s", activity) : 0));
2901 19365 : }
2902 :
2903 : /*
2904 : * Advance the postmaster's state machine and take actions as appropriate
2905 : *
2906 : * This is common code for process_pm_shutdown_request(),
2907 : * process_pm_child_exit() and process_pm_pmsignal(), which process the signals
2908 : * that might mean we need to change state.
2909 : */
2910 : static void
2911 28533 : PostmasterStateMachine(void)
2912 : {
2913 : /* If we're doing a smart shutdown, try to advance that state. */
2914 28533 : if (pmState == PM_RUN || pmState == PM_HOT_STANDBY)
2915 : {
2916 20196 : if (!connsAllowed)
2917 : {
2918 : /*
2919 : * This state ends when we have no normal client backends running.
2920 : * Then we're ready to stop other children.
2921 : */
2922 114 : if (CountChildren(btmask(B_BACKEND)) == 0)
2923 48 : UpdatePMState(PM_STOP_BACKENDS);
2924 : }
2925 : }
2926 :
2927 : /*
2928 : * In the PM_WAIT_BACKENDS state, wait for all the regular backends and
2929 : * processes like autovacuum and background workers that are comparable to
2930 : * backends to exit.
2931 : *
2932 : * PM_STOP_BACKENDS is a transient state that means the same as
2933 : * PM_WAIT_BACKENDS, but we signal the processes first, before waiting for
2934 : * them. Treating it as a distinct pmState allows us to share this code
2935 : * across multiple shutdown code paths.
2936 : */
2937 28533 : if (pmState == PM_STOP_BACKENDS || pmState == PM_WAIT_BACKENDS)
2938 : {
2939 5226 : BackendTypeMask targetMask = BTYPE_MASK_NONE;
2940 :
2941 : /*
2942 : * PM_WAIT_BACKENDS state ends when we have no regular backends, no
2943 : * autovac launcher or workers, and no bgworkers (including
2944 : * unconnected ones).
2945 : */
2946 5226 : targetMask = btmask_add(targetMask,
2947 : B_BACKEND,
2948 : B_AUTOVAC_LAUNCHER,
2949 : B_AUTOVAC_WORKER,
2950 : B_BG_WORKER);
2951 :
2952 : /*
2953 : * No walwriter, bgwriter, slot sync worker, or WAL summarizer either.
2954 : */
2955 5226 : targetMask = btmask_add(targetMask,
2956 : B_WAL_WRITER,
2957 : B_BG_WRITER,
2958 : B_SLOTSYNC_WORKER,
2959 : B_WAL_SUMMARIZER);
2960 :
2961 : /* If we're in recovery, also stop startup and walreceiver procs */
2962 5226 : targetMask = btmask_add(targetMask,
2963 : B_STARTUP,
2964 : B_WAL_RECEIVER);
2965 :
2966 : /*
2967 : * If we are doing crash recovery or an immediate shutdown then we
2968 : * expect archiver, checkpointer, io workers and walsender to exit as
2969 : * well, otherwise not.
2970 : */
2971 5226 : if (FatalError || Shutdown >= ImmediateShutdown)
2972 2004 : targetMask = btmask_add(targetMask,
2973 : B_CHECKPOINTER,
2974 : B_ARCHIVER,
2975 : B_IO_WORKER,
2976 : B_WAL_SENDER);
2977 :
2978 : /*
2979 : * Normally archiver, checkpointer, IO workers and walsenders will
2980 : * continue running; they will be terminated later after writing the
2981 : * checkpoint record. We also let dead-end children to keep running
2982 : * for now. The syslogger process exits last.
2983 : *
2984 : * This assertion checks that we have covered all backend types,
2985 : * either by including them in targetMask, or by noting here that they
2986 : * are allowed to continue running.
2987 : */
2988 : #ifdef USE_ASSERT_CHECKING
2989 : {
2990 : BackendTypeMask remainMask = BTYPE_MASK_NONE;
2991 :
2992 : remainMask = btmask_add(remainMask,
2993 : B_DEAD_END_BACKEND,
2994 : B_LOGGER);
2995 :
2996 : /*
2997 : * Archiver, checkpointer, IO workers, and walsender may or may
2998 : * not be in targetMask already.
2999 : */
3000 : remainMask = btmask_add(remainMask,
3001 : B_ARCHIVER,
3002 : B_CHECKPOINTER,
3003 : B_IO_WORKER,
3004 : B_WAL_SENDER);
3005 :
3006 : /* these are not real postmaster children */
3007 : remainMask = btmask_add(remainMask,
3008 : B_INVALID,
3009 : B_STANDALONE_BACKEND);
3010 :
3011 : /* also add data checksums processes */
3012 : remainMask = btmask_add(remainMask,
3013 : B_DATACHECKSUMSWORKER_LAUNCHER,
3014 : B_DATACHECKSUMSWORKER_WORKER);
3015 :
3016 : /* All types should be included in targetMask or remainMask */
3017 : Assert((remainMask.mask | targetMask.mask) == BTYPE_MASK_ALL.mask);
3018 : }
3019 : #endif
3020 :
3021 : /* If we had not yet signaled the processes to exit, do so now */
3022 5226 : if (pmState == PM_STOP_BACKENDS)
3023 : {
3024 : /*
3025 : * Forget any pending requests for background workers, since we're
3026 : * no longer willing to launch any new workers. (If additional
3027 : * requests arrive, BackgroundWorkerStateChange will reject them.)
3028 : */
3029 626 : ForgetUnstartedBackgroundWorkers();
3030 :
3031 626 : SignalChildren(SIGTERM, targetMask);
3032 :
3033 626 : UpdatePMState(PM_WAIT_BACKENDS);
3034 : }
3035 :
3036 : /* Are any of the target processes still running? */
3037 5226 : if (CountChildren(targetMask) == 0)
3038 : {
3039 980 : if (Shutdown >= ImmediateShutdown || FatalError)
3040 : {
3041 : /*
3042 : * Stop any dead-end children and stop creating new ones.
3043 : *
3044 : * NB: Similar code exists in HandleFatalError(), when the
3045 : * error happens in pmState > PM_WAIT_BACKENDS.
3046 : */
3047 354 : UpdatePMState(PM_WAIT_DEAD_END);
3048 354 : ConfigurePostmasterWaitSet(false);
3049 354 : SignalChildren(SIGQUIT, btmask(B_DEAD_END_BACKEND));
3050 :
3051 : /*
3052 : * We already SIGQUIT'd auxiliary processes (other than
3053 : * logger), if any, when we started immediate shutdown or
3054 : * entered FatalError state.
3055 : */
3056 : }
3057 : else
3058 : {
3059 : /*
3060 : * If we get here, we are proceeding with normal shutdown. All
3061 : * the regular children are gone, and it's time to tell the
3062 : * checkpointer to do a shutdown checkpoint.
3063 : */
3064 : Assert(Shutdown > NoShutdown);
3065 : /* Start the checkpointer if not running */
3066 626 : if (CheckpointerPMChild == NULL)
3067 0 : CheckpointerPMChild = StartChildProcess(B_CHECKPOINTER);
3068 : /* And tell it to write the shutdown checkpoint */
3069 626 : if (CheckpointerPMChild != NULL)
3070 : {
3071 626 : signal_child(CheckpointerPMChild, SIGINT);
3072 626 : UpdatePMState(PM_WAIT_XLOG_SHUTDOWN);
3073 : }
3074 : else
3075 : {
3076 : /*
3077 : * If we failed to fork a checkpointer, just shut down.
3078 : * Any required cleanup will happen at next restart. We
3079 : * set FatalError so that an "abnormal shutdown" message
3080 : * gets logged when we exit.
3081 : *
3082 : * We don't consult send_abort_for_crash here, as it's
3083 : * unlikely that dumping cores would illuminate the reason
3084 : * for checkpointer fork failure.
3085 : *
3086 : * XXX: It may be worth to introduce a different PMQUIT
3087 : * value that signals that the cluster is in a bad state,
3088 : * without a process having crashed. But right now this
3089 : * path is very unlikely to be reached, so it isn't
3090 : * obviously worthwhile adding a distinct error message in
3091 : * quickdie().
3092 : */
3093 0 : HandleFatalError(PMQUIT_FOR_CRASH, false);
3094 : }
3095 : }
3096 : }
3097 : }
3098 :
3099 : /*
3100 : * The state transition from PM_WAIT_XLOG_SHUTDOWN to
3101 : * PM_WAIT_XLOG_ARCHIVAL is in process_pm_pmsignal(), in response to
3102 : * PMSIGNAL_XLOG_IS_SHUTDOWN.
3103 : */
3104 :
3105 28533 : if (pmState == PM_WAIT_XLOG_ARCHIVAL)
3106 : {
3107 : /*
3108 : * PM_WAIT_XLOG_ARCHIVAL state ends when there are no children other
3109 : * than checkpointer, io workers and dead-end children left. There
3110 : * shouldn't be any regular backends left by now anyway; what we're
3111 : * really waiting for is for walsenders and archiver to exit.
