| blob | cc0d9a05d9fd886029fd3e8223761418bb91a680 |
1 /*-------------------------------------------------------------------------
2 *
3 * xlog.c
4 * PostgreSQL write-ahead log manager
5 *
6 * The Write-Ahead Log (WAL) functionality is split into several source
7 * files, in addition to this one:
8 *
9 * xloginsert.c - Functions for constructing WAL records
10 * xlogrecovery.c - WAL recovery and standby code
11 * xlogreader.c - Facility for reading WAL files and parsing WAL records
12 * xlogutils.c - Helper functions for WAL redo routines
13 *
14 * This file contains functions for coordinating database startup and
15 * checkpointing, and managing the write-ahead log buffers when the
16 * system is running.
17 *
18 * StartupXLOG() is the main entry point of the startup process. It
19 * coordinates database startup, performing WAL recovery, and the
20 * transition from WAL recovery into normal operations.
21 *
22 * XLogInsertRecord() inserts a WAL record into the WAL buffers. Most
23 * callers should not call this directly, but use the functions in
24 * xloginsert.c to construct the WAL record. XLogFlush() can be used
25 * to force the WAL to disk.
26 *
27 * In addition to those, there are many other functions for interrogating
28 * the current system state, and for starting/stopping backups.
29 *
30 *
31 * Portions Copyright (c) 1996-2023, PostgreSQL Global Development Group
32 * Portions Copyright (c) 1994, Regents of the University of California
33 *
34 * src/backend/access/transam/xlog.c
35 *
36 *-------------------------------------------------------------------------
37 */
41 #include <ctype.h>
42 #include <math.h>
43 #include <time.h>
44 #include <fcntl.h>
45 #include <sys/stat.h>
46 #include <sys/time.h>
47 #include <unistd.h>
113 /* timeline ID to be used when bootstrapping */
114 #define BootstrapTimeLineID 1
116 /* User-settable parameters */
142 #ifdef WAL_DEBUG
144 #endif
148 /*
149 * Number of WAL insertion locks to use. A higher value allows more insertions
150 * to happen concurrently, but adds some CPU overhead to flushing the WAL,
151 * which needs to iterate all the locks.
152 */
153 #define NUM_XLOGINSERT_LOCKS 8
155 /*
156 * Max distance from last checkpoint, before triggering a new xlog-based
157 * checkpoint.
158 */
161 /* Estimated distance between checkpoints, in bytes */
165 /*
166 * Track whether there were any deferred checks for custom resource managers
167 * specified in wal_consistency_checking.
168 */
171 /*
172 * GUC support
173 */
176 #ifdef HAVE_FSYNC_WRITETHROUGH
178 #endif
180 #ifdef O_SYNC
182 #endif
183 #ifdef O_DSYNC
185 #endif
187 };
190 /*
191 * Although only "on", "off", and "always" are documented,
192 * we accept all the likely variants of "on" and "off".
193 */
205 };
207 /*
208 * Statistics for current checkpoint are collected in this global struct.
209 * Because only the checkpointer or a stand-alone backend can perform
210 * checkpoints, this will be unused in normal backends.
211 */
212 CheckpointStatsData CheckpointStats;
214 /*
215 * During recovery, lastFullPageWrites keeps track of full_page_writes that
216 * the replayed WAL records indicate. It's initialized with full_page_writes
217 * that the recovery starting checkpoint record indicates, and then updated
218 * each time XLOG_FPW_CHANGE record is replayed.
219 */
222 /*
223 * Local copy of the state tracked by SharedRecoveryState in shared memory,
224 * It is false if SharedRecoveryState is RECOVERY_STATE_DONE. True actually
225 * means "not known, need to check the shared state".
226 */
229 /*
230 * Local state for XLogInsertAllowed():
231 * 1: unconditionally allowed to insert XLOG
232 * 0: unconditionally not allowed to insert XLOG
233 * -1: must check RecoveryInProgress(); disallow until it is false
234 * Most processes start with -1 and transition to 1 after seeing that recovery
235 * is not in progress. But we can also force the value for special cases.
236 * The coding in XLogInsertAllowed() depends on the first two of these states
237 * being numerically the same as bool true and false.
238 */
241 /*
242 * ProcLastRecPtr points to the start of the last XLOG record inserted by the
243 * current backend. It is updated for all inserts. XactLastRecEnd points to
244 * end+1 of the last record, and is reset when we end a top-level transaction,
245 * or start a new one; so it can be used to tell if the current transaction has
246 * created any XLOG records.
247 *
248 * While in parallel mode, this may not be fully up to date. When committing,
249 * a transaction can assume this covers all xlog records written either by the
250 * user backend or by any parallel worker which was present at any point during
251 * the transaction. But when aborting, or when still in parallel mode, other
252 * parallel backends may have written WAL records at later LSNs than the value
253 * stored here. The parallel leader advances its own copy, when necessary,
254 * in WaitForParallelWorkersToFinish.
255 */
260 /*
261 * RedoRecPtr is this backend's local copy of the REDO record pointer
262 * (which is almost but not quite the same as a pointer to the most recent
263 * CHECKPOINT record). We update this from the shared-memory copy,
264 * XLogCtl->Insert.RedoRecPtr, whenever we can safely do so (ie, when we
265 * hold an insertion lock). See XLogInsertRecord for details. We are also
266 * allowed to update from XLogCtl->RedoRecPtr if we hold the info_lck;
267 * see GetRedoRecPtr.
268 *
269 * NB: Code that uses this variable must be prepared not only for the
270 * possibility that it may be arbitrarily out of date, but also for the
271 * possibility that it might be set to InvalidXLogRecPtr. We used to
272 * initialize it as a side effect of the first call to RecoveryInProgress(),
273 * which meant that most code that might use it could assume that it had a
274 * real if perhaps stale value. That's no longer the case.
275 */
278 /*
279 * doPageWrites is this backend's local copy of (fullPageWrites ||
280 * runningBackups > 0). It is used together with RedoRecPtr to decide whether
281 * a full-page image of a page need to be taken.
282 *
283 * NB: Initially this is false, and there's no guarantee that it will be
284 * initialized to any other value before it is first used. Any code that
285 * makes use of it must recheck the value after obtaining a WALInsertLock,
286 * and respond appropriately if it turns out that the previous value wasn't
287 * accurate.
288 */
291 /*----------
292 * Shared-memory data structures for XLOG control
293 *
294 * LogwrtRqst indicates a byte position that we need to write and/or fsync
295 * the log up to (all records before that point must be written or fsynced).
296 * LogwrtResult indicates the byte positions we have already written/fsynced.
297 * These structs are identical but are declared separately to indicate their
298 * slightly different functions.
299 *
300 * To read XLogCtl->LogwrtResult, you must hold either info_lck or
301 * WALWriteLock. To update it, you need to hold both locks. The point of
302 * this arrangement is that the value can be examined by code that already
303 * holds WALWriteLock without needing to grab info_lck as well. In addition
304 * to the shared variable, each backend has a private copy of LogwrtResult,
305 * which is updated when convenient.
306 *
307 * The request bookkeeping is simpler: there is a shared XLogCtl->LogwrtRqst
308 * (protected by info_lck), but we don't need to cache any copies of it.
309 *
310 * info_lck is only held long enough to read/update the protected variables,
311 * so it's a plain spinlock. The other locks are held longer (potentially
312 * over I/O operations), so we use LWLocks for them. These locks are:
313 *
314 * WALBufMappingLock: must be held to replace a page in the WAL buffer cache.
315 * It is only held while initializing and changing the mapping. If the
316 * contents of the buffer being replaced haven't been written yet, the mapping
317 * lock is released while the write is done, and reacquired afterwards.
318 *
319 * WALWriteLock: must be held to write WAL buffers to disk (XLogWrite or
320 * XLogFlush).
321 *
322 * ControlFileLock: must be held to read/update control file or create
323 * new log file.
324 *
325 *----------
326 */
329 {
335 {
340 /*
341 * Inserting to WAL is protected by a small fixed number of WAL insertion
342 * locks. To insert to the WAL, you must hold one of the locks - it doesn't
343 * matter which one. To lock out other concurrent insertions, you must hold
344 * of them. Each WAL insertion lock consists of a lightweight lock, plus an
345 * indicator of how far the insertion has progressed (insertingAt).
346 *
347 * The insertingAt values are read when a process wants to flush WAL from
348 * the in-memory buffers to disk, to check that all the insertions to the
349 * region the process is about to write out have finished. You could simply
350 * wait for all currently in-progress insertions to finish, but the
351 * insertingAt indicator allows you to ignore insertions to later in the WAL,
352 * so that you only wait for the insertions that are modifying the buffers
353 * you're about to write out.
354 *
355 * This isn't just an optimization. If all the WAL buffers are dirty, an
356 * inserter that's holding a WAL insert lock might need to evict an old WAL
357 * buffer, which requires flushing the WAL. If it's possible for an inserter
358 * to block on another inserter unnecessarily, deadlock can arise when two
359 * inserters holding a WAL insert lock wait for each other to finish their
360 * insertion.
361 *
362 * Small WAL records that don't cross a page boundary never update the value,
363 * the WAL record is just copied to the page and the lock is released. But
364 * to avoid the deadlock-scenario explained above, the indicator is always
365 * updated before sleeping while holding an insertion lock.
366 *
367 * lastImportantAt contains the LSN of the last important WAL record inserted
368 * using a given lock. This value is used to detect if there has been
369 * important WAL activity since the last time some action, like a checkpoint,
370 * was performed - allowing to not repeat the action if not. The LSN is
371 * updated for all insertions, unless the XLOG_MARK_UNIMPORTANT flag was
372 * set. lastImportantAt is never cleared, only overwritten by the LSN of newer
373 * records. Tracking the WAL activity directly in WALInsertLock has the
374 * advantage of not needing any additional locks to update the value.
375 */
377 {
378 LWLock lock;
379 XLogRecPtr insertingAt;
380 XLogRecPtr lastImportantAt;
383 /*
384 * All the WAL insertion locks are allocated as an array in shared memory. We
385 * force the array stride to be a power of 2, which saves a few cycles in
386 * indexing, but more importantly also ensures that individual slots don't
387 * cross cache line boundaries. (Of course, we have to also ensure that the
388 * array start address is suitably aligned.)
389 */
391 {
392 WALInsertLock l;
396 /*
397 * Session status of running backup, used for sanity checks in SQL-callable
398 * functions to start and stop backups.
399 */
402 /*
403 * Shared state data for WAL insertion.
404 */
406 {
409 /*
410 * CurrBytePos is the end of reserved WAL. The next record will be
411 * inserted at that position. PrevBytePos is the start position of the
412 * previously inserted (or rather, reserved) record - it is copied to the
413 * prev-link of the next record. These are stored as "usable byte
414 * positions" rather than XLogRecPtrs (see XLogBytePosToRecPtr()).
415 */
416 uint64 CurrBytePos;
417 uint64 PrevBytePos;
419 /*
420 * Make sure the above heavily-contended spinlock and byte positions are
421 * on their own cache line. In particular, the RedoRecPtr and full page
422 * write variables below should be on a different cache line. They are
423 * read on every WAL insertion, but updated rarely, and we don't want
424 * those reads to steal the cache line containing Curr/PrevBytePos.
425 */
428 /*
429 * fullPageWrites is the authoritative value used by all backends to
430 * determine whether to write full-page image to WAL. This shared value,
431 * instead of the process-local fullPageWrites, is required because, when
432 * full_page_writes is changed by SIGHUP, we must WAL-log it before it
433 * actually affects WAL-logging by backends. Checkpointer sets at startup
434 * or after SIGHUP.
435 *
436 * To read these fields, you must hold an insertion lock. To modify them,
437 * you must hold ALL the locks.
438 */
442 /*
443 * runningBackups is a counter indicating the number of backups currently
444 * in progress. lastBackupStart is the latest checkpoint redo location
445 * used as a starting point for an online backup.
446 */
448 XLogRecPtr lastBackupStart;
450 /*
451 * WAL insertion locks.
452 */
456 /*
457 * Total shared-memory state for XLOG.
458 */
460 {
461 XLogCtlInsert Insert;
463 /* Protected by info_lck: */
464 XLogwrtRqst LogwrtRqst;
472 /* Fake LSN counter, for unlogged relations. Protected by ulsn_lck. */
473 XLogRecPtr unloggedLSN;
474 slock_t ulsn_lck;
476 /* Time and LSN of last xlog segment switch. Protected by WALWriteLock. */
477 pg_time_t lastSegSwitchTime;
478 XLogRecPtr lastSegSwitchLSN;
480 /*
481 * Protected by info_lck and WALWriteLock (you must hold either lock to
482 * read it, but both to update)
483 */
484 XLogwrtResult LogwrtResult;
486 /*
487 * Latest initialized page in the cache (last byte position + 1).
488 *
489 * To change the identity of a buffer (and InitializedUpTo), you need to
490 * hold WALBufMappingLock. To change the identity of a buffer that's
491 * still dirty, the old page needs to be written out first, and for that
492 * you need WALWriteLock, and you need to ensure that there are no
493 * in-progress insertions to the page by calling
494 * WaitXLogInsertionsToFinish().
495 */
496 XLogRecPtr InitializedUpTo;
498 /*
499 * These values do not change after startup, although the pointed-to pages
500 * and xlblocks values certainly do. xlblocks values are protected by
501 * WALBufMappingLock.
502 */
507 /*
508 * InsertTimeLineID is the timeline into which new WAL is being inserted
509 * and flushed. It is zero during recovery, and does not change once set.
510 *
511 * If we create a new timeline when the system was started up,
512 * PrevTimeLineID is the old timeline's ID that we forked off from.
513 * Otherwise it's equal to InsertTimeLineID.
514 */
515 TimeLineID InsertTimeLineID;
516 TimeLineID PrevTimeLineID;
518 /*
519 * SharedRecoveryState indicates if we're still in crash or archive
520 * recovery. Protected by info_lck.
521 */
522 RecoveryState SharedRecoveryState;
524 /*
525 * InstallXLogFileSegmentActive indicates whether the checkpointer should
526 * arrange for future segments by recycling and/or PreallocXlogFiles().
527 * Protected by ControlFileLock. Only the startup process changes it. If
528 * true, anyone can use InstallXLogFileSegment(). If false, the startup
529 * process owns the exclusive right to install segments, by reading from
530 * the archive and possibly replacing existing files.
531 */
534 /*
535 * WalWriterSleeping indicates whether the WAL writer is currently in
536 * low-power mode (and hence should be nudged if an async commit occurs).
537 * Protected by info_lck.
538 */
541 /*
542 * During recovery, we keep a copy of the latest checkpoint record here.
543 * lastCheckPointRecPtr points to start of checkpoint record and
544 * lastCheckPointEndPtr points to end+1 of checkpoint record. Used by the
545 * checkpointer when it wants to create a restartpoint.
546 *
547 * Protected by info_lck.
548 */
549 XLogRecPtr lastCheckPointRecPtr;
550 XLogRecPtr lastCheckPointEndPtr;
551 CheckPoint lastCheckPoint;
553 /*
554 * lastFpwDisableRecPtr points to the start of the last replayed
555 * XLOG_FPW_CHANGE record that instructs full_page_writes is disabled.
556 */
557 XLogRecPtr lastFpwDisableRecPtr;
564 /* a private copy of XLogCtl->Insert.WALInsertLocks, for convenience */
567 /*
568 * We maintain an image of pg_control in shared memory.
569 */
572 /*
573 * Calculate the amount of space left on the page after 'endptr'. Beware
574 * multiple evaluation!