3112 : */
3113 690 : if (CountChildren(btmask_all_except(B_CHECKPOINTER, B_IO_WORKER,
3114 : B_LOGGER, B_DEAD_END_BACKEND)) == 0)
3115 : {
3116 626 : UpdatePMState(PM_WAIT_IO_WORKERS);
3117 626 : SignalChildren(SIGUSR2, btmask(B_IO_WORKER));
3118 : }
3119 : }
3120 :
3121 28533 : if (pmState == PM_WAIT_IO_WORKERS)
3122 : {
3123 : /*
3124 : * PM_WAIT_IO_WORKERS state ends when there's only checkpointer and
3125 : * dead-end children left.
3126 : */
3127 2377 : if (io_worker_count == 0)
3128 : {
3129 626 : UpdatePMState(PM_WAIT_CHECKPOINTER);
3130 :
3131 : /*
3132 : * Now that the processes mentioned above are gone, tell
3133 : * checkpointer to shut down too. That allows checkpointer to
3134 : * perform some last bits of cleanup without other processes
3135 : * interfering.
3136 : */
3137 626 : if (CheckpointerPMChild != NULL)
3138 626 : signal_child(CheckpointerPMChild, SIGUSR2);
3139 : }
3140 : }
3141 :
3142 : /*
3143 : * The state transition from PM_WAIT_CHECKPOINTER to PM_WAIT_DEAD_END is
3144 : * in process_pm_child_exit().
3145 : */
3146 :
3147 28533 : if (pmState == PM_WAIT_DEAD_END)
3148 : {
3149 : /*
3150 : * PM_WAIT_DEAD_END state ends when all other children are gone except
3151 : * for the logger. During normal shutdown, all that remains are
3152 : * dead-end backends, but in FatalError processing we jump straight
3153 : * here with more processes remaining. Note that they have already
3154 : * been sent appropriate shutdown signals, either during a normal
3155 : * state transition leading up to PM_WAIT_DEAD_END, or during
3156 : * FatalError processing.
3157 : *
3158 : * The reason we wait is to protect against a new postmaster starting
3159 : * conflicting subprocesses; this isn't an ironclad protection, but it
3160 : * at least helps in the shutdown-and-immediately-restart scenario.
3161 : */
3162 993 : if (CountChildren(btmask_all_except(B_LOGGER)) == 0)
3163 : {
3164 : /* These other guys should be dead already */
3165 : Assert(StartupPMChild == NULL);
3166 : Assert(WalReceiverPMChild == NULL);
3167 : Assert(WalSummarizerPMChild == NULL);
3168 : Assert(BgWriterPMChild == NULL);
3169 : Assert(CheckpointerPMChild == NULL);
3170 : Assert(WalWriterPMChild == NULL);
3171 : Assert(AutoVacLauncherPMChild == NULL);
3172 : Assert(SlotSyncWorkerPMChild == NULL);
3173 : /* syslogger is not considered here */
3174 980 : UpdatePMState(PM_NO_CHILDREN);
3175 : }
3176 : }
3177 :
3178 : /*
3179 : * If we've been told to shut down, we exit as soon as there are no
3180 : * remaining children. If there was a crash, cleanup will occur at the
3181 : * next startup. (Before PostgreSQL 8.3, we tried to recover from the
3182 : * crash before exiting, but that seems unwise if we are quitting because
3183 : * we got SIGTERM from init --- there may well not be time for recovery
3184 : * before init decides to SIGKILL us.)
3185 : *
3186 : * Note that the syslogger continues to run. It will exit when it sees
3187 : * EOF on its input pipe, which happens when there are no more upstream
3188 : * processes.
3189 : */
3190 28533 : if (Shutdown > NoShutdown && pmState == PM_NO_CHILDREN)
3191 : {
3192 972 : if (FatalError)
3193 : {
3194 0 : ereport(LOG, (errmsg("abnormal database system shutdown")));
3195 0 : ExitPostmaster(1);
3196 : }
3197 : else
3198 : {
3199 : /*
3200 : * Normal exit from the postmaster is here. We don't need to log
3201 : * anything here, since the UnlinkLockFiles proc_exit callback
3202 : * will do so, and that should be the last user-visible action.
3203 : */
3204 972 : ExitPostmaster(0);
3205 : }
3206 : }
3207 :
3208 : /*
3209 : * If the startup process failed, or the user does not want an automatic
3210 : * restart after backend crashes, wait for all non-syslogger children to
3211 : * exit, and then exit postmaster. We don't try to reinitialize when the
3212 : * startup process fails, because more than likely it will just fail again
3213 : * and we will keep trying forever.
3214 : */
3215 27561 : if (pmState == PM_NO_CHILDREN)
3216 : {
3217 8 : if (StartupStatus == STARTUP_CRASHED)
3218 : {
3219 3 : ereport(LOG,
3220 : (errmsg("shutting down due to startup process failure")));
3221 3 : ExitPostmaster(1);
3222 : }
3223 5 : if (!restart_after_crash)
3224 : {
3225 0 : ereport(LOG,
3226 : (errmsg("shutting down because \"restart_after_crash\" is off")));
3227 0 : ExitPostmaster(1);
3228 : }
3229 : }
3230 :
3231 : /*
3232 : * If we need to recover from a crash, wait for all non-syslogger children
3233 : * to exit, then reset shmem and start the startup process.
3234 : */
3235 27558 : if (FatalError && pmState == PM_NO_CHILDREN)
3236 : {
3237 5 : ereport(LOG,
3238 : (errmsg("all server processes terminated; reinitializing")));
3239 :
3240 : /* remove leftover temporary files after a crash */
3241 5 : if (remove_temp_files_after_crash)
3242 4 : RemovePgTempFiles();
3243 :
3244 : /* allow background workers to immediately restart */
3245 5 : ResetBackgroundWorkerCrashTimes();
3246 :
3247 5 : shmem_exit(1);
3248 :
3249 : /* re-read control file into local memory */
3250 5 : LocalProcessControlFile(true);
3251 :
3252 : /*
3253 : * Re-initialize shared memory and semaphores. Note: We don't call
3254 : * RegisterBuiltinShmemCallbacks(), we keep the old registrations. In
3255 : * order to re-register structs in extensions, we'd need to reload
3256 : * shared preload libraries, and we don't want to do that.
3257 : */
3258 5 : ResetShmemAllocator();
3259 5 : ShmemCallRequestCallbacks();
3260 5 : CreateSharedMemoryAndSemaphores();
3261 :
3262 5 : UpdatePMState(PM_STARTUP);
3263 :
3264 : /* Make sure we can perform I/O while starting up. */
3265 5 : maybe_adjust_io_workers();
3266 :
3267 5 : StartupPMChild = StartChildProcess(B_STARTUP);
3268 : Assert(StartupPMChild != NULL);
3269 5 : StartupStatus = STARTUP_RUNNING;
3270 : /* crash recovery started, reset SIGKILL flag */
3271 5 : AbortStartTime = 0;
3272 :
3273 : /* start accepting server socket connection events again */
3274 5 : ConfigurePostmasterWaitSet(true);
3275 : }
3276 27558 : }
3277 :
3278 : static const char *
3279 1532 : pmstate_name(PMState state)
3280 : {
3281 : #define PM_TOSTR_CASE(sym) case sym: return #sym
3282 1532 : switch (state)
3283 : {
3284 83 : PM_TOSTR_CASE(PM_INIT);
3285 165 : PM_TOSTR_CASE(PM_STARTUP);
3286 28 : PM_TOSTR_CASE(PM_RECOVERY);
3287 25 : PM_TOSTR_CASE(PM_HOT_STANDBY);
3288 153 : PM_TOSTR_CASE(PM_RUN);
3289 130 : PM_TOSTR_CASE(PM_STOP_BACKENDS);
3290 176 : PM_TOSTR_CASE(PM_WAIT_BACKENDS);
3291 130 : PM_TOSTR_CASE(PM_WAIT_XLOG_SHUTDOWN);
3292 130 : PM_TOSTR_CASE(PM_WAIT_XLOG_ARCHIVAL);
3293 130 : PM_TOSTR_CASE(PM_WAIT_IO_WORKERS);
3294 168 : PM_TOSTR_CASE(PM_WAIT_DEAD_END);
3295 130 : PM_TOSTR_CASE(PM_WAIT_CHECKPOINTER);
3296 84 : PM_TOSTR_CASE(PM_NO_CHILDREN);
3297 : }
3298 : #undef PM_TOSTR_CASE
3299 :
3300 0 : pg_unreachable();
3301 : return ""; /* silence compiler */
3302 : }
3303 :
3304 : /*
3305 : * Simple wrapper for updating pmState. The main reason to have this wrapper
3306 : * is that it makes it easy to log all state transitions.
3307 : */
3308 : static void
3309 8409 : UpdatePMState(PMState newState)
3310 : {
3311 8409 : elog(DEBUG1, "updating PMState from %s to %s",
3312 : pmstate_name(pmState), pmstate_name(newState));
3313 8409 : pmState = newState;
3314 8409 : }
3315 :
3316 : /*
3317 : * Launch background processes after state change, or relaunch after an
3318 : * existing process has exited.