575 */
576 #define INSERT_FREESPACE(endptr) \
577 (((endptr) % XLOG_BLCKSZ == 0) ? 0 : (XLOG_BLCKSZ - (endptr) % XLOG_BLCKSZ))
579 /* Macro to advance to next buffer index. */
580 #define NextBufIdx(idx) \
581 (((idx) == XLogCtl->XLogCacheBlck) ? 0 : ((idx) + 1))
583 /*
584 * XLogRecPtrToBufIdx returns the index of the WAL buffer that holds, or
585 * would hold if it was in cache, the page containing 'recptr'.
586 */
587 #define XLogRecPtrToBufIdx(recptr) \
588 (((recptr) / XLOG_BLCKSZ) % (XLogCtl->XLogCacheBlck + 1))
590 /*
591 * These are the number of bytes in a WAL page usable for WAL data.
592 */
593 #define UsableBytesInPage (XLOG_BLCKSZ - SizeOfXLogShortPHD)
595 /*
596 * Convert values of GUCs measured in megabytes to equiv. segment count.
597 * Rounds down.
598 */
599 #define ConvertToXSegs(x, segsize) XLogMBVarToSegs((x), (segsize))
601 /* The number of bytes in a WAL segment usable for WAL data. */
604 /*
605 * Private, possibly out-of-date copy of shared LogwrtResult.
606 * See discussion above.
607 */
610 /*
611 * openLogFile is -1 or a kernel FD for an open log file segment.
612 * openLogSegNo identifies the segment, and openLogTLI the corresponding TLI.
613 * These variables are only used to write the XLOG, and so will normally refer
614 * to the active segment.
615 *
616 * Note: call Reserve/ReleaseExternalFD to track consumption of this FD.
617 */
622 /*
623 * Local copies of equivalent fields in the control file. When running
624 * crash recovery, LocalMinRecoveryPoint is set to InvalidXLogRecPtr as we
625 * expect to replay all the WAL available, and updateMinRecoveryPoint is
626 * switched to false to prevent any updates while replaying records.
627 * Those values are kept consistent as long as crash recovery runs.
628 */
633 /* For WALInsertLockAcquire/Release functions */
637 #ifdef WAL_DEBUG
639 #endif
642 XLogRecPtr EndOfLog,
643 TimeLineID newTLI);
649 XLogRecPtr pagePtr,
650 TimeLineID newTLI);
660 TimeLineID tli);
668 TimeLineID insertTLI);
685 TimeLineID tli);
702 /*
703 * Insert an XLOG record represented by an already-constructed chain of data
704 * chunks. This is a low-level routine; to construct the WAL record header
705 * and data, use the higher-level routines in xloginsert.c.
706 *
707 * If 'fpw_lsn' is valid, it is the oldest LSN among the pages that this
708 * WAL record applies to, that were not included in the record as full page
709 * images. If fpw_lsn <= RedoRecPtr, the function does not perform the
710 * insertion and returns InvalidXLogRecPtr. The caller can then recalculate
711 * which pages need a full-page image, and retry. If fpw_lsn is invalid, the
712 * record is always inserted.
713 *
714 * 'flags' gives more in-depth control on the record being inserted. See
715 * XLogSetRecordFlags() for details.
716 *
717 * 'topxid_included' tells whether the top-transaction id is logged along with
718 * current subtransaction. See XLogRecordAssemble().
719 *
720 * The first XLogRecData in the chain must be for the record header, and its
721 * data must be MAXALIGNed. XLogInsertRecord fills in the xl_prev and
722 * xl_crc fields in the header, the rest of the header must already be filled
723 * by the caller.
724 *
725 * Returns XLOG pointer to end of record (beginning of next record).
726 * This can be used as LSN for data pages affected by the logged action.
727 * (LSN is the XLOG point up to which the XLOG must be flushed to disk
728 * before the data page can be written out. This implements the basic
729 * WAL rule "write the log before the data".)
730 */
731 XLogRecPtr
733 XLogRecPtr fpw_lsn,
734 uint8 flags,
737 {
739 pg_crc32c rdata_crc;
745 XLogRecPtr StartPos;
746 XLogRecPtr EndPos;
748 TimeLineID insertTLI;
750 /* we assume that all of the record header is in the first chunk */
753 /* cross-check on whether we should be here or not */
757 /*
758 * Given that we're not in recovery, InsertTimeLineID is set and can't
759 * change, so we can read it without a lock.
760 */
763 /*----------
764 *
765 * We have now done all the preparatory work we can without holding a
766 * lock or modifying shared state. From here on, inserting the new WAL
767 * record to the shared WAL buffer cache is a two-step process:
768 *
769 * 1. Reserve the right amount of space from the WAL. The current head of
770 * reserved space is kept in Insert->CurrBytePos, and is protected by
771 * insertpos_lck.
772 *
773 * 2. Copy the record to the reserved WAL space. This involves finding the
774 * correct WAL buffer containing the reserved space, and copying the
775 * record in place. This can be done concurrently in multiple processes.
776 *
777 * To keep track of which insertions are still in-progress, each concurrent
778 * inserter acquires an insertion lock. In addition to just indicating that
779 * an insertion is in progress, the lock tells others how far the inserter
780 * has progressed. There is a small fixed number of insertion locks,
781 * determined by NUM_XLOGINSERT_LOCKS. When an inserter crosses a page
782 * boundary, it updates the value stored in the lock to the how far it has
783 * inserted, to allow the previous buffer to be flushed.
784 *
785 * Holding onto an insertion lock also protects RedoRecPtr and
786 * fullPageWrites from changing until the insertion is finished.
787 *
788 * Step 2 can usually be done completely in parallel. If the required WAL
789 * page is not initialized yet, you have to grab WALBufMappingLock to
790 * initialize it, but the WAL writer tries to do that ahead of insertions
791 * to avoid that from happening in the critical path.
792 *
793 *----------
794 */
798 else
801 /*
802 * Check to see if my copy of RedoRecPtr is out of date. If so, may have
803 * to go back and have the caller recompute everything. This can only
804 * happen just after a checkpoint, so it's better to be slow in this case
805 * and fast otherwise.
806 *
807 * Also check to see if fullPageWrites was just turned on or there's a
808 * running backup (which forces full-page writes); if we weren't already
809 * doing full-page writes then go back and recompute.
810 *
811 * If we aren't doing full-page writes then RedoRecPtr doesn't actually
812 * affect the contents of the XLOG record, so we'll update our local copy
813 * but not force a recomputation. (If doPageWrites was just turned off,
814 * we could recompute the record without full pages, but we choose not to
815 * bother.)
816 */
818 {
821 }
827 {
828 /*
829 * Oops, some buffer now needs to be backed up that the caller didn't
830 * back up. Start over.
831 */
835 }
837 /*
838 * Reserve space for the record in the WAL. This also sets the xl_prev
839 * pointer.
840 */
843 else
844 {
848 }
851 {
852 /*
853 * Now that xl_prev has been filled in, calculate CRC of the record
854 * header.
855 */
861 /*
862 * All the record data, including the header, is now ready to be
863 * inserted. Copy the record in the space reserved.
864 */
868 /*
869 * Unless record is flagged as not important, update LSN of last
870 * important record in the current slot. When holding all locks, just
871 * update the first one.
872 */
874 {
878 }
879 }
880 else
881 {
882 /*
883 * This was an xlog-switch record, but the current insert location was
884 * already exactly at the beginning of a segment, so there was no need
885 * to do anything.
886 */
887 }
889 /*
890 * Done! Let others know that we're finished.
891 */
898 /*
899 * Mark top transaction id is logged (if needed) so that we should not try
900 * to log it again with the next WAL record in the current subtransaction.
901 */
905 /*
906 * Update shared LogwrtRqst.Write, if we crossed page boundary.
907 */
909 {
911 /* advance global request to include new block(s) */
914 /* update local result copy while I have the chance */
917 }
919 /*
920 * If this was an XLOG_SWITCH record, flush the record and the empty
921 * padding space that fills the rest of the segment, and perform
922 * end-of-segment actions (eg, notifying archiver).
923 */
925 {
929 /*
930 * Even though we reserved the rest of the segment for us, which is
931 * reflected in EndPos, we return a pointer to just the end of the
932 * xlog-switch record.
933 */
935 {
938 {
943 else
945 }
946 }
947 }
949 #ifdef WAL_DEBUG
951 {
955 StringInfoData buf;
956 StringInfoData recordBuf;
958 MemoryContext oldCxt;
965 /*
966 * We have to piece together the WAL record data from the XLogRecData
967 * entries, so that we can pass it to the rm_desc function as one
968 * contiguous chunk.
969 */
974 /* We also need temporary space to decode the record. */
984 {
985 appendStringInfoString(&buf, "error decoding record: out of memory while allocating a WAL reading processor");
986 }
988 decoded,
989 record,
990 EndPos,
992 {
995 }
996 else
997 {
1003 }
1010 }
1011 #endif
1013 /*
1014 * Update our global variables
1015 */
1019 /* Report WAL traffic to the instrumentation. */
1021 {
1025 }
1028 }
1030 /*
1031 * Reserves the right amount of space for a record of given size from the WAL.
1032 * *StartPos is set to the beginning of the reserved section, *EndPos to
1033 * its end+1. *PrevPtr is set to the beginning of the previous record; it is
1034 * used to set the xl_prev of this record.
1035 *
1036 * This is the performance critical part of XLogInsert that must be serialized
1037 * across backends. The rest can happen mostly in parallel. Try to keep this
1038 * section as short as possible, insertpos_lck can be heavily contended on a
1039 * busy system.
1040 *
1041 * NB: The space calculation here must match the code in CopyXLogRecordToWAL,
1042 * where we actually copy the record to the reserved space.
1043 */
1044 static void
1047 {
1049 uint64 startbytepos;
1050 uint64 endbytepos;
1051 uint64 prevbytepos;
1055 /* All (non xlog-switch) records should contain data. */
1058 /*
1059 * The duration the spinlock needs to be held is minimized by minimizing
1060 * the calculations that have to be done while holding the lock. The
1061 * current tip of reserved WAL is kept in CurrBytePos, as a byte position
1062 * that only counts "usable" bytes in WAL, that is, it excludes all WAL
1063 * page headers. The mapping between "usable" byte positions and physical
1064 * positions (XLogRecPtrs) can be done outside the locked region, and
1065 * because the usable byte position doesn't include any headers, reserving
1066 * X bytes from WAL is almost as simple as "CurrBytePos += X".
1067 */
1082 /*
1083 * Check that the conversions between "usable byte positions" and
1084 * XLogRecPtrs work consistently in both directions.
1085 */
1089 }
1091 /*
1092 * Like ReserveXLogInsertLocation(), but for an xlog-switch record.
1093 *
1094 * A log-switch record is handled slightly differently. The rest of the
1095 * segment will be reserved for this insertion, as indicated by the returned
1096 * *EndPos value. However, if we are already at the beginning of the current
1097 * segment, *StartPos and *EndPos are set to the current location without
1098 * reserving any space, and the function returns false.
1099 */
1100 static bool
1102 {
1104 uint64 startbytepos;
1105 uint64 endbytepos;
1106 uint64 prevbytepos;
1108 XLogRecPtr ptr;
1109 uint32 segleft;
1111 /*
1112 * These calculations are a bit heavy-weight to be done while holding a
1113 * spinlock, but since we're holding all the WAL insertion locks, there
1114 * are no other inserters competing for it. GetXLogInsertRecPtr() does
1115 * compete for it, but that's not called very frequently.
1116 */
1123 {
1127 }
1137 {
1138 /* consume the rest of the segment */
1141 }
1155 }
1157 /*
1158 * Subroutine of XLogInsertRecord. Copies a WAL record to an already-reserved
1159 * area in the WAL.
1160 */
1161 static void
1164 {
1168 XLogRecPtr CurrPos;
1169 XLogPageHeader pagehdr;
1171 /*
1172 * Get a pointer to the right place in the right WAL buffer to start
1173 * inserting to.
1174 */
1179 /*
1180 * there should be enough space for at least the first field (xl_tot_len)
1181 * on this page.
1182 */
1185 /* Copy record data */
1188 {
1193 {
1194 /*
1195 * Write what fits on this page, and continue on the next page.
1196 */
1204 /*
1205 * Get pointer to beginning of next page, and set the xlp_rem_len
1206 * in the page header. Set XLP_FIRST_IS_CONTRECORD.
1207 *
1208 * It's safe to set the contrecord flag and xlp_rem_len without a
1209 * lock on the page. All the other flags were already set when the
1210 * page was initialized, in AdvanceXLInsertBuffer, and we're the
1211 * only backend that needs to set the contrecord flag.
1212 */
1218 /* skip over the page header */
1220 {
1223 }
1224 else
1225 {
1228 }
1230 }
1240 }
1243 /*
1244 * If this was an xlog-switch, it's not enough to write the switch record,
1245 * we also have to consume all the remaining space in the WAL segment. We
1246 * have already reserved that space, but we need to actually fill it.
1247 */
1249 {
1250 /* An xlog-switch record doesn't contain any data besides the header */
1253 /* Assert that we did reserve the right amount of space */
1256 /* Use up all the remaining space on the current page */
1259 /*
1260 * Cause all remaining pages in the segment to be flushed, leaving the
1261 * XLog position where it should be, at the start of the next segment.
1262 * We do this one page at a time, to make sure we don't deadlock
1263 * against ourselves if wal_buffers < wal_segment_size.
1264 */
1266 {
1267 /*
1268 * The minimal action to flush the page would be to call
1269 * WALInsertLockUpdateInsertingAt(CurrPos) followed by
1270 * AdvanceXLInsertBuffer(...). The page would be left initialized
1271 * mostly to zeros, except for the page header (always the short
1272 * variant, as this is never a segment's first page).
1273 *
1274 * The large vistas of zeros are good for compressibility, but the
1275 * headers interrupting them every XLOG_BLCKSZ (with values that
1276 * differ from page to page) are not. The effect varies with
1277 * compression tool, but bzip2 for instance compresses about an
1278 * order of magnitude worse if those headers are left in place.
1279 *
1280 * Rather than complicating AdvanceXLInsertBuffer itself (which is
1281 * called in heavily-loaded circumstances as well as this lightly-
1282 * loaded one) with variant behavior, we just use GetXLogBuffer
1283 * (which itself calls the two methods we need) to get the pointer
1284 * and zero most of the page. Then we just zero the page header.
1285 */
1290 }
1291 }
1292 else
1293 {
1294 /* Align the end position, so that the next record starts aligned */
1296 }
1300 }
1302 /*
1303 * Acquire a WAL insertion lock, for inserting to WAL.
1304 */
1305 static void
1307 {
1310 /*
1311 * It doesn't matter which of the WAL insertion locks we acquire, so try
1312 * the one we used last time. If the system isn't particularly busy, it's
1313 * a good bet that it's still available, and it's good to have some
1314 * affinity to a particular lock so that you don't unnecessarily bounce
1315 * cache lines between processes when there's no contention.
1316 *
1317 * If this is the first time through in this backend, pick a lock
1318 * (semi-)randomly. This allows the locks to be used evenly if you have a
1319 * lot of very short connections.
1320 */
1327 /*
1328 * The insertingAt value is initially set to 0, as we don't know our
1329 * insert location yet.
1330 */
1333 {
1334 /*
1335 * If we couldn't get the lock immediately, try another lock next
1336 * time. On a system with more insertion locks than concurrent
1337 * inserters, this causes all the inserters to eventually migrate to a
1338 * lock that no-one else is using. On a system with more inserters
1339 * than locks, it still helps to distribute the inserters evenly
1340 * across the locks.
1341 */
1343 }
1344 }
1346 /*
1347 * Acquire all WAL insertion locks, to prevent other backends from inserting
1348 * to WAL.
1349 */
1350 static void
1352 {
1355 /*
1356 * When holding all the locks, all but the last lock's insertingAt
1357 * indicator is set to 0xFFFFFFFFFFFFFFFF, which is higher than any real
1358 * XLogRecPtr value, to make sure that no-one blocks waiting on those.
1359 */
1361 {
1365 PG_UINT64_MAX);
1366 }
1367 /* Variable value reset to 0 at release */
1371 }
1373 /*
1374 * Release our insertion lock (or locks, if we're holding them all).
1375 *
1376 * NB: Reset all variables to 0, so they cause LWLockWaitForVar to block the
1377 * next time the lock is acquired.
1378 */
1379 static void
1381 {
1383 {
1392 }
1393 else
1394 {
1398 }
1399 }
1401 /*
1402 * Update our insertingAt value, to let others know that we've finished
1403 * inserting up to that point.
1404 */
1405 static void
1407 {
1409 {
1410 /*
1411 * We use the last lock to mark our actual position, see comments in
1412 * WALInsertLockAcquireExclusive.
1413 */
1416 insertingAt);
1417 }
1418 else
1421 insertingAt);
1422 }
1424 /*
1425 * Wait for any WAL insertions < upto to finish.
1426 *
1427 * Returns the location of the oldest insertion that is still in-progress.
1428 * Any WAL prior to that point has been fully copied into WAL buffers, and
1429 * can be flushed out to disk. Because this waits for any insertions older
1430 * than 'upto' to finish, the return value is always >= 'upto'.
1431 *
1432 * Note: When you are about to write out WAL, you must call this function
1433 * *before* acquiring WALWriteLock, to avoid deadlocks. This function might
1434 * need to wait for an insertion to finish (or at least advance to next
1435 * uninitialized page), and the inserter might need to evict an old WAL buffer
1436 * to make room for a new one, which in turn requires WALWriteLock.
1437 */
1438 static XLogRecPtr
1440 {
1441 uint64 bytepos;
1442 XLogRecPtr reservedUpto;
1443 XLogRecPtr finishedUpto;
1450 /* Read the current insert position */
1456 /*
1457 * No-one should request to flush a piece of WAL that hasn't even been
1458 * reserved yet. However, it can happen if there is a block with a bogus
1459 * LSN on disk, for example. XLogFlush checks for that situation and
1460 * complains, but only after the flush. Here we just assume that to mean
1461 * that all WAL that has been reserved needs to be finished. In this
1462 * corner-case, the return value can be smaller than 'upto' argument.
1463 */
1465 {
1470 }
1472 /*
1473 * Loop through all the locks, sleeping on any in-progress insert older
1474 * than 'upto'.
1475 *
1476 * finishedUpto is our return value, indicating the point upto which all
1477 * the WAL insertions have been finished. Initialize it to the head of
1478 * reserved WAL, and as we iterate through the insertion locks, back it
1479 * out for any insertion that's still in progress.
1480 */
1483 {
1486 do
1487 {
1488 /*
1489 * See if this insertion is in progress. LWLockWaitForVar will
1490 * wait for the lock to be released, or for the 'value' to be set
1491 * by a LWLockUpdateVar call. When a lock is initially acquired,
1492 * its value is 0 (InvalidXLogRecPtr), which means that we don't
1493 * know where it's inserting yet. We will have to wait for it. If
1494 * it's a small insertion, the record will most likely fit on the
1495 * same page and the inserter will release the lock without ever
1496 * calling LWLockUpdateVar. But if it has to sleep, it will
1497 * advertise the insertion point with LWLockUpdateVar before
1498 * sleeping.
1499 */
1503 {
1504 /* the lock was free, so no insertion in progress */
1507 }
1509 /*
1510 * This insertion is still in progress. Have to wait, unless the
1511 * inserter has proceeded past 'upto'.
1512 */
1517 }
1519 }
1521 /*
1522 * Get a pointer to the right location in the WAL buffer containing the
1523 * given XLogRecPtr.
1524 *
1525 * If the page is not initialized yet, it is initialized. That might require
1526 * evicting an old dirty buffer from the buffer cache, which means I/O.
1527 *
1528 * The caller must ensure that the page containing the requested location
1529 * isn't evicted yet, and won't be evicted. The way to ensure that is to
1530 * hold onto a WAL insertion lock with the insertingAt position set to
1531 * something <= ptr. GetXLogBuffer() will update insertingAt if it needs
1532 * to evict an old page from the buffer. (This means that once you call
1533 * GetXLogBuffer() with a given 'ptr', you must not access anything before
1534 * that point anymore, and must not call GetXLogBuffer() with an older 'ptr'
1535 * later, because older buffers might be recycled already)
1536 */
1539 {
1541 XLogRecPtr endptr;
1544 XLogRecPtr expectedEndPtr;
1546 /*
1547 * Fast path for the common case that we need to access again the same
1548 * page as last time.
1549 */
1551 {
1555 }
1557 /*
1558 * The XLog buffer cache is organized so that a page is always loaded to a
1559 * particular buffer. That way we can easily calculate the buffer a given
1560 * page must be loaded into, from the XLogRecPtr alone.
1561 */
1564 /*
1565 * See what page is loaded in the buffer at the moment. It could be the
1566 * page we're looking for, or something older. It can't be anything newer
1567 * - that would imply the page we're looking for has already been written
1568 * out to disk and evicted, and the caller is responsible for making sure
1569 * that doesn't happen.
1570 *
1571 * However, we don't hold a lock while we read the value. If someone has
1572 * just initialized the page, it's possible that we get a "torn read" of
1573 * the XLogRecPtr if 64-bit fetches are not atomic on this platform. In
1574 * that case we will see a bogus value. That's ok, we'll grab the mapping
1575 * lock (in AdvanceXLInsertBuffer) and retry if we see anything else than
1576 * the page we're looking for. But it means that when we do this unlocked
1577 * read, we might see a value that appears to be ahead of the page we're
1578 * looking for. Don't PANIC on that, until we've verified the value while
1579 * holding the lock.
1580 */
1586 {
1587 XLogRecPtr initializedUpto;
1589 /*
1590 * Before calling AdvanceXLInsertBuffer(), which can block, let others
1591 * know how far we're finished with inserting the record.
1592 *
1593 * NB: If 'ptr' points to just after the page header, advertise a
1594 * position at the beginning of the page rather than 'ptr' itself. If
1595 * there are no other insertions running, someone might try to flush
1596 * up to our advertised location. If we advertised a position after
1597 * the page header, someone might try to flush the page header, even
1598 * though page might actually not be initialized yet. As the first
1599 * inserter on the page, we are effectively responsible for making
1600 * sure that it's initialized, before we let insertingAt to move past
1601 * the page header.
1602 */
1609 else
1620 }
1621 else
1622 {
1623 /*
1624 * Make sure the initialization of the page is visible to us, and
1625 * won't arrive later to overwrite the WAL data we write on the page.
1626 */
1628 }
1630 /*
1631 * Found the buffer holding this page. Return a pointer to the right
1632 * offset within the page.
1633 */
1641 }
1643 /*
1644 * Converts a "usable byte position" to XLogRecPtr. A usable byte position
1645 * is the position starting from the beginning of WAL, excluding all WAL
1646 * page headers.
1647 */
1648 static XLogRecPtr
1650 {
1651 uint64 fullsegs;
1652 uint64 fullpages;
1653 uint64 bytesleft;
1654 uint32 seg_offset;
1655 XLogRecPtr result;
1661 {
1662 /* fits on first page of segment */
1664 }
1665 else
1666 {
1667 /* account for the first page on segment with long header */
1675 }
1680 }
1682 /*
1683 * Like XLogBytePosToRecPtr, but if the position is at a page boundary,
1684 * returns a pointer to the beginning of the page (ie. before page header),
1685 * not to where the first xlog record on that page would go to. This is used
1686 * when converting a pointer to the end of a record.
1687 */
1688 static XLogRecPtr
1690 {
1691 uint64 fullsegs;
1692 uint64 fullpages;
1693 uint64 bytesleft;
1694 uint32 seg_offset;
1695 XLogRecPtr result;
1701 {
1702 /* fits on first page of segment */
1705 else
1707 }
1708 else
1709 {
1710 /* account for the first page on segment with long header */
1719 else
1721 }
1726 }
1728 /*
1729 * Convert an XLogRecPtr to a "usable byte position".
1730 */
1731 static uint64
1733 {
1734 uint64 fullsegs;
1735 uint32 fullpages;
1736 uint32 offset;
1737 uint64 result;
1745 {
1748 {
1751 }
1752 }
1753 else
1754 {
1759 {
1762 }
1763 }
1766 }
1768 /*
1769 * Initialize XLOG buffers, writing out old buffers if they still contain
1770 * unwritten data, upto the page containing 'upto'. Or if 'opportunistic' is
1771 * true, initialize as many pages as we can without having to write out
1772 * unwritten data. Any new pages are initialized to zeros, with pages headers
1773 * initialized properly.
1774 */
1775 static void
1777 {
1780 XLogRecPtr OldPageRqstPtr;
1781 XLogwrtRqst WriteRqst;
1783 XLogRecPtr NewPageBeginPtr;
1784 XLogPageHeader NewPage;
1789 /*
1790 * Now that we have the lock, check if someone initialized the page
1791 * already.
1792 */
1794 {
1797 /*
1798 * Get ending-offset of the buffer page we need to replace (this may
1799 * be zero if the buffer hasn't been used yet). Fall through if it's
1800 * already written out.
1801 */
1804 {
1805 /*
1806 * Nope, got work to do. If we just want to pre-initialize as much
1807 * as we can without flushing, give up now.
1808 */
1812 /* Before waiting, get info_lck and update LogwrtResult */
1819 /*
1820 * Now that we have an up-to-date LogwrtResult value, see if we
1821 * still need to write it or if someone else already did.
1822 */
1824 {
1825 /*
1826 * Must acquire write lock. Release WALBufMappingLock first,
1827 * to make sure that all insertions that we need to wait for
1828 * can finish (up to this same position). Otherwise we risk
1829 * deadlock.
1830 */
1839 {
1840 /* OK, someone wrote it already */
1842 }
1843 else
1844 {
1845 /* Have to write it ourselves */
1853 }
1854 /* Re-acquire WALBufMappingLock and retry */
1857 }
1858 }
1860 /*
1861 * Now the next buffer slot is free and we can set it up to be the
1862 * next output page.
1863 */
1871 /*
1872 * Be sure to re-zero the buffer so that bytes beyond what we've
1873 * written will look like zeroes and not valid XLOG records...
1874 */
1877 /*
1878 * Fill the new page's header
1879 */
1888 /*
1889 * If online backup is not in progress, mark the header to indicate
1890 * that WAL records beginning in this page have removable backup
1891 * blocks. This allows the WAL archiver to know whether it is safe to
1892 * compress archived WAL data by transforming full-block records into
1893 * the non-full-block format. It is sufficient to record this at the
1894 * page level because we force a page switch (in fact a segment
1895 * switch) when starting a backup, so the flag will be off before any
1896 * records can be written during the backup. At the end of a backup,
1897 * the last page will be marked as all unsafe when perhaps only part
1898 * is unsafe, but at worst the archiver would miss the opportunity to
1899 * compress a few records.
1900 */
1904 /*
1905 * If first page of an XLOG segment file, make it a long header.
1906 */
1908 {
1915 }
1917 /*
1918 * Make sure the initialization of the page becomes visible to others
1919 * before the xlblocks update. GetXLogBuffer() reads xlblocks without
1920 * holding a lock.
1921 */
1928 npages++;
1929 }
1932 #ifdef WAL_DEBUG
1934 {
1937 }
1938 #endif
1939 }
1941 /*
1942 * Calculate CheckPointSegments based on max_wal_size_mb and
1943 * checkpoint_completion_target.
1944 */
1945 static void
1947 {
1950 /*-------
1951 * Calculate the distance at which to trigger a checkpoint, to avoid
1952 * exceeding max_wal_size_mb. This is based on two assumptions:
1953 *
1954 * a) we keep WAL for only one checkpoint cycle (prior to PG11 we kept
1955 * WAL for two checkpoint cycles to allow us to recover from the
1956 * secondary checkpoint if the first checkpoint failed, though we
1957 * only did this on the primary anyway, not on standby. Keeping just
1958 * one checkpoint simplifies processing and reduces disk space in
1959 * many smaller databases.)
1960 * b) during checkpoint, we consume checkpoint_completion_target *
1961 * number of segments consumed between checkpoints.
1962 *-------
1963 */
1967 /* round down */
1972 }
1974 void
1976 {
1979 }
1981 void
1983 {
1986 }
1988 /*
1989 * At a checkpoint, how many WAL segments to recycle as preallocated future
1990 * XLOG segments? Returns the highest segment that should be preallocated.
1991 */
1992 static XLogSegNo
1994 {
1995 XLogSegNo minSegNo;
1996 XLogSegNo maxSegNo;
1998 XLogSegNo recycleSegNo;
2000 /*
2001 * Calculate the segment numbers that min_wal_size_mb and max_wal_size_mb
2002 * correspond to. Always recycle enough segments to meet the minimum, and
2003 * remove enough segments to stay below the maximum.
2004 */
2010 /*
2011 * Between those limits, recycle enough segments to get us through to the
2012 * estimated end of next checkpoint.
2013 *
2014 * To estimate where the next checkpoint will finish, assume that the
2015 * system runs steadily consuming CheckPointDistanceEstimate bytes between
2016 * every checkpoint.
2017 */
2019 /* add 10% for good measure. */
2023 wal_segment_size);
2031 }
2033 /*
2034 * Check whether we've consumed enough xlog space that a checkpoint is needed.
2035 *
2036 * new_segno indicates a log file that has just been filled up (or read
2037 * during recovery). We measure the distance from RedoRecPtr to new_segno
2038 * and see if that exceeds CheckPointSegments.
2039 *
2040 * Note: it is caller's responsibility that RedoRecPtr is up-to-date.
2041 */
2042 bool
2044 {
2045 XLogSegNo old_segno;
2052 }
2054 /*
2055 * Write and/or fsync the log at least as far as WriteRqst indicates.
2056 *
2057 * If flexible == true, we don't have to write as far as WriteRqst, but
2058 * may stop at any convenient boundary (such as a cache or logfile boundary).
2059 * This option allows us to avoid uselessly issuing multiple writes when a
2060 * single one would do.
2061 *
2062 * Must be called with WALWriteLock held. WaitXLogInsertionsToFinish(WriteRqst)
2063 * must be called before grabbing the lock, to make sure the data is ready to
2064 * write.
2065 */
2066 static void
2068 {
2075 uint32 startoffset;
2077 /* We should always be inside a critical section here */
2080 /*
2081 * Update local LogwrtResult (caller probably did this already, but...)
2082 */
2085 /*
2086 * Since successive pages in the xlog cache are consecutively allocated,
2087 * we can usually gather multiple pages together and issue just one
2088 * write() call. npages is the number of pages we have determined can be
2089 * written together; startidx is the cache block index of the first one,
2090 * and startoffset is the file offset at which it should go. The latter
2091 * two variables are only valid when npages > 0, but we must initialize
2092 * all of them to keep the compiler quiet.
2093 */
2098 /*
2099 * Within the loop, curridx is the cache block index of the page to
2100 * consider writing. Begin at the buffer containing the next unwritten
2101 * page, or last partially written page.
2102 */
2106 {
2107 /*
2108 * Make sure we're not ahead of the insert process. This could happen
2109 * if we're passed a bogus WriteRqst.Write that is past the end of the
2110 * last page that's been initialized by AdvanceXLInsertBuffer.
2111 */
2119 /* Advance LogwrtResult.Write to end of current buffer page */
2124 wal_segment_size))
2125 {
2126 /*
2127 * Switch to new logfile segment. We cannot have any pending
2128 * pages here (since we dump what we have at segment end).