3319 : *
3320 : * Check the current pmState and the status of any background processes. If
3321 : * there are any background processes missing that should be running in the
3322 : * current state, but are not, launch them.
3323 : */
3324 : static void
3325 180247 : LaunchMissingBackgroundProcesses(void)
3326 : {
3327 : /* Syslogger is active in all states */
3328 180247 : if (SysLoggerPMChild == NULL && Logging_collector)
3329 0 : StartSysLogger();
3330 :
3331 : /*
3332 : * The number of configured workers might have changed, or a prior start
3333 : * of a worker might have failed. Check if we need to start/stop any
3334 : * workers.
3335 : *
3336 : * A config file change will always lead to this function being called, so
3337 : * we always will process the config change in a timely manner.
3338 : */
3339 180247 : maybe_adjust_io_workers();
3340 :
3341 : /*
3342 : * The checkpointer and the background writer are active from the start,
3343 : * until shutdown is initiated.
3344 : *
3345 : * (If the checkpointer is not running when we enter the
3346 : * PM_WAIT_XLOG_SHUTDOWN state, it is launched one more time to perform
3347 : * the shutdown checkpoint. That's done in PostmasterStateMachine(), not
3348 : * here.)
3349 : */
3350 180247 : if (pmState == PM_RUN || pmState == PM_RECOVERY ||
3351 9909 : pmState == PM_HOT_STANDBY || pmState == PM_STARTUP)
3352 : {
3353 172845 : if (CheckpointerPMChild == NULL)
3354 5 : CheckpointerPMChild = StartChildProcess(B_CHECKPOINTER);
3355 172845 : if (BgWriterPMChild == NULL)
3356 5 : BgWriterPMChild = StartChildProcess(B_BG_WRITER);
3357 : }
3358 :
3359 : /*
3360 : * WAL writer is needed only in normal operation (else we cannot be
3361 : * writing any new WAL).
3362 : */
3363 180247 : if (WalWriterPMChild == NULL && pmState == PM_RUN)
3364 871 : WalWriterPMChild = StartChildProcess(B_WAL_WRITER);
3365 :
3366 : /*
3367 : * We don't want autovacuum to run in binary upgrade mode because
3368 : * autovacuum might update relfrozenxid for empty tables before the
3369 : * physical files are put in place.
3370 : */
3371 191243 : if (!IsBinaryUpgrade && AutoVacLauncherPMChild == NULL &&
3372 15220 : (AutoVacuumingActive() || start_autovac_launcher) &&
3373 6772 : pmState == PM_RUN)
3374 : {
3375 733 : AutoVacLauncherPMChild = StartChildProcess(B_AUTOVAC_LAUNCHER);
3376 733 : if (AutoVacLauncherPMChild != NULL)
3377 733 : start_autovac_launcher = false; /* signal processed */
3378 : }
3379 :
3380 : /*
3381 : * If WAL archiving is enabled always, we are allowed to start archiver
3382 : * even during recovery.
3383 : */
3384 180247 : if (PgArchPMChild == NULL &&
3385 179102 : ((XLogArchivingActive() && pmState == PM_RUN) ||
3386 179102 : (XLogArchivingAlways() && (pmState == PM_RECOVERY || pmState == PM_HOT_STANDBY))) &&
3387 54 : PgArchCanRestart())
3388 54 : PgArchPMChild = StartChildProcess(B_ARCHIVER);
3389 :
3390 : /*
3391 : * If we need to start a slot sync worker, try to do that now
3392 : *
3393 : * We allow to start the slot sync worker when we are on a hot standby,
3394 : * fast or immediate shutdown is not in progress, slot sync parameters are
3395 : * configured correctly, and it is the first time of worker's launch, or
3396 : * enough time has passed since the worker was launched last.
3397 : */
3398 180247 : if (SlotSyncWorkerPMChild == NULL && pmState == PM_HOT_STANDBY &&
3399 2275 : Shutdown <= SmartShutdown && sync_replication_slots &&
3400 37 : ValidateSlotSyncParams(LOG) && SlotSyncWorkerCanRestart())
3401 6 : SlotSyncWorkerPMChild = StartChildProcess(B_SLOTSYNC_WORKER);
3402 :
3403 : /*
3404 : * If we need to start a WAL receiver, try to do that now
3405 : *
3406 : * Note: if a walreceiver process is already running, it might seem that
3407 : * we should clear WalReceiverRequested. However, there's a race
3408 : * condition if the walreceiver terminates and the startup process
3409 : * immediately requests a new one: it's quite possible to get the signal
3410 : * for the request before reaping the dead walreceiver process. Better to
3411 : * risk launching an extra walreceiver than to miss launching one we need.
3412 : * (The walreceiver code has logic to recognize that it should go away if
3413 : * not needed.)
3414 : */
3415 180247 : if (WalReceiverRequested)
3416 : {
3417 402 : if (WalReceiverPMChild == NULL &&
3418 295 : (pmState == PM_STARTUP || pmState == PM_RECOVERY ||
3419 294 : pmState == PM_HOT_STANDBY) &&
3420 274 : Shutdown <= SmartShutdown)
3421 : {
3422 274 : WalReceiverPMChild = StartChildProcess(B_WAL_RECEIVER);
3423 274 : if (WalReceiverPMChild != NULL)
3424 274 : WalReceiverRequested = false;
3425 : /* else leave the flag set, so we'll try again later */
3426 : }
3427 : }
3428 :
3429 : /* If we need to start a WAL summarizer, try to do that now */
3430 180247 : if (summarize_wal && WalSummarizerPMChild == NULL &&
3431 97 : (pmState == PM_RUN || pmState == PM_HOT_STANDBY) &&
3432 21 : Shutdown <= SmartShutdown)
3433 21 : WalSummarizerPMChild = StartChildProcess(B_WAL_SUMMARIZER);
3434 :
3435 : /* Get other worker processes running, if needed */
3436 180247 : if (StartWorkerNeeded || HaveCrashedWorker)
3437 8515 : maybe_start_bgworkers();
3438 180247 : }
3439 :
3440 : /*
3441 : * Return string representation of signal.
3442 : *
3443 : * Because this is only implemented for signals we already rely on in this
3444 : * file we don't need to deal with unimplemented or same-numeric-value signals
3445 : * (as we'd e.g. have to for EWOULDBLOCK / EAGAIN).
3446 : */
3447 : static const char *
3448 63 : pm_signame(int signal)
3449 : {
3450 : #define PM_TOSTR_CASE(sym) case sym: return #sym
3451 63 : switch (signal)
3452 : {
3453 0 : PM_TOSTR_CASE(SIGABRT);
3454 0 : PM_TOSTR_CASE(SIGCHLD);
3455 0 : PM_TOSTR_CASE(SIGHUP);
3456 7 : PM_TOSTR_CASE(SIGINT);
3457 0 : PM_TOSTR_CASE(SIGKILL);
3458 0 : PM_TOSTR_CASE(SIGQUIT);
3459 37 : PM_TOSTR_CASE(SIGTERM);
3460 0 : PM_TOSTR_CASE(SIGUSR1);
3461 19 : PM_TOSTR_CASE(SIGUSR2);
3462 0 : default:
3463 : /* all signals sent by postmaster should be listed here */
3464 : Assert(false);
3465 0 : return "(unknown)";
3466 : }
3467 : #undef PM_TOSTR_CASE
3468 :
3469 : return ""; /* silence compiler */
3470 : }
3471 :
3472 : /*
3473 : * Send a signal to a postmaster child process
3474 : *
3475 : * On systems that have setsid(), each child process sets itself up as a
3476 : * process group leader. For signals that are generally interpreted in the
3477 : * appropriate fashion, we signal the entire process group not just the
3478 : * direct child process. This allows us to, for example, SIGQUIT a blocked
3479 : * archive_recovery script, or SIGINT a script being run by a backend via
3480 : * system().
3481 : *
3482 : * There is a race condition for recently-forked children: they might not
3483 : * have executed setsid() yet. So we signal the child directly as well as
3484 : * the group. We assume such a child will handle the signal before trying
3485 : * to spawn any grandchild processes. We also assume that signaling the
3486 : * child twice will not cause any problems.
3487 : */
3488 : static void
3489 12092 : signal_child(PMChild *pmchild, int signal)
3490 : {
3491 12092 : pid_t pid = pmchild->pid;
3492 :
3493 12092 : ereport(DEBUG3,
3494 : (errmsg_internal("sending signal %d/%s to %s process with pid %d",
3495 : signal, pm_signame(signal),
3496 : GetBackendTypeDesc(pmchild->bkend_type),
3497 : (int) pmchild->pid)));
3498 :
3499 12092 : if (kill(pid, signal) < 0)
3500 0 : elog(DEBUG3, "kill(%ld,%d) failed: %m", (long) pid, signal);
3501 : #ifdef HAVE_SETSID
3502 12092 : switch (signal)
3503 : {
3504 6530 : case SIGINT:
3505 : case SIGTERM:
3506 : case SIGQUIT:
3507 : case SIGKILL:
3508 : case SIGABRT:
3509 6530 : if (kill(-pid, signal) < 0)
3510 2 : elog(DEBUG3, "kill(%ld,%d) failed: %m", (long) (-pid), signal);
3511 6530 : break;
3512 5562 : default:
3513 5562 : break;
3514 : }
3515 : #endif
3516 12092 : }
3517 :
3518 : /*
3519 : * Send a signal to the targeted children.