2129 */
2134 wal_segment_size);
2137 /* create/use new log file */
2140 }
2142 /* Make sure we have the current logfile open */
2144 {
2146 wal_segment_size);
2150 }
2152 /* Add current page to the set of pending pages-to-dump */
2154 {
2155 /* first of group */
2158 wal_segment_size);
2159 }
2160 npages++;
2162 /*
2163 * Dump the set if this will be the last loop iteration, or if we are
2164 * at the last page of the cache area (since the next page won't be
2165 * contiguous in memory), or if we are at the end of the logfile
2166 * segment.
2167 */
2175 finishing_seg)
2176 {
2178 Size nbytes;
2179 Size nleft;
2181 instr_time start;
2183 /* OK to write the page(s) */
2187 do
2188 {
2191 /* Measure I/O timing to write WAL data */
2199 /*
2200 * Increment the I/O timing and the number of times WAL data
2201 * were written out to disk.
2202 */
2204 {
2205 instr_time duration;
2210 }
2215 {
2224 wal_segment_size);
2231 }
2239 /*
2240 * If we just wrote the whole last page of a logfile segment,
2241 * fsync the segment immediately. This avoids having to go back
2242 * and re-open prior segments when an fsync request comes along
2243 * later. Doing it here ensures that one and only one backend will
2244 * perform this fsync.
2245 *
2246 * This is also the right place to notify the Archiver that the
2247 * segment is ready to copy to archival storage, and to update the
2248 * timer for archive_timeout, and to signal for a checkpoint if
2249 * too many logfile segments have been used since the last
2250 * checkpoint.
2251 */
2253 {
2256 /* signal that we need to wakeup walsenders later */
2267 /*
2268 * Request a checkpoint if we've consumed too much xlog since
2269 * the last one. For speed, we first check using the local
2270 * copy of RedoRecPtr, which might be out of date; if it looks
2271 * like a checkpoint is needed, forcibly update RedoRecPtr and
2272 * recheck.
2273 */
2275 {
2279 }
2280 }
2281 }
2284 {
2285 /* Only asked to write a partial page */
2288 }
2291 /* If flexible, break out of loop as soon as we wrote something */
2294 }
2298 /*
2299 * If asked to flush, do so
2300 */
2303 {
2304 /*
2305 * Could get here without iterating above loop, in which case we might
2306 * have no open file or the wrong one. However, we do not need to
2307 * fsync more than one file.
2308 */
2311 {
2314 wal_segment_size))
2317 {
2319 wal_segment_size);
2323 }
2326 }
2328 /* signal that we need to wakeup walsenders later */
2332 }
2334 /*
2335 * Update shared-memory status
2336 *
2337 * We make sure that the shared 'request' values do not fall behind the
2338 * 'result' values. This is not absolutely essential, but it saves some
2339 * code in a couple of places.
2340 */
2341 {
2349 }
2350 }
2352 /*
2353 * Record the LSN for an asynchronous transaction commit/abort
2354 * and nudge the WALWriter if there is work for it to do.
2355 * (This should not be called for synchronous commits.)
2356 */
2357 void
2359 {
2370 /*
2371 * If the WALWriter is sleeping, we should kick it to make it come out of
2372 * low-power mode. Otherwise, determine whether there's a full page of
2373 * WAL available to write.
2374 */
2376 {
2377 /* back off to last completed page boundary */
2380 /* if we have already flushed that far, we're done */
2383 }
2385 /*
2386 * Nudge the WALWriter: it has a full page of WAL to write, or we want it
2387 * to come out of low-power mode so that this async commit will reach disk
2388 * within the expected amount of time.
2389 */
2392 }
2394 /*
2395 * Record the LSN up to which we can remove WAL because it's not required by
2396 * any replication slot.
2397 */
2398 void
2400 {
2404 }
2407 /*
2408 * Return the oldest LSN we must retain to satisfy the needs of some
2409 * replication slot.
2410 */
2411 static XLogRecPtr
2413 {
2414 XLogRecPtr retval;
2421 }
2423 /*
2424 * Advance minRecoveryPoint in control file.
2425 *
2426 * If we crash during recovery, we must reach this point again before the
2427 * database is consistent.
2428 *
2429 * If 'force' is true, 'lsn' argument is ignored. Otherwise, minRecoveryPoint
2430 * is only updated if it's not already greater than or equal to 'lsn'.
2431 */
2432 static void
2434 {
2435 /* Quick check using our local copy of the variable */
2439 /*
2440 * An invalid minRecoveryPoint means that we need to recover all the WAL,
2441 * i.e., we're doing crash recovery. We never modify the control file's
2442 * value in that case, so we can short-circuit future checks here too. The
2443 * local values of minRecoveryPoint and minRecoveryPointTLI should not be
2444 * updated until crash recovery finishes. We only do this for the startup
2445 * process as it should not update its own reference of minRecoveryPoint
2446 * until it has finished crash recovery to make sure that all WAL
2447 * available is replayed in this case. This also saves from extra locks
2448 * taken on the control file from the startup process.
2449 */
2451 {
2454 }
2458 /* update local copy */
2465 {
2466 XLogRecPtr newMinRecoveryPoint;
2467 TimeLineID newMinRecoveryPointTLI;
2469 /*
2470 * To avoid having to update the control file too often, we update it
2471 * all the way to the last record being replayed, even though 'lsn'
2472 * would suffice for correctness. This also allows the 'force' case
2473 * to not need a valid 'lsn' value.
2474 *
2475 * Another important reason for doing it this way is that the passed
2476 * 'lsn' value could be bogus, i.e., past the end of available WAL, if
2477 * the caller got it from a corrupted heap page. Accepting such a
2478 * value as the min recovery point would prevent us from coming up at
2479 * all. Instead, we just log a warning and continue with recovery.
2480 * (See also the comments about corrupt LSNs in XLogFlush.)
2481 */
2488 /* update control file */
2490 {
2500 newMinRecoveryPointTLI)));
2501 }
2502 }
2504 }
2506 /*
2507 * Ensure that all XLOG data through the given position is flushed to disk.
2508 *
2509 * NOTE: this differs from XLogWrite mainly in that the WALWriteLock is not
2510 * already held, and we try to avoid acquiring it if possible.
2511 */
2512 void
2514 {
2515 XLogRecPtr WriteRqstPtr;
2516 XLogwrtRqst WriteRqst;
2519 /*
2520 * During REDO, we are reading not writing WAL. Therefore, instead of
2521 * trying to flush the WAL, we should update minRecoveryPoint instead. We
2522 * test XLogInsertAllowed(), not InRecovery, because we need checkpointer
2523 * to act this way too, and because when it tries to write the
2524 * end-of-recovery checkpoint, it should indeed flush.
2525 */
2527 {
2530 }
2532 /* Quick exit if already known flushed */
2536 #ifdef WAL_DEBUG
2542 #endif
2546 /*
2547 * Since fsync is usually a horribly expensive operation, we try to
2548 * piggyback as much data as we can on each fsync: if we see any more data
2549 * entered into the xlog buffer, we'll write and fsync that too, so that
2550 * the final value of LogwrtResult.Flush is as large as possible. This
2551 * gives us some chance of avoiding another fsync immediately after.
2552 */
2554 /* initialize to given target; may increase below */
2557 /*
2558 * Now wait until we get the write lock, or someone else does the flush
2559 * for us.
2560 */
2562 {
2563 XLogRecPtr insertpos;
2565 /* read LogwrtResult and update local state */
2572 /* done already? */
2576 /*
2577 * Before actually performing the write, wait for all in-flight
2578 * insertions to the pages we're about to write to finish.
2579 */
2582 /*
2583 * Try to get the write lock. If we can't get it immediately, wait
2584 * until it's released, and recheck if we still need to do the flush
2585 * or if the backend that held the lock did it for us already. This
2586 * helps to maintain a good rate of group committing when the system
2587 * is bottlenecked by the speed of fsyncing.
2588 */
2590 {
2591 /*
2592 * The lock is now free, but we didn't acquire it yet. Before we
2593 * do, loop back to check if someone else flushed the record for
2594 * us already.
2595 */
2597 }
2599 /* Got the lock; recheck whether request is satisfied */
2602 {
2605 }
2607 /*
2608 * Sleep before flush! By adding a delay here, we may give further
2609 * backends the opportunity to join the backlog of group commit
2610 * followers; this can significantly improve transaction throughput,
2611 * at the risk of increasing transaction latency.
2612 *
2613 * We do not sleep if enableFsync is not turned on, nor if there are
2614 * fewer than CommitSiblings other backends with active transactions.
2615 */
2618 {
2621 /*
2622 * Re-check how far we can now flush the WAL. It's generally not
2623 * safe to call WaitXLogInsertionsToFinish while holding
2624 * WALWriteLock, because an in-progress insertion might need to
2625 * also grab WALWriteLock to make progress. But we know that all
2626 * the insertions up to insertpos have already finished, because
2627 * that's what the earlier WaitXLogInsertionsToFinish() returned.
2628 * We're only calling it again to allow insertpos to be moved
2629 * further forward, not to actually wait for anyone.
2630 */
2632 }
2634 /* try to write/flush later additions to XLOG as well */
2641 /* done */
2643 }
2647 /* wake up walsenders now that we've released heavily contended locks */
2650 /*
2651 * If we still haven't flushed to the request point then we have a
2652 * problem; most likely, the requested flush point is past end of XLOG.
2653 * This has been seen to occur when a disk page has a corrupted LSN.
2654 *
2655 * Formerly we treated this as a PANIC condition, but that hurts the
2656 * system's robustness rather than helping it: we do not want to take down
2657 * the whole system due to corruption on one data page. In particular, if
2658 * the bad page is encountered again during recovery then we would be
2659 * unable to restart the database at all! (This scenario actually
2660 * happened in the field several times with 7.1 releases.) As of 8.4, bad
2661 * LSNs encountered during recovery are UpdateMinRecoveryPoint's problem;
2662 * the only time we can reach here during recovery is while flushing the
2663 * end-of-recovery checkpoint record, and we don't expect that to have a
2664 * bad LSN.
2665 *
2666 * Note that for calls from xact.c, the ERROR will be promoted to PANIC
2667 * since xact.c calls this routine inside a critical section. However,
2668 * calls from bufmgr.c are not within critical sections and so we will not
2669 * force a restart for a bad LSN on a data page.
2670 */
2676 }
2678 /*
2679 * Write & flush xlog, but without specifying exactly where to.
2680 *
2681 * We normally write only completed blocks; but if there is nothing to do on
2682 * that basis, we check for unwritten async commits in the current incomplete
2683 * block, and write through the latest one of those. Thus, if async commits
2684 * are not being used, we will write complete blocks only.
2685 *
2686 * If, based on the above, there's anything to write we do so immediately. But
2687 * to avoid calling fsync, fdatasync et. al. at a rate that'd impact
2688 * concurrent IO, we only flush WAL every wal_writer_delay ms, or if there's
2689 * more than wal_writer_flush_after unflushed blocks.
2690 *
2691 * We can guarantee that async commits reach disk after at most three
2692 * wal_writer_delay cycles. (When flushing complete blocks, we allow XLogWrite
2693 * to write "flexibly", meaning it can stop at the end of the buffer ring;
2694 * this makes a difference only with very high load or long wal_writer_delay,
2695 * but imposes one extra cycle for the worst case for async commits.)
2696 *
2697 * This routine is invoked periodically by the background walwriter process.
2698 *
2699 * Returns true if there was any work to do, even if we skipped flushing due
2700 * to wal_writer_delay/wal_writer_flush_after.
2701 */
2702 bool
2704 {
2705 XLogwrtRqst WriteRqst;
2708 TimestampTz now;
2710 TimeLineID insertTLI;
2712 /* XLOG doesn't need flushing during recovery */
2716 /*
2717 * Since we're not in recovery, InsertTimeLineID is set and can't change,
2718 * so we can read it without a lock.
2719 */
2722 /* read LogwrtResult and update local state */
2728 /* back off to last completed page boundary */
2731 /* if we have already flushed that far, consider async commit records */
2733 {
2738 }
2740 /*
2741 * If already known flushed, we're done. Just need to check if we are
2742 * holding an open file handle to a logfile that's no longer in use,
2743 * preventing the file from being deleted.
2744 */
2746 {
2748 {
2750 wal_segment_size))
2751 {
2753 }
2754 }
2756 }
2758 /*
2759 * Determine how far to flush WAL, based on the wal_writer_delay and
2760 * wal_writer_flush_after GUCs.
2761 */
2763 flushbytes =
2767 {
2768 /* first call, or block based limits disabled */
2771 }
2773 {
2774 /*
2775 * Flush the writes at least every WalWriterDelay ms. This is
2776 * important to bound the amount of time it takes for an asynchronous
2777 * commit to hit disk.
2778 */
2781 }
2783 {
2784 /* exceeded wal_writer_flush_after blocks, flush */
2787 }
2788 else
2789 {
2790 /* no flushing, this time round */
2792 }
2794 #ifdef WAL_DEBUG
2796 elog(LOG, "xlog bg flush request write %X/%X; flush: %X/%X, current is write %X/%X; flush %X/%X",
2801 #endif
2805 /* now wait for any in-progress insertions to finish and get write lock */
2811 {
2813 }
2818 /* wake up walsenders now that we've released heavily contended locks */
2821 /*
2822 * Great, done. To take some work off the critical path, try to initialize
2823 * as many of the no-longer-needed WAL buffers for future use as we can.
2824 */
2827 /*
2828 * If we determined that we need to write data, but somebody else
2829 * wrote/flushed already, it should be considered as being active, to
2830 * avoid hibernating too early.
2831 */
2833 }
2835 /*
2836 * Test whether XLOG data has been flushed up to (at least) the given position.
2837 *
2838 * Returns true if a flush is still needed. (It may be that someone else
2839 * is already in process of flushing that far, however.)
2840 */
2841 bool
2843 {
2844 /*
2845 * During recovery, we don't flush WAL but update minRecoveryPoint
2846 * instead. So "needs flush" is taken to mean whether minRecoveryPoint
2847 * would need to be updated.
2848 */
2850 {
2851 /*
2852 * An invalid minRecoveryPoint means that we need to recover all the
2853 * WAL, i.e., we're doing crash recovery. We never modify the control
2854 * file's value in that case, so we can short-circuit future checks
2855 * here too. This triggers a quick exit path for the startup process,
2856 * which cannot update its local copy of minRecoveryPoint as long as
2857 * it has not replayed all WAL available when doing crash recovery.
2858 */
2862 /* Quick exit if already known to be updated or cannot be updated */
2866 /*
2867 * Update local copy of minRecoveryPoint. But if the lock is busy,
2868 * just return a conservative guess.
2869 */
2876 /*
2877 * Check minRecoveryPoint for any other process than the startup
2878 * process doing crash recovery, which should not update the control
2879 * file value if crash recovery is still running.
2880 */
2884 /* check again */
2887 else
2889 }
2891 /* Quick exit if already known flushed */
2895 /* read LogwrtResult and update local state */
2900 /* check again */
2905 }
2907 /*
2908 * Try to make a given XLOG file segment exist.
2909 *
2910 * logsegno: identify segment.
2911 *
2912 * *added: on return, true if this call raised the number of extant segments.
2913 *
2914 * path: on return, this char[MAXPGPATH] has the path to the logsegno file.
2915 *
2916 * Returns -1 or FD of opened file. A -1 here is not an error; a caller
2917 * wanting an open segment should attempt to open "path", which usually will
2918 * succeed. (This is weird, but it's efficient for the callers.)
2919 */
2920 static int
2923 {
2925 XLogSegNo installed_segno;
2926 XLogSegNo max_segno;
2934 /*
2935 * Try to use existent file (checkpoint maker may have created it already)
2936 */
2940 {
2945 }
2946 else
2949 /*
2950 * Initialize an empty (all zeroes) segment. NOTE: it is possible that
2951 * another process is doing the same thing. If so, we will end up
2952 * pre-creating an extra log segment. That seems OK, and better than
2953 * holding the lock throughout this lengthy process.
2954 */
2961 /* do not use get_sync_bit() here --- want to fsync only at end of fill */
2971 {
2972 ssize_t rc;
2974 /*
2975 * Zero-fill the file. With this setting, we do this the hard way to
2976 * ensure that all the file space has really been allocated. On
2977 * platforms that allow "holes" in files, just seeking to the end
2978 * doesn't allocate intermediate space. This way, we know that we
2979 * have all the space and (after the fsync below) that all the
2980 * indirect blocks are down on disk. Therefore, fdatasync(2) or
2981 * O_DSYNC will be sufficient to sync future writes to the log file.
2982 */
2987 }
2988 else
2989 {
2990 /*
2991 * Otherwise, seeking to the end and writing a solitary byte is
2992 * enough.
2993 */
2996 {
2997 /* if write didn't set errno, assume no disk space */
2999 }
3000 }
3004 {
3005 /*
3006 * If we fail to make the file, delete it to release disk space
3007 */
3017 }
3021 {
3028 }
3036 /*
3037 * Now move the segment into place with its final name. Cope with
3038 * possibility that someone else has created the file while we were
3039 * filling ours: if so, use ours to pre-create a future log segment.
3040 */
3043 /*
3044 * XXX: What should we use as max_segno? We used to use XLOGfileslop when
3045 * that was a constant, but that was always a bit dubious: normally, at a
3046 * checkpoint, XLOGfileslop was the offset from the checkpoint record, but
3047 * here, it was the offset from the insert location. We can't do the
3048 * normal XLOGfileslop calculation here because we don't have access to
3049 * the prior checkpoint's redo location. So somewhat arbitrarily, just use
3050 * CheckPointSegments.
3051 */
3054 logtli))
3055 {
3058 }
3059 else
3060 {
3061 /*
3062 * No need for any more future segments, or InstallXLogFileSegment()
3063 * failed to rename the file into place. If the rename failed, a
3064 * caller opening the file may fail.
3065 */
3068 }
3071 }
3073 /*
3074 * Create a new XLOG file segment, or open a pre-existing one.
3075 *
3076 * logsegno: identify segment to be created/opened.
3077 *
3078 * Returns FD of opened file.
3079 *
3080 * Note: errors here are ERROR not PANIC because we might or might not be
3081 * inside a critical section (eg, during checkpoint there is no reason to
3082 * take down the system on failure). They will promote to PANIC if we are
3083 * in a critical section.
3084 */
3085 int
3087 {
3098 /* Now open original target segment (might not be file I just made) */
3105 }
3107 /*
3108 * Create a new XLOG file segment by copying a pre-existing one.
3109 *
3110 * destsegno: identify segment to be created.
3111 *
3112 * srcTLI, srcsegno: identify segment to be copied (could be from
3113 * a different timeline)
3114 *
3115 * upto: how much of the source file to copy (the rest is filled with
3116 * zeros)
3117 *
3118 * Currently this is only used during recovery, and so there are no locking
3119 * considerations. But we should be just as tense as XLogFileInit to avoid
3120 * emplacing a bogus file.
3121 */
3122 static void
3126 {
3129 PGAlignedXLogBlock buffer;
3134 /*
3135 * Open the source file
3136 */
3144 /*
3145 * Copy into a temp file name.
3146 */
3151 /* do not use get_sync_bit() here --- want to fsync only at end of fill */
3158 /*
3159 * Do the data copying.
3160 */
3162 {
3167 /*
3168 * The part that is not read from the source file is filled with
3169 * zeros.
3170 */
3175 {
3183 {
3188 path)));
3189 else
3194 }
3196 }
3200 {
3203 /*
3204 * If we fail to make the file, delete it to release disk space
3205 */
3207 /* if write didn't set errno, assume problem is no disk space */
3213 }
3215 }
3234 /*
3235 * Now move the segment into place with its final name.
3236 */
3239 }
3241 /*
3242 * Install a new XLOG segment file as a current or future log segment.
3243 *
3244 * This is used both to install a newly-created segment (which has a temp
3245 * filename while it's being created) and to recycle an old segment.
3246 *
3247 * *segno: identify segment to install as (or first possible target).
3248 * When find_free is true, this is modified on return to indicate the
3249 * actual installation location or last segment searched.
3250 *
3251 * tmppath: initial name of file to install. It will be renamed into place.
3252 *
3253 * find_free: if true, install the new segment at the first empty segno
3254 * number at or after the passed numbers. If false, install the new segment
3255 * exactly where specified, deleting any existing segment file there.
3256 *
3257 * max_segno: maximum segment number to install the new file as. Fail if no
3258 * free slot is found between *segno and max_segno. (Ignored when find_free
3259 * is false.)
3260 *
3261 * tli: The timeline on which the new segment should be installed.
3262 *
3263 * Returns true if the file was installed successfully. false indicates that
3264 * max_segno limit was exceeded, the startup process has disabled this
3265 * function for now, or an error occurred while renaming the file into place.
3266 */
3267 static bool
3270 {
3280 {
3283 }
3286 {
3287 /* Force installation: get rid of any pre-existing segment file */
3289 }
3290 else
3291 {
3292 /* Find a free slot to put it in */
3294 {
3296 {
3297 /* Failed to find a free slot within specified range */
3300 }
3303 }
3304 }
3308 {
3310 /* durable_rename already emitted log message */
3312 }
3317 }
3319 /*
3320 * Open a pre-existing logfile segment for writing.
3321 */
3322 int
3324 {
3337 }
3339 /*
3340 * Close the current logfile segment for writing.
3341 */
3342 static void
3344 {
3347 /*
3348 * WAL segment files will not be re-read in normal operation, so we advise
3349 * the OS to release any cached pages. But do not do so if WAL archiving
3350 * or streaming is active, because archiver and walsender process could
3351 * use the cache to read the WAL segment.
3352 */
3353 #if defined(USE_POSIX_FADVISE) && defined(POSIX_FADV_DONTNEED)
3356 #endif
3359 {
3368 }
3372 }
3374 /*
3375 * Preallocate log files beyond the specified log endpoint.
3376 *
3377 * XXX this is currently extremely conservative, since it forces only one
3378 * future log segment to exist, and even that only if we are 75% done with
3379 * the current one. This is only appropriate for very low-WAL-volume systems.
3380 * High-volume systems will be OK once they've built up a sufficient set of
3381 * recycled log segments, but the startup transient is likely to include
3382 * a lot of segment creations by foreground processes, which is not so good.
3383 *
3384 * XLogFileInitInternal() can ereport(ERROR). All known causes indicate big
3385 * trouble; for example, a full filesystem is one cause. The checkpoint WAL
3386 * and/or ControlFile updates already completed. If a RequestCheckpoint()
3387 * initiated the present checkpoint and an ERROR ends this function, the
3388 * command that called RequestCheckpoint() fails. That's not ideal, but it's
3389 * not worth contorting more functions to use caller-specified elevel values.
3390 * (With or without RequestCheckpoint(), an ERROR forestalls some inessential
3391 * reporting and resource reclamation.)
3392 */
3393 static void
3395 {
3396 XLogSegNo _logSegNo;
3400 uint64 offset;
3408 {
3409 _logSegNo++;
3415 }
3416 }
3418 /*
3419 * Throws an error if the given log segment has already been removed or
3420 * recycled. The caller should only pass a segment that it knows to have
3421 * existed while the server has been running, as this function always
3422 * succeeds if no WAL segments have been removed since startup.
3423 * 'tli' is only used in the error message.
3424 *
3425 * Note: this function guarantees to keep errno unchanged on return.
3426 * This supports callers that use this to possibly deliver a better
3427 * error message about a missing file, while still being able to throw
3428 * a normal file-access error afterwards, if this does return.
3429 */
3430 void
3432 {
3434 XLogSegNo lastRemovedSegNo;
3441 {
3449 filename)));
3450 }
3452 }
3454 /*
3455 * Return the last WAL segment removed, or 0 if no segment has been removed
3456 * since startup.
3457 *
3458 * NB: the result can be out of date arbitrarily fast, the caller has to deal
3459 * with that.
3460 */
3461 XLogSegNo
3463 {
3464 XLogSegNo lastRemovedSegNo;
3471 }
3474 /*
3475 * Update the last removed segno pointer in shared memory, to reflect that the
3476 * given XLOG file has been removed.
3477 */
3478 static void
3480 {
3481 uint32 tli;
3482 XLogSegNo segno;
3490 }
3492 /*
3493 * Remove all temporary log files in pg_wal
3494 *
3495 * This is called at the beginning of recovery after a previous crash,
3496 * at a point where no other processes write fresh WAL data.
3497 */
3498 static void
3500 {
3508 {
3517 }
3519 }
3521 /*
3522 * Recycle or remove all log files older or equal to passed segno.
3523 *
3524 * endptr is current (or recent) end of xlog, and lastredoptr is the
3525 * redo pointer of the last checkpoint. These are used to determine
3526 * whether we want to recycle rather than delete no-longer-wanted log files.
3527 *
3528 * insertTLI is the current timeline for XLOG insertion. Any recycled
3529 * segments should be reused for this timeline.
3530 */
3531 static void
3533 TimeLineID insertTLI)
3534 {
3538 XLogSegNo endlogSegNo;
3539 XLogSegNo recycleSegNo;
3541 /* Initialize info about where to try to recycle to */
3545 /*
3546 * Construct a filename of the last segment to be kept. The timeline ID
3547 * doesn't matter, we ignore that in the comparison. (During recovery,
3548 * InsertTimeLineID isn't set, so we can't use that.)
3549 */
3553 lastoff);
3558 {
3559 /* Ignore files that are not XLOG segments */
3564 /*
3565 * We ignore the timeline part of the XLOG segment identifiers in
3566 * deciding whether a segment is still needed. This ensures that we
3567 * won't prematurely remove a segment from a parent timeline. We could
3568 * probably be a little more proactive about removing segments of
3569 * non-parent timelines, but that would be a whole lot more
3570 * complicated.
3571 *
3572 * We use the alphanumeric sorting property of the filenames to decide
3573 * which ones are earlier than the lastoff segment.
3574 */
3576 {
3578 {
3579 /* Update the last removed location in shared memory first */
3583 }
3584 }
3585 }
3588 }
3590 /*
3591 * Remove WAL files that are not part of the given timeline's history.
3592 *
3593 * This is called during recovery, whenever we switch to follow a new
3594 * timeline, and at the end of recovery when we create a new timeline. We
3595 * wouldn't otherwise care about extra WAL files lying in pg_wal, but they
3596 * might be leftover pre-allocated or recycled WAL segments on the old timeline
3597 * that we haven't used yet, and contain garbage. If we just leave them in
3598 * pg_wal, they will eventually be archived, and we can't let that happen.
3599 * Files that belong to our timeline history are valid, because we have
3600 * successfully replayed them, but from others we can't be sure.
3601 *
3602 * 'switchpoint' is the current point in WAL where we switch to new timeline,
3603 * and 'newTLI' is the new timeline we switch to.
3604 */
3605 void
3607 {
3611 XLogSegNo endLogSegNo;
3612 XLogSegNo switchLogSegNo;
3613 XLogSegNo recycleSegNo;
3615 /*
3616 * Initialize info about where to begin the work. This will recycle,
3617 * somewhat arbitrarily, 10 future segments.
3618 */
3623 /*
3624 * Construct a filename of the last segment to be kept.
3625 */
3629 switchseg);
3634 {
3635 /* Ignore files that are not XLOG segments */
3639 /*
3640 * Remove files that are on a timeline older than the new one we're
3641 * switching to, but with a segment number >= the first segment on the
3642 * new timeline.
3643 */
3646 {
3647 /*
3648 * If the file has already been marked as .ready, however, don't
3649 * remove it yet. It should be OK to remove it - files that are
3650 * not part of our timeline history are not required for recovery
3651 * - but seems safer to let them be archived and removed later.
3652 */
3655 }
3656 }
3659 }
3661 /*
3662 * Recycle or remove a log file that's no longer needed.
3663 *
3664 * segment_de is the dirent structure of the segment to recycle or remove.
3665 * recycleSegNo is the segment number to recycle up to. endlogSegNo is
3666 * the segment number of the current (or recent) end of WAL.
3667 *
3668 * endlogSegNo gets incremented if the segment is recycled so as it is not
3669 * checked again with future callers of this function.
3670 *
3671 * insertTLI is the current timeline for XLOG insertion. Any recycled segments
3672 * should be used for this timeline.
3673 */
3674 static void
3677 TimeLineID insertTLI)
3678 {
3680 #ifdef WIN32
3682 #endif
3687 /*
3688 * Before deleting the file, see if it can be recycled as a future log
3689 * segment. Only recycle normal files, because we don't want to recycle
3690 * symbolic links pointing to a separate archive directory.
3691 */
3698 {
3701 segname)));
3703 /* Needn't recheck that slot on future iterations */
3705 }
3706 else
3707 {
3708 /* No need for any more future segments, or recycling failed ... */
3713 segname)));
3715 #ifdef WIN32
3717 /*
3718 * On Windows, if another process (e.g another backend) holds the file
3719 * open in FILE_SHARE_DELETE mode, unlink will succeed, but the file
3720 * will still show up in directory listing until the last handle is
3721 * closed. To avoid confusing the lingering deleted file for a live
3722 * WAL file that needs to be archived, rename it before deleting it.
3723 *
3724 * If another process holds the file open without FILE_SHARE_DELETE
3725 * flag, rename will fail. We'll try again at the next checkpoint.
3726 */
3729 {
3733 path)));
3735 }
3737 #else
3739 #endif
3741 {
3742 /* Message already logged by durable_unlink() */
3744 }
3746 }
3749 }
3751 /*
3752 * Verify whether pg_wal and pg_wal/archive_status exist.
3753 * If the latter does not exist, recreate it.
3754 *
3755 * It is not the goal of this function to verify the contents of these
3756 * directories, but to help in cases where someone has performed a cluster
3757 * copy for PITR purposes but omitted pg_wal from the copy.
3758 *
3759 * We could also recreate pg_wal if it doesn't exist, but a deliberate
3760 * policy decision was made not to. It is fairly common for pg_wal to be
3761 * a symlink, and if that was the DBA's intent then automatically making a
3762 * plain directory would result in degraded performance with no notice.
3763 */
3764 static void
3766 {
3770 /* Check for pg_wal; if it doesn't exist, error out */
3775 XLOGDIR)));
3777 /* Check for archive_status */
3780 {
3781 /* Check for weird cases where it exists but isn't a directory */
3785 path)));
3786 }
3787 else
3788 {
3794 path)));
3795 }
3796 }
3798 /*
3799 * Remove previous backup history files. This also retries creation of
3800 * .ready files for any backup history files for which XLogArchiveNotify
3801 * failed earlier.
3802 */
3803 static void
3805 {
3813 {
3815 {
3817 {
3823 }
3824 }
3825 }
3828 }
3830 /*
3831 * I/O routines for pg_control
3832 *
3833 * *ControlFile is a buffer in shared memory that holds an image of the
3834 * contents of pg_control. WriteControlFile() initializes pg_control
3835 * given a preloaded buffer, ReadControlFile() loads the buffer from
3836 * the pg_control file (during postmaster or standalone-backend startup),
3837 * and UpdateControlFile() rewrites pg_control after we modify xlog state.
3838 * InitControlFile() fills the buffer with initial values.