3520 : */
3521 : static bool
3522 3375 : SignalChildren(int signal, BackendTypeMask targetMask)
3523 : {
3524 : dlist_iter iter;
3525 3375 : bool signaled = false;
3526 :
3527 18478 : dlist_foreach(iter, &ActiveChildList)
3528 : {
3529 15103 : PMChild *bp = dlist_container(PMChild, elem, iter.cur);
3530 :
3531 : /*
3532 : * If we need to distinguish between B_BACKEND and B_WAL_SENDER, check
3533 : * if any B_BACKEND backends have recently announced that they are
3534 : * actually WAL senders.
3535 : */
3536 15103 : if (btmask_contains(targetMask, B_WAL_SENDER) != btmask_contains(targetMask, B_BACKEND) &&
3537 7959 : bp->bkend_type == B_BACKEND)
3538 : {
3539 512 : if (IsPostmasterChildWalSender(bp->child_slot))
3540 47 : bp->bkend_type = B_WAL_SENDER;
3541 : }
3542 :
3543 15103 : if (!btmask_contains(targetMask, bp->bkend_type))
3544 5743 : continue;
3545 :
3546 9360 : signal_child(bp, signal);
3547 9360 : signaled = true;
3548 : }
3549 3375 : return signaled;
3550 : }
3551 :
3552 : /*
3553 : * Send a termination signal to children. This considers all of our children
3554 : * processes, except syslogger.
3555 : */
3556 : static void
3557 354 : TerminateChildren(int signal)
3558 : {
3559 354 : SignalChildren(signal, btmask_all_except(B_LOGGER));
3560 354 : if (StartupPMChild != NULL)
3561 : {
3562 46 : if (signal == SIGQUIT || signal == SIGKILL || signal == SIGABRT)
3563 46 : StartupStatus = STARTUP_SIGNALED;
3564 : }
3565 354 : }
3566 :
3567 : /*
3568 : * BackendStartup -- start backend process
3569 : *
3570 : * returns: STATUS_ERROR if the fork failed, STATUS_OK otherwise.
3571 : *
3572 : * Note: if you change this code, also consider StartAutovacuumWorker and
3573 : * StartBackgroundWorker.
3574 : */
3575 : static int
3576 15039 : BackendStartup(ClientSocket *client_sock)
3577 : {
3578 15039 : PMChild *bn = NULL;
3579 : pid_t pid;
3580 : BackendStartupData startup_data;
3581 : CAC_state cac;
3582 :
3583 : /*
3584 : * Capture time that Postmaster got a socket from accept (for logging
3585 : * connection establishment and setup total duration).
3586 : */
3587 15039 : startup_data.socket_created = GetCurrentTimestamp();
3588 :
3589 : /*
3590 : * Allocate and assign the child slot. Note we must do this before
3591 : * forking, so that we can handle failures (out of memory or child-process
3592 : * slots) cleanly.
3593 : */
3594 15039 : cac = canAcceptConnections(B_BACKEND);
3595 15039 : if (cac == CAC_OK)
3596 : {
3597 : /* Can change later to B_WAL_SENDER */
3598 14814 : bn = AssignPostmasterChildSlot(B_BACKEND);
3599 14814 : if (!bn)
3600 : {
3601 : /*
3602 : * Too many regular child processes; launch a dead-end child
3603 : * process instead.
3604 : */
3605 28 : cac = CAC_TOOMANY;
3606 : }
3607 : }
3608 15039 : if (!bn)
3609 : {
3610 253 : bn = AllocDeadEndChild();
3611 253 : if (!bn)
3612 : {
3613 0 : ereport(LOG,
3614 : (errcode(ERRCODE_OUT_OF_MEMORY),
3615 : errmsg("out of memory")));
3616 0 : return STATUS_ERROR;
3617 : }
3618 : }
3619 :
3620 : /* Pass down canAcceptConnections state */
3621 15039 : startup_data.canAcceptConnections = cac;
3622 15039 : bn->rw = NULL;
3623 :
3624 : /* Hasn't asked to be notified about any bgworkers yet */
3625 15039 : bn->bgworker_notify = false;
3626 :
3627 15039 : pid = postmaster_child_launch(bn->bkend_type, bn->child_slot,
3628 : &startup_data, sizeof(startup_data),
3629 : client_sock);
3630 15039 : if (pid < 0)
3631 : {
3632 : /* in parent, fork failed */
3633 0 : int save_errno = errno;
3634 :
3635 0 : (void) ReleasePostmasterChildSlot(bn);
3636 0 : errno = save_errno;
3637 0 : ereport(LOG,
3638 : (errmsg("could not fork new process for connection: %m")));
3639 0 : report_fork_failure_to_client(client_sock, save_errno);
3640 0 : return STATUS_ERROR;
3641 : }
3642 :
3643 : /* in parent, successful fork */
3644 15039 : ereport(DEBUG2,
3645 : (errmsg_internal("forked new %s, pid=%d socket=%d",
3646 : GetBackendTypeDesc(bn->bkend_type),
3647 : (int) pid, (int) client_sock->sock)));
3648 :
3649 : /*
3650 : * Everything's been successful, it's safe to add this backend to our list
3651 : * of backends.
3652 : */
3653 15039 : bn->pid = pid;
3654 15039 : return STATUS_OK;
3655 : }
3656 :
3657 : /*
3658 : * Try to report backend fork() failure to client before we close the
3659 : * connection. Since we do not care to risk blocking the postmaster on
3660 : * this connection, we set the connection to non-blocking and try only once.
3661 : *
3662 : * This is grungy special-purpose code; we cannot use backend libpq since
3663 : * it's not up and running.
3664 : */
3665 : static void
3666 0 : report_fork_failure_to_client(ClientSocket *client_sock, int errnum)
3667 : {
3668 : char buffer[1000];
3669 : int rc;
3670 :
3671 : /* Format the error message packet (always V2 protocol) */
3672 0 : snprintf(buffer, sizeof(buffer), "E%s%s\n",
3673 : _("could not fork new process for connection: "),
3674 : strerror(errnum));
3675 :
3676 : /* Set port to non-blocking. Don't do send() if this fails */
3677 0 : if (!pg_set_noblock(client_sock->sock))
3678 0 : return;
3679 :
3680 : /* We'll retry after EINTR, but ignore all other failures */
3681 : do
3682 : {
3683 0 : rc = send(client_sock->sock, buffer, strlen(buffer) + 1, 0);
3684 0 : } while (rc < 0 && errno == EINTR);
3685 : }
3686 :
3687 : /*
3688 : * ExitPostmaster -- cleanup
3689 : *
3690 : * Do NOT call exit() directly --- always go through here!
3691 : */
3692 : static void
3693 981 : ExitPostmaster(int status)
3694 : {
3695 : #ifdef HAVE_PTHREAD_IS_THREADED_NP
3696 :
3697 : /*
3698 : * There is no known cause for a postmaster to become multithreaded after
3699 : * startup. However, we might reach here via an error exit before
3700 : * reaching the test in PostmasterMain, so provide the same hint as there.
3701 : * This message uses LOG level, because an unclean shutdown at this point
3702 : * would usually not look much different from a clean shutdown.
3703 : */
3704 : if (pthread_is_threaded_np() != 0)
3705 : ereport(LOG,
3706 : (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
3707 : errmsg("postmaster became multithreaded"),
3708 : errhint("Set the LC_ALL environment variable to a valid locale.")));
3709 : #endif
3710 :
3711 : /* should cleanup shared memory and kill all backends */
3712 :
3713 : /*
3714 : * Not sure of the semantics here. When the Postmaster dies, should the
3715 : * backends all be killed? probably not.
3716 : *
3717 : * MUST -- vadim 05-10-1999
3718 : */
3719 :
3720 981 : proc_exit(status);
3721 : }
3722 :
3723 : /*
3724 : * Handle pmsignal conditions representing requests from backends,
3725 : * and check for promote and logrotate requests from pg_ctl.
3726 : */
3727 : static void
3728 139553 : process_pm_pmsignal(void)
3729 : {
3730 139553 : bool request_state_update = false;
3731 :
3732 139553 : pending_pm_pmsignal = false;
3733 :
3734 139553 : ereport(DEBUG2,
3735 : (errmsg_internal("postmaster received pmsignal signal")));
3736 :
3737 : /*
3738 : * RECOVERY_STARTED and BEGIN_HOT_STANDBY signals are ignored in
3739 : * unexpected states. If the startup process quickly starts up, completes
3740 : * recovery, exits, we might process the death of the startup process
3741 : * first. We don't want to go back to recovery in that case.
3742 : */
3743 139553 : if (CheckPostmasterSignal(PMSIGNAL_RECOVERY_STARTED) &&
3744 262 : pmState == PM_STARTUP && Shutdown == NoShutdown)
3745 : {
3746 : /* WAL redo has started. We're out of reinitialization. */
3747 262 : FatalError = false;
3748 262 : AbortStartTime = 0;
3749 262 : reachedConsistency = false;
3750 :
3751 : /*
3752 : * Start the archiver if we're responsible for (re-)archiving received
3753 : * files.
3754 : */
3755 : Assert(PgArchPMChild == NULL);
3756 262 : if (XLogArchivingAlways())
3757 3 : PgArchPMChild = StartChildProcess(B_ARCHIVER);
3758 :
3759 : /*
3760 : * If we aren't planning to enter hot standby mode later, treat
3761 : * RECOVERY_STARTED as meaning we're out of startup, and report status
3762 : * accordingly.
3763 : */
3764 262 : if (!EnableHotStandby)
3765 : {
3766 2 : AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_STANDBY);
3767 : #ifdef USE_SYSTEMD
3768 : sd_notify(0, "READY=1");
3769 : #endif
3770 : }
3771 :
3772 262 : UpdatePMState(PM_RECOVERY);
3773 : }
3774 :
3775 139553 : if (CheckPostmasterSignal(PMSIGNAL_RECOVERY_CONSISTENT) &&
3776 171 : pmState == PM_RECOVERY && Shutdown == NoShutdown)
3777 : {
3778 171 : reachedConsistency = true;
3779 : }
3780 :
3781 139553 : if (CheckPostmasterSignal(PMSIGNAL_BEGIN_HOT_STANDBY) &&
3782 162 : (pmState == PM_RECOVERY && Shutdown == NoShutdown))
3783 : {
3784 162 : ereport(LOG,
3785 : (errmsg("database system is ready to accept read-only connections")));
3786 :
3787 : /* Report status */
3788 162 : AddToDataDirLockFile(LOCK_FILE_LINE_PM_STATUS, PM_STATUS_READY);
3789 : #ifdef USE_SYSTEMD
3790 : sd_notify(0, "READY=1");
3791 : #endif
3792 :
3793 162 : UpdatePMState(PM_HOT_STANDBY);
3794 162 : connsAllowed = true;
3795 :
3796 : /* Some workers may be scheduled to start now */
3797 162 : StartWorkerNeeded = true;
3798 : }
3799 :
3800 : /* Process background worker state changes. */
3801 139553 : if (CheckPostmasterSignal(PMSIGNAL_BACKGROUND_WORKER_CHANGE))
3802 : {
3803 : /* Accept new worker requests only if not stopping. */
3804 1702 : BackgroundWorkerStateChange(pmState < PM_STOP_BACKENDS);
3805 1702 : StartWorkerNeeded = true;
3806 : }
3807 :
3808 : /* Tell syslogger to rotate logfile if requested */
3809 139553 : if (SysLoggerPMChild != NULL)
3810 : {
3811 2 : if (CheckLogrotateSignal())
3812 : {
3813 1 : signal_child(SysLoggerPMChild, SIGUSR1);
3814 1 : RemoveLogrotateSignalFiles();
3815 : }
3816 1 : else if (CheckPostmasterSignal(PMSIGNAL_ROTATE_LOGFILE))
3817 : {
3818 0 : signal_child(SysLoggerPMChild, SIGUSR1);
3819 : }
3820 : }
3821 :
3822 139553 : if (CheckPostmasterSignal(PMSIGNAL_START_AUTOVAC_LAUNCHER) &&
3823 134193 : Shutdown <= SmartShutdown && pmState < PM_STOP_BACKENDS)
3824 : {
3825 : /*
3826 : * Start one iteration of the autovacuum daemon, even if autovacuuming
3827 : * is nominally not enabled. This is so we can have an active defense
3828 : * against transaction ID wraparound. We set a flag for the main loop
3829 : * to do it rather than trying to do it here --- this is because the
3830 : * autovac process itself may send the signal, and we want to handle
3831 : * that by launching another iteration as soon as the current one
3832 : * completes.
3833 : */
3834 134193 : start_autovac_launcher = true;
3835 : }
3836 :
3837 139553 : if (CheckPostmasterSignal(PMSIGNAL_START_AUTOVAC_WORKER) &&
3838 1418 : Shutdown <= SmartShutdown && pmState < PM_STOP_BACKENDS)
3839 : {
3840 : /* The autovacuum launcher wants us to start a worker process. */
3841 1418 : StartAutovacuumWorker();
3842 : }
3843 :
3844 139553 : if (CheckPostmasterSignal(PMSIGNAL_START_WALRECEIVER))
3845 : {
3846 : /* Startup Process wants us to start the walreceiver process. */
3847 280 : WalReceiverRequested = true;
3848 : }
3849 :
3850 139553 : if (CheckPostmasterSignal(PMSIGNAL_XLOG_IS_SHUTDOWN))
3851 : {
3852 : /* Checkpointer completed the shutdown checkpoint */
3853 626 : if (pmState == PM_WAIT_XLOG_SHUTDOWN)
3854 : {
3855 : /*
3856 : * If we have an archiver subprocess, tell it to do a last archive
3857 : * cycle and quit. Likewise, if we have walsender processes, tell
3858 : * them to send any remaining WAL and quit.
3859 : */
3860 : Assert(Shutdown > NoShutdown);
3861 :
3862 : /* Waken archiver for the last time */
3863 626 : if (PgArchPMChild != NULL)
3864 17 : signal_child(PgArchPMChild, SIGUSR2);
3865 :
3866 : /*
3867 : * Waken walsenders for the last time. No regular backends should
3868 : * be around anymore.
3869 : */
3870 626 : SignalChildren(SIGUSR2, btmask(B_WAL_SENDER));
3871 :
3872 626 : UpdatePMState(PM_WAIT_XLOG_ARCHIVAL);
3873 : }
3874 0 : else if (!FatalError && Shutdown != ImmediateShutdown)
3875 : {
3876 : /*
3877 : * Checkpointer only ought to perform the shutdown checkpoint
3878 : * during shutdown. If somehow checkpointer did so in another
3879 : * situation, we have no choice but to crash-restart.
3880 : *
3881 : * It's possible however that we get PMSIGNAL_XLOG_IS_SHUTDOWN
3882 : * outside of PM_WAIT_XLOG_SHUTDOWN if an orderly shutdown was
3883 : * "interrupted" by a crash or an immediate shutdown.
3884 : */
3885 0 : ereport(LOG,
3886 : (errmsg("WAL was shut down unexpectedly")));
3887 :
3888 : /*
3889 : * Doesn't seem likely to help to take send_abort_for_crash into
3890 : * account here.
3891 : */
3892 0 : HandleFatalError(PMQUIT_FOR_CRASH, false);
3893 : }
3894 :
3895 : /*
3896 : * Need to run PostmasterStateMachine() to check if we already can go
3897 : * to the next state.
3898 : */
3899 626 : request_state_update = true;
3900 : }
3901 :
3902 : /*
3903 : * Try to advance postmaster's state machine, if a child requests it.
3904 : */
3905 139553 : if (CheckPostmasterSignal(PMSIGNAL_ADVANCE_STATE_MACHINE))
3906 : {
3907 1338 : request_state_update = true;
3908 : }
3909 :
3910 : /*
3911 : * Be careful about the order of this action relative to this function's
3912 : * other actions. Generally, this should be after other actions, in case
3913 : * they have effects PostmasterStateMachine would need to know about.
3914 : * However, we should do it before the CheckPromoteSignal step, which
3915 : * cannot have any (immediate) effect on the state machine, but does
3916 : * depend on what state we're in now.
3917 : */
3918 139553 : if (request_state_update)
3919 : {
3920 1964 : PostmasterStateMachine();
3921 : }
3922 :
3923 139553 : if (StartupPMChild != NULL &&
3924 676 : (pmState == PM_STARTUP || pmState == PM_RECOVERY ||
3925 1144 : pmState == PM_HOT_STANDBY) &&
3926 673 : CheckPromoteSignal())
3927 : {
3928 : /*
3929 : * Tell startup process to finish recovery.
3930 : *
3931 : * Leave the promote signal file in place and let the Startup process
3932 : * do the unlink.
3933 : */
3934 48 : signal_child(StartupPMChild, SIGUSR2);
3935 : }
3936 139553 : }
3937 :
3938 : /*
3939 : * Dummy signal handler
3940 : *
3941 : * We use this for signals that we don't actually use in the postmaster,
3942 : * but we do use in backends. If we were to SIG_IGN such signals in the
3943 : * postmaster, then a newly started backend might drop a signal that arrives
3944 : * before it's able to reconfigure its signal processing. (See notes in
3945 : * tcop/postgres.c.)
3946 : */
3947 : static void
3948 0 : dummy_handler(SIGNAL_ARGS)
3949 : {
3950 0 : }
3951 :
3952 : /*
3953 : * Count up number of child processes of specified types.