3839 *
3840 * For simplicity, WriteControlFile() initializes the fields of pg_control
3841 * that are related to checking backend/database compatibility, and
3842 * ReadControlFile() verifies they are correct. We could split out the
3843 * I/O and compatibility-check functions, but there seems no need currently.
3844 */
3846 static void
3848 {
3851 /*
3852 * Generate a random nonce. This is used for authentication requests that
3853 * will fail because the user does not exist. The nonce is used to create
3854 * a genuine-looking password challenge for the non-existent user, in lieu
3855 * of an actual stored password.
3856 */
3863 /* Initialize pg_control status fields */
3869 /* Set important parameter values for use when replaying WAL */
3879 }
3881 static void
3883 {
3887 /*
3888 * Initialize version and compatibility-check fields
3889 */
3909 /* Contents are protected with a CRC */
3916 /*
3917 * We write out PG_CONTROL_FILE_SIZE bytes into pg_control, zero-padding
3918 * the excess over sizeof(ControlFileData). This reduces the odds of
3919 * premature-EOF errors when reading pg_control. We'll still fail when we
3920 * check the contents of the file, but hopefully with a more specific
3921 * error than "couldn't read pg_control".
3922 */
3932 XLOG_CONTROL_FILE)));
3937 {
3938 /* if write didn't set errno, assume problem is no disk space */
3944 XLOG_CONTROL_FILE)));
3945 }
3953 XLOG_CONTROL_FILE)));
3960 XLOG_CONTROL_FILE)));
3961 }
3963 static void
3965 {
3966 pg_crc32c crc;
3971 /*
3972 * Read data...
3973 */
3980 XLOG_CONTROL_FILE)));
3985 {
3990 XLOG_CONTROL_FILE)));
3991 else
3996 }
4001 /*
4002 * Check for expected pg_control format version. If this is wrong, the
4003 * CRC check will likely fail because we'll be checking the wrong number
4004 * of bytes. Complaining about wrong version will probably be more
4005 * enlightening than complaining about wrong CRC.
4006 */
4008 if (ControlFile->pg_control_version != PG_CONTROL_VERSION && ControlFile->pg_control_version % 65536 == 0 && ControlFile->pg_control_version / 65536 != 0)
4015 errhint("This could be a problem of mismatched byte ordering. It looks like you need to initdb.")));
4025 /* Now check the CRC. */
4036 /*
4037 * Do compatibility checking immediately. If the database isn't
4038 * compatible with the backend executable, we want to abort before we can
4039 * possibly do any damage.
4040 */
4058 errdetail("The database cluster appears to use a different floating-point number format than the server executable."),
4110 #ifdef USE_FLOAT8_BYVAL
4117 #else
4124 #endif
4130 errmsg_plural("WAL segment size must be a power of two between 1 MB and 1 GB, but the control file specifies %d byte",
4131 "WAL segment size must be a power of two between 1 MB and 1 GB, but the control file specifies %d bytes",
4132 wal_segment_size,
4133 wal_segment_size)));
4137 PGC_S_DYNAMIC_DEFAULT);
4139 /* check and update variables dependent on wal_segment_size */
4148 UsableBytesInSegment =
4154 /* Make the initdb settings visible as GUC variables, too */
4157 }
4159 /*
4160 * Utility wrapper to update the control file. Note that the control
4161 * file gets flushed.
4162 */
4163 static void
4165 {
4167 }
4169 /*
4170 * Returns the unique system identifier from control file.
4171 */
4172 uint64
4174 {
4177 }
4179 /*
4180 * Returns the random nonce from control file.
4181 */
4184 {
4187 }
4189 /*
4190 * Are checksums enabled for data pages?
4191 */
4192 bool
4194 {
4197 }
4199 /*
4200 * Returns a fake LSN for unlogged relations.
4201 *
4202 * Each call generates an LSN that is greater than any previous value
4203 * returned. The current counter value is saved and restored across clean
4204 * shutdowns, but like unlogged relations, does not survive a crash. This can
4205 * be used in lieu of real LSN values returned by XLogInsert, if you need an
4206 * LSN-like increasing sequence of numbers without writing any WAL.
4207 */
4208 XLogRecPtr
4210 {
4211 XLogRecPtr nextUnloggedLSN;
4213 /* increment the unloggedLSN counter, need SpinLock */
4219 }
4221 /*
4222 * Auto-tune the number of XLOG buffers.
4223 *
4224 * The preferred setting for wal_buffers is about 3% of shared_buffers, with
4225 * a maximum of one XLOG segment (there is little reason to think that more
4226 * is helpful, at least so long as we force an fsync when switching log files)
4227 * and a minimum of 8 blocks (which was the default value prior to PostgreSQL
4228 * 9.1, when auto-tuning was added).
4229 *
4230 * This should not be called until NBuffers has received its final value.
4231 */
4232 static int
4234 {
4243 }
4245 /*
4246 * GUC check_hook for wal_buffers
4247 */
4248 bool
4250 {
4251 /*
4252 * -1 indicates a request for auto-tune.
4253 */
4255 {
4256 /*
4257 * If we haven't yet changed the boot_val default of -1, just let it
4258 * be. We'll fix it when XLOGShmemSize is called.
4259 */
4263 /* Otherwise, substitute the auto-tune value */
4265 }
4267 /*
4268 * We clamp manually-set values to at least 4 blocks. Prior to PostgreSQL
4269 * 9.1, a minimum of 4 was enforced by guc.c, but since that is no longer
4270 * the case, we just silently treat such values as a request for the
4271 * minimum. (We could throw an error instead, but that doesn't seem very
4272 * helpful.)
4273 */
4278 }
4280 /*
4281 * GUC check_hook for wal_consistency_checking
4282 */
4283 bool
4285 {
4291 /* Initialize the array */
4294 /* Need a modifiable copy of string */
4297 /* Parse string into list of identifiers */
4299 {
4300 /* syntax error in list */
4305 }
4308 {
4312 /* Check for 'all'. */
4314 {
4318 }
4319 else
4320 {
4321 /* Check if the token matches any known resource manager. */
4325 {
4328 {
4332 }
4333 }
4335 {
4336 /*
4337 * During startup, it might be a not-yet-loaded custom
4338 * resource manager. Defer checking until
4339 * InitializeWalConsistencyChecking().
4340 */
4342 {
4344 }
4345 else
4346 {
4351 }
4352 }
4353 }
4354 }
4359 /* assign new value */
4363 }
4365 /*
4366 * GUC assign_hook for wal_consistency_checking
4367 */
4368 void
4370 {
4371 /*
4372 * If some checks were deferred, it's possible that the checks will fail
4373 * later during InitializeWalConsistencyChecking(). But in that case, the
4374 * postmaster will exit anyway, so it's safe to proceed with the
4375 * assignment.
4376 *
4377 * Any built-in resource managers specified are assigned immediately,
4378 * which affects WAL created before shared_preload_libraries are
4379 * processed. Any custom resource managers specified won't be assigned
4380 * until after shared_preload_libraries are processed, but that's OK
4381 * because WAL for a custom resource manager can't be written before the
4382 * module is loaded anyway.
4383 */
4385 }
4387 /*
4388 * InitializeWalConsistencyChecking: run after loading custom resource managers
4389 *
4390 * If any unknown resource managers were specified in the
4391 * wal_consistency_checking GUC, processing was deferred. Now that
4392 * shared_preload_libraries have been loaded, process wal_consistency_checking
4393 * again.
4394 */
4395 void
4397 {
4401 {
4409 wal_consistency_checking_string,
4413 /* checking should not be deferred again */
4415 }
4416 }
4418 /*
4419 * GUC show_hook for archive_command
4420 */
4423 {
4426 else
4428 }
4430 /*
4431 * GUC show_hook for in_hot_standby
4432 */
4435 {
4436 /*
4437 * We display the actual state based on shared memory, so that this GUC
4438 * reports up-to-date state if examined intra-query. The underlying
4439 * variable (in_hot_standby_guc) changes only when we transmit a new value
4440 * to the client.
4441 */
4443 }
4446 /*
4447 * Read the control file, set respective GUCs.
4448 *
4449 * This is to be called during startup, including a crash recovery cycle,
4450 * unless in bootstrap mode, where no control file yet exists. As there's no
4451 * usable shared memory yet (its sizing can depend on the contents of the
4452 * control file!), first store the contents in local memory. XLOGShmemInit()
4453 * will then copy it to shared memory later.
4454 *
4455 * reset just controls whether previous contents are to be expected (in the
4456 * reset case, there's a dangling pointer into old shared memory), or not.
4457 */
4458 void
4460 {
4464 }
4466 /*
4467 * Initialization of shared memory for XLOG
4468 */
4469 Size
4471 {
4472 Size size;
4474 /*
4475 * If the value of wal_buffers is -1, use the preferred auto-tune value.
4476 * This isn't an amazingly clean place to do this, but we must wait till
4477 * NBuffers has received its final value, and must do it before using the
4478 * value of XLOGbuffers to do anything important.
4479 *
4480 * We prefer to report this value's source as PGC_S_DYNAMIC_DEFAULT.
4481 * However, if the DBA explicitly set wal_buffers = -1 in the config file,
4482 * then PGC_S_DYNAMIC_DEFAULT will fail to override that and we must force
4483 * the matter with PGC_S_OVERRIDE.
4484 */
4486 {
4491 PGC_S_DYNAMIC_DEFAULT);
4494 PGC_S_OVERRIDE);
4495 }
4498 /* XLogCtl */
4501 /* WAL insertion locks, plus alignment */
4503 /* xlblocks array */
4505 /* extra alignment padding for XLOG I/O buffers */
4507 /* and the buffers themselves */
4510 /*
4511 * Note: we don't count ControlFileData, it comes out of the "slop factor"
4512 * added by CreateSharedMemoryAndSemaphores. This lets us use this
4513 * routine again below to compute the actual allocation size.
4514 */
4517 }
4519 void
4521 {
4523 foundXLog;
4528 #ifdef WAL_DEBUG
4530 /*
4531 * Create a memory context for WAL debugging that's exempt from the normal
4532 * "no pallocs in critical section" rule. Yes, that can lead to a PANIC if
4533 * an allocation fails, but wal_debug is not for production use anyway.
4534 */
4536 {
4539 ALLOCSET_DEFAULT_SIZES);
4541 }
4542 #endif
4553 {
4554 /* both should be present or neither */
4557 /* Initialize local copy of WALInsertLocks */
4563 }
4566 /*
4567 * Already have read control file locally, unless in bootstrap mode. Move
4568 * contents into shared memory.
4569 */
4571 {
4574 }
4576 /*
4577 * Since XLogCtlData contains XLogRecPtr fields, its sizeof should be a
4578 * multiple of the alignment for same, so no extra alignment padding is
4579 * needed here.
4580 */
4587 /* WAL insertion locks. Ensure they're aligned to the full padded size */
4595 {
4599 }
4601 /*
4602 * Align the start of the page buffers to a full xlog block size boundary.
4603 * This simplifies some calculations in XLOG insertion. It is also
4604 * required for O_DIRECT.
4605 */
4610 /*
4611 * Do basic initialization of XLogCtl shared data. (StartupXLOG will fill
4612 * in additional info.)
4613 */
4622 }
4624 /*
4625 * This func must be called ONCE on system install. It creates pg_control
4626 * and the initial XLOG segment.
4627 */
4628 void
4630 {
4631 CheckPoint checkPoint;
4633 XLogPageHeader page;
4634 XLogLongPageHeader longpage;
4637 uint64 sysidentifier;
4639 pg_crc32c crc;
4641 /* allow ordinary WAL segment creation, like StartupXLOG() would */
4644 /*
4645 * Select a hopefully-unique system identifier code for this installation.
4646 * We use the result of gettimeofday(), including the fractional seconds
4647 * field, as being about as unique as we can easily get. (Think not to
4648 * use random(), since it hasn't been seeded and there's no portable way
4649 * to seed it other than the system clock value...) The upper half of the
4650 * uint64 value is just the tv_sec part, while the lower half contains the
4651 * tv_usec part (which must fit in 20 bits), plus 12 bits from our current
4652 * PID for a little extra uniqueness. A person knowing this encoding can
4653 * determine the initialization time of the installation, which could
4654 * perhaps be useful sometimes.
4655 */
4661 /* page buffer must be aligned suitably for O_DIRECT */
4666 /*
4667 * Set up information for the initial checkpoint record
4668 *
4669 * The initial checkpoint record is written to the beginning of the WAL
4670 * segment with logid=0 logseg=1. The very first WAL segment, 0/0, is not
4671 * used, so that we can use 0/0 to mean "before any valid WAL segment".
4672 */
4700 /* Set up the XLOG page header */
4710 /* Insert the initial checkpoint record */
4719 /* fill the XLogRecordDataHeaderShort struct */
4732 /* Create first XLOG segment file */
4736 /*
4737 * We needn't bother with Reserve/ReleaseExternalFD here, since we'll
4738 * close the file again in a moment.
4739 */
4741 /* Write the first page with the initial record */
4745 {
4746 /* if write didn't set errno, assume problem is no disk space */
4752 }
4769 /* Now create pg_control */
4775 /* some additional ControlFile fields are set in WriteControlFile() */
4778 /* Bootstrap the commit log, too */
4786 /*
4787 * Force control file to be read - in contrast to normal processing we'd
4788 * otherwise never run the checks and GUC related initializations therein.
4789 */
4791 }
4795 {
4803 }
4805 /*
4806 * Initialize the first WAL segment on new timeline.
4807 */
4808 static void
4810 {
4812 XLogSegNo endLogSegNo;
4813 XLogSegNo startLogSegNo;
4815 /* we always switch to a new timeline after archive recovery */
4818 /*
4819 * Update min recovery point one last time.
4820 */
4823 /*
4824 * Calculate the last segment on the old timeline, and the first segment
4825 * on the new timeline. If the switch happens in the middle of a segment,
4826 * they are the same, but if the switch happens exactly at a segment
4827 * boundary, startLogSegNo will be endLogSegNo + 1.
4828 */
4832 /*
4833 * Initialize the starting WAL segment for the new timeline. If the switch
4834 * happens in the middle of a segment, copy data from the last WAL segment
4835 * of the old timeline up to the switch point, to the starting WAL segment
4836 * on the new timeline.
4837 */
4839 {
4840 /*
4841 * Make a copy of the file on the new timeline.
4842 *
4843 * Writing WAL isn't allowed yet, so there are no locking
4844 * considerations. But we should be just as tense as XLogFileInit to
4845 * avoid emplacing a bogus file.
4846 */
4849 }
4850 else
4851 {
4852 /*
4853 * The switch happened at a segment boundary, so just create the next
4854 * segment on the new timeline.
4855 */
4861 {
4869 }
4870 }
4872 /*
4873 * Let's just make real sure there are not .ready or .done flags posted
4874 * for the new segment.
4875 */
4878 }
4880 /*
4881 * Perform cleanup actions at the conclusion of archive recovery.
4882 */
4883 static void
4885 TimeLineID newTLI)
4886 {
4887 /*
4888 * Execute the recovery_end_command, if any.
4889 */
4891 {
4896 }
4898 /*
4899 * We switched to a new timeline. Clean up segments on the old timeline.
4900 *
4901 * If there are any higher-numbered segments on the old timeline, remove
4902 * them. They might contain valid WAL, but they might also be
4903 * pre-allocated files containing garbage. In any case, they are not part
4904 * of the new timeline's history so we don't need them.