3954 : */
3955 : static int
3956 7023 : CountChildren(BackendTypeMask targetMask)
3957 : {
3958 : dlist_iter iter;
3959 7023 : int cnt = 0;
3960 :
3961 40295 : dlist_foreach(iter, &ActiveChildList)
3962 : {
3963 33272 : PMChild *bp = dlist_container(PMChild, elem, iter.cur);
3964 :
3965 : /*
3966 : * If we need to distinguish between B_BACKEND and B_WAL_SENDER, check
3967 : * if any B_BACKEND backends have recently announced that they are
3968 : * actually WAL senders.
3969 : */
3970 33272 : if (btmask_contains(targetMask, B_WAL_SENDER) != btmask_contains(targetMask, B_BACKEND) &&
3971 21756 : bp->bkend_type == B_BACKEND)
3972 : {
3973 763 : if (IsPostmasterChildWalSender(bp->child_slot))
3974 0 : bp->bkend_type = B_WAL_SENDER;
3975 : }
3976 :
3977 33272 : if (!btmask_contains(targetMask, bp->bkend_type))
3978 16856 : continue;
3979 :
3980 16416 : ereport(DEBUG4,
3981 : (errmsg_internal("%s process %d is still running",
3982 : GetBackendTypeDesc(bp->bkend_type), (int) bp->pid)));
3983 :
3984 16416 : cnt++;
3985 : }
3986 7023 : return cnt;
3987 : }
3988 :
3989 :
3990 : /*
3991 : * StartChildProcess -- start an auxiliary process for the postmaster
3992 : *
3993 : * "type" determines what kind of child will be started. All child types
3994 : * initially go to AuxiliaryProcessMain, which will handle common setup.
3995 : *
3996 : * Return value of StartChildProcess is subprocess' PMChild entry, or NULL on
3997 : * failure.
3998 : */
3999 : static PMChild *
4000 9311 : StartChildProcess(BackendType type)
4001 : {
4002 : PMChild *pmchild;
4003 : pid_t pid;
4004 :
4005 9311 : pmchild = AssignPostmasterChildSlot(type);
4006 9311 : if (!pmchild)
4007 : {
4008 0 : if (type == B_AUTOVAC_WORKER)
4009 0 : ereport(LOG,
4010 : (errcode(ERRCODE_CONFIGURATION_LIMIT_EXCEEDED),
4011 : errmsg("no slot available for new autovacuum worker process")));
4012 : else
4013 : {
4014 : /* shouldn't happen because we allocate enough slots */
4015 0 : elog(LOG, "no postmaster child slot available for aux process");
4016 : }
4017 0 : return NULL;
4018 : }
4019 :
4020 9311 : pid = postmaster_child_launch(type, pmchild->child_slot, NULL, 0, NULL);
4021 9311 : if (pid < 0)
4022 : {
4023 : /* in parent, fork failed */
4024 0 : ReleasePostmasterChildSlot(pmchild);
4025 0 : ereport(LOG,
4026 : (errmsg("could not fork \"%s\" process: %m", PostmasterChildName(type))));
4027 :
4028 : /*
4029 : * fork failure is fatal during startup, but there's no need to choke
4030 : * immediately if starting other child types fails.
4031 : */
4032 0 : if (type == B_STARTUP)
4033 0 : ExitPostmaster(1);
4034 0 : return NULL;
4035 : }
4036 :
4037 : /* in parent, successful fork */
4038 9311 : pmchild->pid = pid;
4039 9311 : return pmchild;
4040 : }
4041 :
4042 : /*
4043 : * StartSysLogger -- start the syslogger process
4044 : */
4045 : void
4046 1 : StartSysLogger(void)
4047 : {
4048 : Assert(SysLoggerPMChild == NULL);
4049 :
4050 1 : SysLoggerPMChild = AssignPostmasterChildSlot(B_LOGGER);
4051 1 : if (!SysLoggerPMChild)
4052 0 : elog(PANIC, "no postmaster child slot available for syslogger");
4053 1 : SysLoggerPMChild->pid = SysLogger_Start(SysLoggerPMChild->child_slot);
4054 1 : if (SysLoggerPMChild->pid == 0)
4055 : {
4056 0 : ReleasePostmasterChildSlot(SysLoggerPMChild);
4057 0 : SysLoggerPMChild = NULL;
4058 : }
4059 1 : }
4060 :
4061 : /*
4062 : * StartAutovacuumWorker
4063 : * Start an autovac worker process.
4064 : *
4065 : * This function is here because it enters the resulting PID into the
4066 : * postmaster's private backends list.
4067 : *
4068 : * NB -- this code very roughly matches BackendStartup.
4069 : */
4070 : static void
4071 1418 : StartAutovacuumWorker(void)
4072 : {
4073 : PMChild *bn;
4074 :
4075 : /*
4076 : * If not in condition to run a process, don't try, but handle it like a
4077 : * fork failure. This does not normally happen, since the signal is only
4078 : * supposed to be sent by autovacuum launcher when it's OK to do it, but
4079 : * we have to check to avoid race-condition problems during DB state
4080 : * changes.
4081 : */
4082 1418 : if (canAcceptConnections(B_AUTOVAC_WORKER) == CAC_OK)
4083 : {
4084 1418 : bn = StartChildProcess(B_AUTOVAC_WORKER);
4085 1418 : if (bn)
4086 : {
4087 1418 : bn->bgworker_notify = false;
4088 1418 : bn->rw = NULL;
4089 1418 : return;
4090 : }
4091 : else
4092 : {
4093 : /*
4094 : * fork failed, fall through to report -- actual error message was
4095 : * logged by StartChildProcess
4096 : */
4097 : }
4098 : }
4099 :
4100 : /*
4101 : * Report the failure to the launcher, if it's running. (If it's not, we
4102 : * might not even be connected to shared memory, so don't try to call
4103 : * AutoVacWorkerFailed.) Note that we also need to signal it so that it
4104 : * responds to the condition, but we don't do that here, instead waiting
4105 : * for ServerLoop to do it. This way we avoid a ping-pong signaling in
4106 : * quick succession between the autovac launcher and postmaster in case
4107 : * things get ugly.
4108 : */
4109 0 : if (AutoVacLauncherPMChild != NULL)
4110 : {
4111 0 : AutoVacWorkerFailed();
4112 0 : avlauncher_needs_signal = true;
4113 : }
4114 : }
4115 :
4116 :
4117 : /*
4118 : * Create the opts file
4119 : */
4120 : static bool
4121 979 : CreateOptsFile(int argc, char *argv[], char *fullprogname)
4122 : {
4123 : FILE *fp;
4124 : int i;
4125 :
4126 : #define OPTS_FILE "postmaster.opts"
4127 :
4128 979 : if ((fp = fopen(OPTS_FILE, "w")) == NULL)
4129 : {
4130 0 : ereport(LOG,
4131 : (errcode_for_file_access(),
4132 : errmsg("could not create file \"%s\": %m", OPTS_FILE)));
4133 0 : return false;
4134 : }
4135 :
4136 979 : fprintf(fp, "%s", fullprogname);
4137 5118 : for (i = 1; i < argc; i++)
4138 4139 : fprintf(fp, " \"%s\"", argv[i]);
4139 979 : fputs("\n", fp);
4140 :
4141 979 : if (fclose(fp))
4142 : {
4143 0 : ereport(LOG,
4144 : (errcode_for_file_access(),
4145 : errmsg("could not write file \"%s\": %m", OPTS_FILE)));
4146 0 : return false;
4147 : }
4148 :
4149 979 : return true;
4150 : }
4151 :
4152 :
4153 : /*
4154 : * Start a new bgworker.
4155 : * Starting time conditions must have been checked already.
4156 : *
4157 : * Returns true on success, false on failure.
4158 : * In either case, update the RegisteredBgWorker's state appropriately.
4159 : *
4160 : * NB -- this code very roughly matches BackendStartup.
4161 : */
4162 : static bool
4163 3510 : StartBackgroundWorker(RegisteredBgWorker *rw)
4164 : {
4165 : PMChild *bn;
4166 : pid_t worker_pid;
4167 :
4168 : Assert(rw->rw_pid == 0);
4169 :
4170 : /*
4171 : * Allocate and assign the child slot. Note we must do this before
4172 : * forking, so that we can handle failures (out of memory or child-process
4173 : * slots) cleanly.
4174 : *
4175 : * Treat failure as though the worker had crashed. That way, the
4176 : * postmaster will wait a bit before attempting to start it again; if we
4177 : * tried again right away, most likely we'd find ourselves hitting the
4178 : * same resource-exhaustion condition.