4905 */
4908 /*
4909 * If the switch happened in the middle of a segment, what to do with the
4910 * last, partial segment on the old timeline? If we don't archive it, and
4911 * the server that created the WAL never archives it either (e.g. because
4912 * it was hit by a meteor), it will never make it to the archive. That's
4913 * OK from our point of view, because the new segment that we created with
4914 * the new TLI contains all the WAL from the old timeline up to the switch
4915 * point. But if you later try to do PITR to the "missing" WAL on the old
4916 * timeline, recovery won't find it in the archive. It's physically
4917 * present in the new file with new TLI, but recovery won't look there
4918 * when it's recovering to the older timeline. On the other hand, if we
4919 * archive the partial segment, and the original server on that timeline
4920 * is still running and archives the completed version of the same segment
4921 * later, it will fail. (We used to do that in 9.4 and below, and it
4922 * caused such problems).
4923 *
4924 * As a compromise, we rename the last segment with the .partial suffix,
4925 * and archive it. Archive recovery will never try to read .partial
4926 * segments, so they will normally go unused. But in the odd PITR case,
4927 * the administrator can copy them manually to the pg_wal directory
4928 * (removing the suffix). They can be useful in debugging, too.
4929 *
4930 * If a .done or .ready file already exists for the old timeline, however,
4931 * we had already determined that the segment is complete, so we can let
4932 * it be archived normally. (In particular, if it was restored from the
4933 * archive to begin with, it's expected to have a .done file).
4934 */
4937 {
4939 XLogSegNo endLogSegNo;
4945 {
4954 /*
4955 * Make sure there's no .done or .ready file for the .partial
4956 * file.
4957 */
4962 }
4963 }
4964 }
4966 /*
4967 * Check to see if required parameters are set high enough on this server
4968 * for various aspects of recovery operation.
4969 *
4970 * Note that all the parameters which this function tests need to be
4971 * listed in Administrator's Overview section in high-availability.sgml.
4972 * If you change them, don't forget to update the list.
4973 */
4974 static void
4976 {
4977 /*
4978 * For archive recovery, the WAL must be generated with at least 'replica'
4979 * wal_level.
4980 */
4982 {
4987 }
4989 /*
4990 * For Hot Standby, the WAL must be generated with 'replica' mode, and we
4991 * must have at least as many backend slots as the primary.
4992 */
4994 {
4995 /* We ignore autovacuum_max_workers when we make this test. */
4997 MaxConnections,
5000 max_worker_processes,
5003 max_wal_senders,
5006 max_prepared_xacts,
5009 max_locks_per_xact,
5011 }
5012 }
5014 /*
5015 * This must be called ONCE during postmaster or standalone-backend startup
5016 */
5017 void
5019 {
5021 CheckPoint checkPoint;
5026 XLogRecPtr EndOfLog;
5027 TimeLineID EndOfLogTLI;
5028 TimeLineID newTLI;
5031 XLogRecPtr abortedRecPtr;
5032 XLogRecPtr missingContrecPtr;
5033 TransactionId oldestActiveXID;
5036 /*
5037 * We should have an aux process resource owner to use, and we should not
5038 * be in a transaction that's installed some other resowner.
5039 */
5045 /*
5046 * Check that contents look valid.
5047 */
5053 {
5056 /*
5057 * This is the expected case, so don't be chatty in standalone
5058 * mode
5059 */
5102 }
5104 /* This is just to allow attaching to startup process with a debugger */
5105 #ifdef XLOG_REPLAY_DELAY
5108 #endif
5110 /*
5111 * Verify that pg_wal and pg_wal/archive_status exist. In cases where
5112 * someone has performed a copy for PITR, these directories may have been
5113 * excluded and need to be re-created.
5114 */
5117 /* Set up timeout handler needed to report startup progress. */
5120 startup_progress_timeout_handler);
5122 /*----------
5123 * If we previously crashed, perform a couple of actions:
5124 *
5125 * - The pg_wal directory may still include some temporary WAL segments
5126 * used when creating a new segment, so perform some clean up to not
5127 * bloat this path. This is done first as there is no point to sync
5128 * this temporary data.
5129 *
5130 * - There might be data which we had written, intending to fsync it, but
5131 * which we had not actually fsync'd yet. Therefore, a power failure in
5132 * the near future might cause earlier unflushed writes to be lost, even
5133 * though more recent data written to disk from here on would be
5134 * persisted. To avoid that, fsync the entire data directory.
5135 */
5138 {
5142 }
5143 else
5146 /*
5147 * Prepare for WAL recovery if needed.
5148 *
5149 * InitWalRecovery analyzes the control file and the backup label file, if
5150 * any. It updates the in-memory ControlFile buffer according to the
5151 * starting checkpoint, and sets InRecovery and ArchiveRecoveryRequested.
5152 * It also applies the tablespace map file, if any.
5153 */
5158 /* initialize shared memory variables from the checkpoint record */
5170 /*
5171 * Clear out any old relcache cache files. This is *necessary* if we do
5172 * any WAL replay, since that would probably result in the cache files
5173 * being out of sync with database reality. In theory we could leave them
5174 * in place if the database had been cleanly shut down, but it seems
5175 * safest to just remove them always and let them be rebuilt during the
5176 * first backend startup. These files needs to be removed from all
5177 * directories including pg_tblspc, however the symlinks are created only
5178 * after reading tablespace_map file in case of archive recovery from
5179 * backup, so needs to clear old relcache files here after creating
5180 * symlinks.
5181 */
5184 /*
5185 * Initialize replication slots, before there's a chance to remove
5186 * required resources.
5187 */
5190 /*
5191 * Startup logical state, needs to be setup now so we have proper data
5192 * during crash recovery.
5193 */
5196 /*
5197 * Startup CLOG. This must be done after ShmemVariableCache->nextXid has
5198 * been initialized and before we accept connections or begin WAL replay.
5199 */
5202 /*
5203 * Startup MultiXact. We need to do this early to be able to replay
5204 * truncations.
5205 */
5208 /*
5209 * Ditto for commit timestamps. Activate the facility if the setting is
5210 * enabled in the control file, as there should be no tracking of commit
5211 * timestamps done when the setting was disabled. This facility can be
5212 * started or stopped when replaying a XLOG_PARAMETER_CHANGE record.
5213 */
5217 /*
5218 * Recover knowledge about replay progress of known replication partners.
5219 */
5222 /*
5223 * Initialize unlogged LSN. On a clean shutdown, it's restored from the
5224 * control file. On recovery, all unlogged relations are blown away, so
5225 * the unlogged LSN counter can be reset too.
5226 */
5229 else
5232 /*
5233 * Copy any missing timeline history files between 'now' and the recovery
5234 * target timeline from archive to pg_wal. While we don't need those files
5235 * ourselves - the history file of the recovery target timeline covers all
5236 * the previous timelines in the history too - a cascading standby server
5237 * might be interested in them. Or, if you archive the WAL from this
5238 * server to a different archive than the primary, it'd be good for all
5239 * the history files to get archived there after failover, so that you can
5240 * use one of the old timelines as a PITR target. Timeline history files
5241 * are small, so it's better to copy them unnecessarily than not copy them
5242 * and regret later.
5243 */
5246 /*
5247 * Before running in recovery, scan pg_twophase and fill in its status to
5248 * be able to work on entries generated by redo. Doing a scan before
5249 * taking any recovery action has the merit to discard any 2PC files that
5250 * are newer than the first record to replay, saving from any conflicts at
5251 * replay. This avoids as well any subsequent scans when doing recovery
5252 * of the on-disk two-phase data.
5253 */
5256 /*
5257 * When starting with crash recovery, reset pgstat data - it might not be
5258 * valid. Otherwise restore pgstat data. It's safe to do this here,
5259 * because postmaster will not yet have started any other processes.
5260 *
5261 * NB: Restoring replication slot stats relies on slot state to have
5262 * already been restored from disk.
5263 *
5264 * TODO: With a bit of extra work we could just start with a pgstat file
5265 * associated with the checkpoint redo location we're starting from.
5266 */
5269 else
5277 /* REDO */
5279 {
5280 /* Initialize state for RecoveryInProgress() */
5284 else
5288 /*
5289 * Update pg_control to show that we are recovering and to show the
5290 * selected checkpoint as the place we are starting from. We also mark
5291 * pg_control with any minimum recovery stop point obtained from a
5292 * backup history file.
5293 *
5294 * No need to hold ControlFileLock yet, we aren't up far enough.
5295 */
5298 /*
5299 * If there was a backup label file, it's done its job and the info
5300 * has now been propagated into pg_control. We must get rid of the
5301 * label file so that if we crash during recovery, we'll pick up at
5302 * the latest recovery restartpoint instead of going all the way back
5303 * to the backup start point. It seems prudent though to just rename
5304 * the file out of the way rather than delete it completely.
5305 */
5307 {
5310 }
5312 /*
5313 * If there was a tablespace_map file, it's done its job and the
5314 * symlinks have been created. We must get rid of the map file so
5315 * that if we crash during recovery, we don't create symlinks again.
5316 * It seems prudent though to just rename the file out of the way
5317 * rather than delete it completely.
5318 */
5320 {
5323 }
5325 /*
5326 * Initialize our local copy of minRecoveryPoint. When doing crash
5327 * recovery we want to replay up to the end of WAL. Particularly, in
5328 * the case of a promoted standby minRecoveryPoint value in the
5329 * control file is only updated after the first checkpoint. However,
5330 * if the instance crashes before the first post-recovery checkpoint
5331 * is completed then recovery will use a stale location causing the
5332 * startup process to think that there are still invalid page
5333 * references when checking for data consistency.
5334 */
5336 {
5339 }
5340 else
5341 {
5344 }
5346 /* Check that the GUCs used to generate the WAL allow recovery */
5349 /*
5350 * We're in recovery, so unlogged relations may be trashed and must be
5351 * reset. This should be done BEFORE allowing Hot Standby
5352 * connections, so that read-only backends don't try to read whatever
5353 * garbage is left over from before.
5354 */
5357 /*
5358 * Likewise, delete any saved transaction snapshot files that got left
5359 * behind by crashed backends.
5360 */
5363 /*
5364 * Initialize for Hot Standby, if enabled. We won't let backends in
5365 * yet, not until we've reached the min recovery point specified in
5366 * control file and we've established a recovery snapshot from a
5367 * running-xacts WAL record.
5368 */
5370 {
5381 else
5385 /* Tell procarray about the range of xids it has to deal with */
5388 /*
5389 * Startup subtrans only. CLOG, MultiXact and commit timestamp
5390 * have already been started up and other SLRUs are not maintained
5391 * during recovery and need not be started yet.
5392 */
5395 /*
5396 * If we're beginning at a shutdown checkpoint, we know that
5397 * nothing was running on the primary at this point. So fake-up an
5398 * empty running-xacts record and use that here and now. Recover
5399 * additional standby state for prepared transactions.
5400 */
5402 {
5403 RunningTransactionsData running;
5404 TransactionId latestCompletedXid;
5406 /*
5407 * Construct a RunningTransactions snapshot representing a
5408 * shut down server, with only prepared transactions still
5409 * alive. We're never overflowed at this point because all
5410 * subxids are listed with their parent prepared transactions.
5411 */
5426 }
5427 }
5429 /*
5430 * We're all set for replaying the WAL now. Do it.
5431 */
5434 }
5435 else
5438 /*
5439 * Finish WAL recovery.
5440 */
5447 /*
5448 * Reset ps status display, so as no information related to recovery
5449 * shows up.
5450 */
5453 /*
5454 * When recovering from a backup (we are in recovery, and archive recovery
5455 * was requested), complain if we did not roll forward far enough to reach
5456 * the point where the database is consistent. For regular online
5457 * backup-from-primary, that means reaching the end-of-backup WAL record
5458 * (at which point we reset backupStartPoint to be Invalid), for
5459 * backup-from-replica (which can't inject records into the WAL stream),
5460 * that point is when we reach the minRecoveryPoint in pg_control (which
5461 * we purposefully copy last when backing up from a replica). For
5462 * pg_rewind (which creates a backup_label with a method of "pg_rewind")
5463 * or snapshot-style backups (which don't), backupEndRequired will be set
5464 * to false.
5465 *
5466 * Note: it is indeed okay to look at the local variable
5467 * LocalMinRecoveryPoint here, even though ControlFile->minRecoveryPoint
5468 * might be further ahead --- ControlFile->minRecoveryPoint cannot have
5469 * been advanced beyond the WAL we processed.
5470 */
5474 {
5475 /*
5476 * Ran off end of WAL before reaching end-of-backup WAL record, or
5477 * minRecoveryPoint. That's a bad sign, indicating that you tried to
5478 * recover from an online backup but never called pg_backup_stop(), or
5479 * you didn't archive all the WAL needed.
5480 */
5482 {
5487 else
5490 }
5491 }
5493 /*
5494 * Reset unlogged relations to the contents of their INIT fork. This is
5495 * done AFTER recovery is complete so as to include any unlogged relations
5496 * created during recovery, but BEFORE recovery is marked as having
5497 * completed successfully. Otherwise we'd not retry if any of the post
5498 * end-of-recovery steps fail.
5499 */
5503 /*
5504 * Pre-scan prepared transactions to find out the range of XIDs present.
5505 * This information is not quite needed yet, but it is positioned here so
5506 * as potential problems are detected before any on-disk change is done.
5507 */
5510 /*
5511 * Allow ordinary WAL segment creation before possibly switching to a new
5512 * timeline, which creates a new segment, and after the last ReadRecord().
5513 */
5516 /*
5517 * Consider whether we need to assign a new timeline ID.
5518 *
5519 * If we did archive recovery, we always assign a new ID. This handles a
5520 * couple of issues. If we stopped short of the end of WAL during
5521 * recovery, then we are clearly generating a new timeline and must assign
5522 * it a unique new ID. Even if we ran to the end, modifying the current
5523 * last segment is problematic because it may result in trying to
5524 * overwrite an already-archived copy of that segment, and we encourage
5525 * DBAs to make their archive_commands reject that. We can dodge the
5526 * problem by making the new active segment have a new timeline ID.
5527 *
5528 * In a normal crash recovery, we can just extend the timeline we were in.
5529 */
5532 {
5537 /*
5538 * Make a writable copy of the last WAL segment. (Note that we also
5539 * have a copy of the last block of the old WAL in
5540 * endOfRecovery->lastPage; we will use that below.)
5541 */
5544 /*
5545 * Remove the signal files out of the way, so that we don't
5546 * accidentally re-enter archive recovery mode in a subsequent crash.
5547 */
5554 /*
5555 * Write the timeline history file, and have it archived. After this
5556 * point (or rather, as soon as the file is archived), the timeline
5557 * will appear as "taken" in the WAL archive and to any standby
5558 * servers. If we crash before actually switching to the new
5559 * timeline, standby servers will nevertheless think that we switched
5560 * to the new timeline, and will try to connect to the new timeline.
5561 * To minimize the window for that, try to do as little as possible
5562 * between here and writing the end-of-recovery record.
5563 */
5569 }
5571 /* Save the selected TimeLineID in shared memory, too */
5575 /*
5576 * Actually, if WAL ended in an incomplete record, skip the parts that
5577 * made it through and start writing after the portion that persisted.
5578 * (It's critical to first write an OVERWRITE_CONTRECORD message, which
5579 * we'll do as soon as we're open for writing new WAL.)
5580 */
5582 {
5583 /*
5584 * We should only have a missingContrecPtr if we're not switching to
5585 * a new timeline. When a timeline switch occurs, WAL is copied from
5586 * the old timeline to the new only up to the end of the last complete
5587 * record, so there can't be an incomplete WAL record that we need to
5588 * disregard.
5589 */
5593 }
5595 /*
5596 * Prepare to write WAL starting at EndOfLog location, and init xlog
5597 * buffer cache using the block containing the last record from the
5598 * previous incarnation.
5599 */
5604 /*
5605 * Tricky point here: lastPage contains the *last* block that the LastRec
5606 * record spans, not the one it starts in. The last block is indeed the
5607 * one we want to use.