4179 : */
4180 3510 : bn = AssignPostmasterChildSlot(B_BG_WORKER);
4181 3510 : if (bn == NULL)
4182 : {
4183 0 : ereport(LOG,
4184 : (errcode(ERRCODE_CONFIGURATION_LIMIT_EXCEEDED),
4185 : errmsg("no slot available for new background worker process")));
4186 0 : rw->rw_crashed_at = GetCurrentTimestamp();
4187 0 : return false;
4188 : }
4189 3510 : bn->rw = rw;
4190 3510 : bn->bkend_type = B_BG_WORKER;
4191 3510 : bn->bgworker_notify = false;
4192 :
4193 3510 : ereport(DEBUG1,
4194 : (errmsg_internal("starting background worker process \"%s\"",
4195 : rw->rw_worker.bgw_name)));
4196 :
4197 3510 : worker_pid = postmaster_child_launch(B_BG_WORKER, bn->child_slot,
4198 3510 : &rw->rw_worker, sizeof(BackgroundWorker), NULL);
4199 3510 : if (worker_pid == -1)
4200 : {
4201 : /* in postmaster, fork failed ... */
4202 0 : ereport(LOG,
4203 : (errmsg("could not fork background worker process: %m")));
4204 : /* undo what AssignPostmasterChildSlot did */
4205 0 : ReleasePostmasterChildSlot(bn);
4206 :
4207 : /* mark entry as crashed, so we'll try again later */
4208 0 : rw->rw_crashed_at = GetCurrentTimestamp();
4209 0 : return false;
4210 : }
4211 :
4212 : /* in postmaster, fork successful ... */
4213 3510 : rw->rw_pid = worker_pid;
4214 3510 : bn->pid = rw->rw_pid;
4215 3510 : ReportBackgroundWorkerPID(rw);
4216 3510 : return true;
4217 : }
4218 :
4219 : /*
4220 : * Does the current postmaster state require starting a worker with the
4221 : * specified start_time?
4222 : */
4223 : static bool
4224 4591 : bgworker_should_start_now(BgWorkerStartTime start_time)
4225 : {
4226 4591 : switch (pmState)
4227 : {
4228 0 : case PM_NO_CHILDREN:
4229 : case PM_WAIT_CHECKPOINTER:
4230 : case PM_WAIT_DEAD_END:
4231 : case PM_WAIT_XLOG_ARCHIVAL:
4232 : case PM_WAIT_XLOG_SHUTDOWN:
4233 : case PM_WAIT_IO_WORKERS:
4234 : case PM_WAIT_BACKENDS:
4235 : case PM_STOP_BACKENDS:
4236 0 : break;
4237 :
4238 3510 : case PM_RUN:
4239 3510 : if (start_time == BgWorkerStart_RecoveryFinished)
4240 1492 : return true;
4241 : pg_fallthrough;
4242 :
4243 : case PM_HOT_STANDBY:
4244 2176 : if (start_time == BgWorkerStart_ConsistentState)
4245 2018 : return true;
4246 : pg_fallthrough;
4247 :
4248 : case PM_RECOVERY:
4249 : case PM_STARTUP:
4250 : case PM_INIT:
4251 1081 : if (start_time == BgWorkerStart_PostmasterStart)
4252 0 : return true;
4253 : }
4254 :
4255 1081 : return false;
4256 : }
4257 :
4258 : /*
4259 : * If the time is right, start background worker(s).
4260 : *
4261 : * As a side effect, the bgworker control variables are set or reset
4262 : * depending on whether more workers may need to be started.
4263 : *
4264 : * We limit the number of workers started per call, to avoid consuming the
4265 : * postmaster's attention for too long when many such requests are pending.
4266 : * As long as StartWorkerNeeded is true, ServerLoop will not block and will
4267 : * call this function again after dealing with any other issues.
4268 : */
4269 : static void
4270 9494 : maybe_start_bgworkers(void)
4271 : {
4272 : #define MAX_BGWORKERS_TO_LAUNCH 100
4273 9494 : int num_launched = 0;
4274 9494 : TimestampTz now = 0;
4275 : dlist_mutable_iter iter;
4276 :
4277 : /*
4278 : * During crash recovery, we have no need to be called until the state
4279 : * transition out of recovery.
4280 : */
4281 9494 : if (FatalError)
4282 : {
4283 0 : StartWorkerNeeded = false;
4284 0 : HaveCrashedWorker = false;
4285 0 : return;
4286 : }
4287 :
4288 : /* Don't need to be called again unless we find a reason for it below */
4289 9494 : StartWorkerNeeded = false;
4290 9494 : HaveCrashedWorker = false;
4291 :
4292 25640 : dlist_foreach_modify(iter, &BackgroundWorkerList)
4293 : {
4294 : RegisteredBgWorker *rw;
4295 :
4296 16146 : rw = dlist_container(RegisteredBgWorker, rw_lnode, iter.cur);
4297 :
4298 : /* ignore if already running */
4299 16146 : if (rw->rw_pid != 0)
4300 8154 : continue;
4301 :
4302 : /* if marked for death, clean up and remove from list */
4303 7992 : if (rw->rw_terminate)
4304 : {
4305 0 : ForgetBackgroundWorker(rw);
4306 0 : continue;
4307 : }
4308 :
4309 : /*
4310 : * If this worker has crashed previously, maybe it needs to be
4311 : * restarted (unless on registration it specified it doesn't want to
4312 : * be restarted at all). Check how long ago did a crash last happen.
4313 : * If the last crash is too recent, don't start it right away; let it
4314 : * be restarted once enough time has passed.
4315 : */
4316 7992 : if (rw->rw_crashed_at != 0)
4317 : {
4318 3401 : if (rw->rw_worker.bgw_restart_time == BGW_NEVER_RESTART)
4319 0 : {
4320 : int notify_pid;
4321 :
4322 0 : notify_pid = rw->rw_worker.bgw_notify_pid;
4323 :
4324 0 : ForgetBackgroundWorker(rw);
4325 :
4326 : /* Report worker is gone now. */
4327 0 : if (notify_pid != 0)
4328 0 : kill(notify_pid, SIGUSR1);
4329 :
4330 0 : continue;
4331 : }
4332 :
4333 : /* read system time only when needed */
4334 3401 : if (now == 0)
4335 3401 : now = GetCurrentTimestamp();
4336 :
4337 3401 : if (!TimestampDifferenceExceeds(rw->rw_crashed_at, now,
4338 3401 : rw->rw_worker.bgw_restart_time * 1000))
4339 : {
4340 : /* Set flag to remember that we have workers to start later */
4341 3401 : HaveCrashedWorker = true;
4342 3401 : continue;
4343 : }
4344 : }
4345 :
4346 4591 : if (bgworker_should_start_now(rw->rw_worker.bgw_start_time))
4347 : {
4348 : /* reset crash time before trying to start worker */
4349 3510 : rw->rw_crashed_at = 0;
4350 :
4351 : /*
4352 : * Try to start the worker.
4353 : *
4354 : * On failure, give up processing workers for now, but set
4355 : * StartWorkerNeeded so we'll come back here on the next iteration
4356 : * of ServerLoop to try again. (We don't want to wait, because
4357 : * there might be additional ready-to-run workers.) We could set
4358 : * HaveCrashedWorker as well, since this worker is now marked
4359 : * crashed, but there's no need because the next run of this
4360 : * function will do that.
4361 : */
4362 3510 : if (!StartBackgroundWorker(rw))
4363 : {
4364 0 : StartWorkerNeeded = true;
4365 0 : return;
4366 : }
4367 :
4368 : /*
4369 : * If we've launched as many workers as allowed, quit, but have
4370 : * ServerLoop call us again to look for additional ready-to-run
4371 : * workers. There might not be any, but we'll find out the next
4372 : * time we run.
4373 : */
4374 3510 : if (++num_launched >= MAX_BGWORKERS_TO_LAUNCH)
4375 : {
4376 0 : StartWorkerNeeded = true;
4377 0 : return;
4378 : }
4379 : }
4380 : }
4381 : }
4382 :
4383 : static bool
4384 22934 : maybe_reap_io_worker(int pid)
4385 : {
4386 665308 : for (int i = 0; i < MAX_IO_WORKERS; ++i)
4387 : {
4388 645341 : if (io_worker_children[i] &&
4389 63899 : io_worker_children[i]->pid == pid)
4390 : {
4391 2967 : ReleasePostmasterChildSlot(io_worker_children[i]);
4392 :
4393 2967 : --io_worker_count;
4394 2967 : io_worker_children[i] = NULL;
4395 2967 : return true;
4396 : }
4397 : }
4398 19967 : return false;
4399 : }
4400 :
4401 : /*
4402 : * Start or stop IO workers, to close the gap between the number of running
4403 : * workers and the number of configured workers. Used to respond to change of
4404 : * the io_workers GUC (by increasing and decreasing the number of workers), as
4405 : * well as workers terminating in response to errors (by starting
4406 : * "replacement" workers).
4407 : */
4408 : static void
4409 184198 : maybe_adjust_io_workers(void)
4410 : {
4411 184198 : if (!pgaio_workers_enabled())
4412 114 : return;
4413 :
4414 : /*
4415 : * If we're in final shutting down state, then we're just waiting for all
4416 : * processes to exit.
4417 : */
4418 184084 : if (pmState >= PM_WAIT_IO_WORKERS)
4419 4358 : return;
4420 :
4421 : /* Don't start new workers during an immediate shutdown either. */
4422 179726 : if (Shutdown >= ImmediateShutdown)
4423 2655 : return;
4424 :
4425 : /*
4426 : * Don't start new workers if we're in the shutdown phase of a crash
4427 : * restart. But we *do* need to start if we're already starting up again.
4428 : */
4429 177071 : if (FatalError && pmState >= PM_STOP_BACKENDS)
4430 52 : return;
4431 :
4432 : Assert(pmState < PM_WAIT_IO_WORKERS);
4433 :
4434 : /* Not enough running? */
4435 179998 : while (io_worker_count < io_workers)
4436 : {
4437 : PMChild *child;
4438 : int i;
4439 :
4440 : /* find unused entry in io_worker_children array */
4441 6421 : for (i = 0; i < MAX_IO_WORKERS; ++i)
4442 : {
4443 6421 : if (io_worker_children[i] == NULL)
4444 2979 : break;
4445 : }
4446 2979 : if (i == MAX_IO_WORKERS)
4447 0 : elog(ERROR, "could not find a free IO worker slot");
4448 :
4449 : /* Try to launch one. */
4450 2979 : child = StartChildProcess(B_IO_WORKER);
4451 2979 : if (child != NULL)
4452 : {
4453 2979 : io_worker_children[i] = child;
4454 2979 : ++io_worker_count;
4455 : }
4456 : else
4457 0 : break; /* try again next time */
4458 : }
4459 :
4460 : /* Too many running? */
4461 177019 : if (io_worker_count > io_workers)
4462 : {
4463 : /* ask the IO worker in the highest slot to exit */
4464 1315 : for (int i = MAX_IO_WORKERS - 1; i >= 0; --i)
4465 : {
4466 1315 : if (io_worker_children[i] != NULL)
4467 : {
4468 87 : kill(io_worker_children[i]->pid, SIGUSR2);
4469 87 : break;
4470 : }
4471 : }
4472 : }
4473 : }
4474 :
4475 :
4476 : /*
4477 : * When a backend asks to be notified about worker state changes, we
4478 : * set a flag in its backend entry. The background worker machinery needs
4479 : * to know when such backends exit.
4480 : */
4481 : bool
4482 2692 : PostmasterMarkPIDForWorkerNotify(int pid)
4483 : {
4484 : dlist_iter iter;
4485 : PMChild *bp;
4486 :
4487 6603 : dlist_foreach(iter, &ActiveChildList)
4488 : {
4489 6603 : bp = dlist_container(PMChild, elem, iter.cur);
4490 6603 : if (bp->pid == pid)
4491 : {
4492 2692 : bp->bgworker_notify = true;
4493 2692 : return true;
4494 : }
4495 : }
4496 0 : return false;
4497 : }
4498 :
4499 : #ifdef WIN32
4500 :
4501 : /*
4502 : * Subset implementation of waitpid() for Windows. We assume pid is -1
4503 : * (that is, check all child processes) and options is WNOHANG (don't wait).
4504 : */
4505 : static pid_t
4506 : waitpid(pid_t pid, int *exitstatus, int options)
4507 : {
4508 : win32_deadchild_waitinfo *childinfo;
4509 : DWORD exitcode;
4510 : DWORD dwd;
4511 : ULONG_PTR key;
4512 : OVERLAPPED *ovl;
4513 :
4514 : /* Try to consume one win32_deadchild_waitinfo from the queue. */
4515 : if (!GetQueuedCompletionStatus(win32ChildQueue, &dwd, &key, &ovl, 0))
4516 : {
4517 : errno = EAGAIN;
4518 : return -1;
4519 : }
4520 :
4521 : childinfo = (win32_deadchild_waitinfo *) key;
4522 : pid = childinfo->procId;
4523 :
4524 : /*
4525 : * Remove handle from wait - required even though it's set to wait only
4526 : * once
4527 : */
4528 : UnregisterWaitEx(childinfo->waitHandle, NULL);
4529 :
4530 : if (!GetExitCodeProcess(childinfo->procHandle, &exitcode))
4531 : {
4532 : /*
4533 : * Should never happen. Inform user and set a fixed exitcode.
4534 : */
4535 : write_stderr("could not read exit code for process\n");
4536 : exitcode = 255;
4537 : }
4538 : *exitstatus = exitcode;
4539 :
4540 : /*
4541 : * Close the process handle. Only after this point can the PID can be
4542 : * recycled by the kernel.
4543 : */
4544 : CloseHandle(childinfo->procHandle);
4545 :
4546 : /*
4547 : * Free struct that was allocated before the call to
4548 : * RegisterWaitForSingleObject()
4549 : */
4550 : pfree(childinfo);
4551 :
4552 : return pid;
4553 : }
4554 :
4555 : /*
4556 : * Note! Code below executes on a thread pool! All operations must
4557 : * be thread safe! Note that elog() and friends must *not* be used.
4558 : */
4559 : static void WINAPI
4560 : pgwin32_deadchild_callback(PVOID lpParameter, BOOLEAN TimerOrWaitFired)
4561 : {
4562 : /* Should never happen, since we use INFINITE as timeout value. */
4563 : if (TimerOrWaitFired)
4564 : return;
4565 :
4566 : /*
4567 : * Post the win32_deadchild_waitinfo object for waitpid() to deal with. If
4568 : * that fails, we leak the object, but we also leak a whole process and
4569 : * get into an unrecoverable state, so there's not much point in worrying
4570 : * about that. We'd like to panic, but we can't use that infrastructure
4571 : * from this thread.
4572 : */
4573 : if (!PostQueuedCompletionStatus(win32ChildQueue,
4574 : 0,
4575 : (ULONG_PTR) lpParameter,
4576 : NULL))
4577 : write_stderr("could not post child completion status\n");
4578 :
4579 : /* Queue SIGCHLD signal. */
4580 : pg_queue_signal(SIGCHLD);
4581 : }
4582 :
4583 : /*
4584 : * Queue a waiter to signal when this child dies. The wait will be handled
4585 : * automatically by an operating system thread pool. The memory and the
4586 : * process handle will be freed by a later call to waitpid().
4587 : */
4588 : void
4589 : pgwin32_register_deadchild_callback(HANDLE procHandle, DWORD procId)
4590 : {
4591 : win32_deadchild_waitinfo *childinfo;
4592 :
4593 : childinfo = palloc_object(win32_deadchild_waitinfo);
4594 : childinfo->procHandle = procHandle;
4595 : childinfo->procId = procId;
4596 :
4597 : if (!RegisterWaitForSingleObject(&childinfo->waitHandle,
4598 : procHandle,
4599 : pgwin32_deadchild_callback,
4600 : childinfo,
4601 : INFINITE,
4602 : WT_EXECUTEONLYONCE | WT_EXECUTEINWAITTHREAD))
4603 : ereport(FATAL,
4604 : (errmsg_internal("could not register process for wait: error code %lu",
4605 : GetLastError())));
4606 : }
4607 :
4608 : #endif /* WIN32 */
4609 :
4610 : /*
4611 : * Initialize one and only handle for monitoring postmaster death.
4612 : *
4613 : * Called once in the postmaster, so that child processes can subsequently
4614 : * monitor if their parent is dead.
4615 : */
4616 : static void
4617 979 : InitPostmasterDeathWatchHandle(void)
4618 : {
4619 : #ifndef WIN32
4620 :
4621 : /*
4622 : * Create a pipe. Postmaster holds the write end of the pipe open
4623 : * (POSTMASTER_FD_OWN), and children hold the read end. Children can pass
4624 : * the read file descriptor to select() to wake up in case postmaster
4625 : * dies, or check for postmaster death with a (read() == 0). Children must
4626 : * close the write end as soon as possible after forking, because EOF
4627 : * won't be signaled in the read end until all processes have closed the
4628 : * write fd. That is taken care of in ClosePostmasterPorts().
4629 : */
4630 : Assert(MyProcPid == PostmasterPid);
4631 979 : if (pipe(postmaster_alive_fds) < 0)
4632 0 : ereport(FATAL,
4633 : (errcode_for_file_access(),
4634 : errmsg_internal("could not create pipe to monitor postmaster death: %m")));
4635 :
4636 : /* Notify fd.c that we've eaten two FDs for the pipe. */
4637 979 : ReserveExternalFD();
4638 979 : ReserveExternalFD();
4639 :
4640 : /*
4641 : * Set O_NONBLOCK to allow testing for the fd's presence with a read()
4642 : * call.
4643 : */
4644 979 : if (fcntl(postmaster_alive_fds[POSTMASTER_FD_WATCH], F_SETFL, O_NONBLOCK) == -1)
4645 0 : ereport(FATAL,
4646 : (errcode_for_socket_access(),
4647 : errmsg_internal("could not set postmaster death monitoring pipe to nonblocking mode: %m")));
4648 : #else
4649 :
4650 : /*
4651 : * On Windows, we use a process handle for the same purpose.
4652 : */
4653 : if (DuplicateHandle(GetCurrentProcess(),
4654 : GetCurrentProcess(),
4655 : GetCurrentProcess(),
4656 : &PostmasterHandle,
4657 : 0,
4658 : TRUE,
4659 : DUPLICATE_SAME_ACCESS) == 0)
4660 : ereport(FATAL,
4661 : (errmsg_internal("could not duplicate postmaster handle: error code %lu",
4662 : GetLastError())));
4663 : #endif /* WIN32 */
4664 979 : }
|