5608 */
5610 {
5619 /* Copy the valid part of the last block, and zero the rest */
5626 }
5627 else
5628 {
5629 /*
5630 * There is no partial block to copy. Just set InitializedUpTo, and
5631 * let the first attempt to insert a log record to initialize the next
5632 * buffer.
5633 */
5635 }
5644 /*
5645 * Preallocate additional log files, if wanted.
5646 */
5649 /*
5650 * Okay, we're officially UP.
5651 */
5654 /* start the archive_timeout timer and LSN running */
5658 /* also initialize latestCompletedXid, to nextXid - 1 */
5664 /*
5665 * Start up subtrans, if not already done for hot standby. (commit
5666 * timestamps are started below, if necessary.)
5667 */
5671 /*
5672 * Perform end of recovery actions for any SLRUs that need it.
5673 */
5677 /* Reload shared-memory state for prepared transactions */
5680 /* Shut down xlogreader */
5683 /* Enable WAL writes for this backend only. */
5686 /* If necessary, write overwrite-contrecord before doing anything else */
5688 {
5691 }
5693 /*
5694 * Update full_page_writes in shared memory and write an XLOG_FPW_CHANGE
5695 * record before resource manager writes cleanup WAL records or checkpoint
5696 * record is written.
5697 */
5701 /*
5702 * Emit checkpoint or end-of-recovery record in XLOG, if required.
5703 */
5707 /*
5708 * If any of the critical GUCs have changed, log them before we allow
5709 * backends to write WAL.
5710 */
5713 /* If this is archive recovery, perform post-recovery cleanup actions. */
5717 /*
5718 * Local WAL inserts enabled, so it's time to finish initialization of
5719 * commit timestamp.
5720 */
5723 /*
5724 * All done with end-of-recovery actions.
5725 *
5726 * Now allow backends to write WAL and update the control file status in
5727 * consequence. SharedRecoveryState, that controls if backends can write
5728 * WAL, is updated while holding ControlFileLock to prevent other backends
5729 * to look at an inconsistent state of the control file in shared memory.
5730 * There is still a small window during which backends can write WAL and
5731 * the control file is still referring to a system not in DB_IN_PRODUCTION
5732 * state while looking at the on-disk control file.
5733 *
5734 * Also, we use info_lck to update SharedRecoveryState to ensure that
5735 * there are no race conditions concerning visibility of other recent
5736 * updates to shared memory.
5737 */
5748 /*
5749 * Shutdown the recovery environment. This must occur after
5750 * RecoverPreparedTransactions() (see notes in lock_twophase_recover())
5751 * and after switching SharedRecoveryState to RECOVERY_STATE_DONE so as
5752 * any session building a snapshot will not rely on KnownAssignedXids as
5753 * RecoveryInProgress() would return false at this stage. This is
5754 * particularly critical for prepared 2PC transactions, that would still
5755 * need to be included in snapshots once recovery has ended.
5756 */
5760 /*
5761 * If there were cascading standby servers connected to us, nudge any wal
5762 * sender processes to notice that we've been promoted.
5763 */
5766 /*
5767 * If this was a promotion, request an (online) checkpoint now. This isn't
5768 * required for consistency, but the last restartpoint might be far back,
5769 * and in case of a crash, recovering from it might take a longer than is
5770 * appropriate now that we're not in standby mode anymore.
5771 */
5774 }
5776 /*
5777 * Callback from PerformWalRecovery(), called when we switch from crash
5778 * recovery to archive recovery mode. Updates the control file accordingly.
5779 */
5780 void
5782 {
5783 /* initialize minRecoveryPoint to this record */
5787 {
5790 }
5791 /* update local copy */
5795 /*
5796 * The startup process can update its local copy of minRecoveryPoint from
5797 * this point.
5798 */
5803 /*
5804 * We update SharedRecoveryState while holding the lock on ControlFileLock
5805 * so both states are consistent in shared memory.
5806 */
5812 }
5814 /*
5815 * Callback from PerformWalRecovery(), called when we reach the end of backup.
5816 * Updates the control file accordingly.
5817 */
5818 void
5820 {
5821 /*
5822 * We have reached the end of base backup, as indicated by pg_control. The
5823 * data on disk is now consistent (unless minRecovery point is further
5824 * ahead, which can happen if we crashed during previous recovery). Reset
5825 * backupStartPoint and backupEndPoint, and update minRecoveryPoint to
5826 * make sure we don't allow starting up at an earlier point even if
5827 * recovery is stopped and restarted soon after this.
5828 */
5832 {
5835 }
5843 }
5845 /*
5846 * Perform whatever XLOG actions are necessary at end of REDO.
5847 *
5848 * The goal here is to make sure that we'll be able to recover properly if
5849 * we crash again. If we choose to write a checkpoint, we'll write a shutdown
5850 * checkpoint rather than an on-line one. This is not particularly critical,
5851 * but since we may be assigning a new TLI, using a shutdown checkpoint allows
5852 * us to have the rule that TLI only changes in shutdown checkpoints, which
5853 * allows some extra error checking in xlog_redo.
5854 */
5855 static bool
5857 {
5860 /*
5861 * Perform a checkpoint to update all our recovery activity to disk.
5862 *
5863 * Note that we write a shutdown checkpoint rather than an on-line one.
5864 * This is not particularly critical, but since we may be assigning a new
5865 * TLI, using a shutdown checkpoint allows us to have the rule that TLI
5866 * only changes in shutdown checkpoints, which allows some extra error
5867 * checking in xlog_redo.
5868 *
5869 * In promotion, only create a lightweight end-of-recovery record instead
5870 * of a full checkpoint. A checkpoint is requested later, after we're
5871 * fully out of recovery mode and already accepting queries.
5872 */
5875 {
5878 /*
5879 * Insert a special WAL record to mark the end of recovery, since we
5880 * aren't doing a checkpoint. That means that the checkpointer process
5881 * may likely be in the middle of a time-smoothed restartpoint and
5882 * could continue to be for minutes after this. That sounds strange,
5883 * but the effect is roughly the same and it would be stranger to try
5884 * to come out of the restartpoint and then checkpoint. We request a
5885 * checkpoint later anyway, just for safety.
5886 */
5888 }
5889 else
5890 {
5892 CHECKPOINT_IMMEDIATE |
5893 CHECKPOINT_WAIT);
5894 }
5897 }
5899 /*
5900 * Is the system still in recovery?
5901 *
5902 * Unlike testing InRecovery, this works in any process that's connected to
5903 * shared memory.
5904 */
5905 bool
5907 {
5908 /*
5909 * We check shared state each time only until we leave recovery mode. We
5910 * can't re-enter recovery, so there's no need to keep checking after the
5911 * shared variable has once been seen false.
5912 */
5915 else
5916 {
5917 /*
5918 * use volatile pointer to make sure we make a fresh read of the
5919 * shared variable.
5920 */
5925 /*
5926 * Note: We don't need a memory barrier when we're still in recovery.
5927 * We might exit recovery immediately after return, so the caller
5928 * can't rely on 'true' meaning that we're still in recovery anyway.
5929 */
5932 }
5933 }
5935 /*
5936 * Returns current recovery state from shared memory.
5937 *
5938 * This returned state is kept consistent with the contents of the control
5939 * file. See details about the possible values of RecoveryState in xlog.h.
5940 */
5941 RecoveryState
5943 {
5944 RecoveryState retval;
5951 }
5953 /*
5954 * Is this process allowed to insert new WAL records?
5955 *
5956 * Ordinarily this is essentially equivalent to !RecoveryInProgress().
5957 * But we also have provisions for forcing the result "true" or "false"
5958 * within specific processes regardless of the global state.
5959 */
5960 bool
5962 {
5963 /*
5964 * If value is "unconditionally true" or "unconditionally false", just
5965 * return it. This provides the normal fast path once recovery is known
5966 * done.
5967 */
5971 /*
5972 * Else, must check to see if we're still in recovery.
5973 */
5977 /*
5978 * On exit from recovery, reset to "unconditionally true", since there is
5979 * no need to keep checking.
5980 */
5983 }
5985 /*
5986 * Make XLogInsertAllowed() return true in the current process only.
5987 *
5988 * Note: it is allowed to switch LocalXLogInsertAllowed back to -1 later,
5989 * and even call LocalSetXLogInsertAllowed() again after that.
5990 *
5991 * Returns the previous value of LocalXLogInsertAllowed.
5992 */
5993 static int
5995 {
6001 }
6003 /*
6004 * Return the current Redo pointer from shared memory.
6005 *
6006 * As a side-effect, the local RedoRecPtr copy is updated.
6007 */
6008 XLogRecPtr
6010 {
6011 XLogRecPtr ptr;
6013 /*
6014 * The possibly not up-to-date copy in XlogCtl is enough. Even if we
6015 * grabbed a WAL insertion lock to read the authoritative value in
6016 * Insert->RedoRecPtr, someone might update it just after we've released
6017 * the lock.
6018 */
6027 }
6029 /*
6030 * Return information needed to decide whether a modified block needs a
6031 * full-page image to be included in the WAL record.
6032 *
6033 * The returned values are cached copies from backend-private memory, and
6034 * possibly out-of-date or, indeed, uninitialized, in which case they will
6035 * be InvalidXLogRecPtr and false, respectively. XLogInsertRecord will
6036 * re-check them against up-to-date values, while holding the WAL insert lock.
6037 */
6038 void
6040 {
6043 }
6045 /*
6046 * GetInsertRecPtr -- Returns the current insert position.
6047 *
6048 * NOTE: The value *actually* returned is the position of the last full
6049 * xlog page. It lags behind the real insert position by at most 1 page.
6050 * For that, we don't need to scan through WAL insertion locks, and an
6051 * approximation is enough for the current usage of this function.
6052 */
6053 XLogRecPtr
6055 {
6056 XLogRecPtr recptr;
6063 }
6065 /*
6066 * GetFlushRecPtr -- Returns the current flush position, ie, the last WAL
6067 * position known to be fsync'd to disk. This should only be used on a
6068 * system that is known not to be in recovery.
6069 */
6070 XLogRecPtr
6072 {
6079 /*
6080 * If we're writing and flushing WAL, the time line can't be changing, so
6081 * no lock is required.
6082 */
6087 }
6089 /*
6090 * GetWALInsertionTimeLine -- Returns the current timeline of a system that
6091 * is not in recovery.
6092 */
6093 TimeLineID
6095 {
6098 /* Since the value can't be changing, no lock is required. */
6100 }
6102 /*
6103 * GetLastImportantRecPtr -- Returns the LSN of the last important record
6104 * inserted. All records not explicitly marked as unimportant are considered
6105 * important.
6106 *
6107 * The LSN is determined by computing the maximum of
6108 * WALInsertLocks[i].lastImportantAt.
6109 */
6110 XLogRecPtr
6112 {
6117 {
6118 XLogRecPtr last_important;
6120 /*
6121 * Need to take a lock to prevent torn reads of the LSN, which are
6122 * possible on some of the supported platforms. WAL insert locks only
6123 * support exclusive mode, so we have to use that.
6124 */
6131 }
6134 }
6136 /*
6137 * Get the time and LSN of the last xlog segment switch
6138 */
6139 pg_time_t
6141 {
6142 pg_time_t result;
6144 /* Need WALWriteLock, but shared lock is sufficient */
6151 }
6153 /*
6154 * This must be called ONCE during postmaster or standalone-backend shutdown
6155 */
6156 void
6158 {
6159 /*
6160 * We should have an aux process resource owner to use, and we should not
6161 * be in a transaction that's installed some other resowner.
6162 */
6168 /* Don't be chatty in standalone mode */
6172 /*
6173 * Signal walsenders to move to stopping state.
6174 */
6177 /*
6178 * Wait for WAL senders to be in stopping state. This prevents commands
6179 * from writing new WAL.
6180 */
6185 else
6186 {
6187 /*
6188 * If archiving is enabled, rotate the last XLOG file so that all the
6189 * remaining records are archived (postmaster wakes up the archiver
6190 * process one more time at the end of shutdown). The checkpoint
6191 * record will go to the next XLOG file and won't be archived (yet).
6192 */
6197 }
6198 }
6200 /*
6201 * Log start of a checkpoint.
6202 */
6203 static void
6205 {
6208 /* translator: the placeholders show checkpoint options */
6218 else
6220 /* translator: the placeholders show checkpoint options */
6230 }
6232 /*
6233 * Log end of a checkpoint.
6234 */
6235 static void
6237 {
6239 sync_msecs,
6240 total_msecs,
6241 longest_msecs,
6242 average_msecs;
6243 uint64 average_sync_time;
6253 /* Accumulate checkpoint timing summary data, in milliseconds. */
6257 /*
6258 * All of the published timing statistics are accounted for. Only
6259 * continue if a log message is to be written.
6260 */
6267 /*
6268 * Timing values returned from CheckpointStats are in microseconds.
6269 * Convert to milliseconds for consistent printing.
6270 */
6279 /*
6280 * ControlFileLock is not required to see ControlFile->checkPoint and
6281 * ->checkPointCopy here as we are the only updator of those variables at
6282 * this moment.
6283 */
6287 "%d WAL file(s) added, %d removed, %d recycled; "
6288 "write=%ld.%03d s, sync=%ld.%03d s, total=%ld.%03d s; "
6289 "sync files=%d, longest=%ld.%03d s, average=%ld.%03d s; "
6290 "distance=%d kB, estimate=%d kB; "
6307 else
6310 "%d WAL file(s) added, %d removed, %d recycled; "
6311 "write=%ld.%03d s, sync=%ld.%03d s, total=%ld.%03d s; "
6312 "sync files=%d, longest=%ld.%03d s, average=%ld.%03d s; "
6313 "distance=%d kB, estimate=%d kB; "
6330 }
6332 /*
6333 * Update the estimate of distance between checkpoints.
6334 *
6335 * The estimate is used to calculate the number of WAL segments to keep
6336 * preallocated, see XLOGfileslop().
6337 */
6338 static void
6340 {
6341 /*
6342 * To estimate the number of segments consumed between checkpoints, keep a
6343 * moving average of the amount of WAL generated in previous checkpoint
6344 * cycles. However, if the load is bursty, with quiet periods and busy
6345 * periods, we want to cater for the peak load. So instead of a plain
6346 * moving average, let the average decline slowly if the previous cycle
6347 * used less WAL than estimated, but bump it up immediately if it used
6348 * more.
6349 *
6350 * When checkpoints are triggered by max_wal_size, this should converge to
6351 * CheckpointSegments * wal_segment_size,
6352 *
6353 * Note: This doesn't pay any attention to what caused the checkpoint.
6354 * Checkpoints triggered manually with CHECKPOINT command, or by e.g.
6355 * starting a base backup, are counted the same as those created
6356 * automatically. The slow-decline will largely mask them out, if they are
6357 * not frequent. If they are frequent, it seems reasonable to count them
6358 * in as any others; if you issue a manual checkpoint every 5 minutes and
6359 * never let a timed checkpoint happen, it makes sense to base the
6360 * preallocation on that 5 minute interval rather than whatever
6361 * checkpoint_timeout is set to.
6362 */
6366 else
6367 CheckPointDistanceEstimate =
6369 }
6371 /*
6372 * Update the ps display for a process running a checkpoint. Note that
6373 * this routine should not do any allocations so as it can be called
6374 * from a critical section.
6375 */
6376 static void
6378 {
6379 /*
6380 * The status is reported only for end-of-recovery and shutdown
6381 * checkpoints or shutdown restartpoints. Updating the ps display is
6382 * useful in those situations as it may not be possible to rely on
6383 * pg_stat_activity to see the status of the checkpointer or the startup
6384 * process.
6385 */
6391 else
6392 {
6400 }
6401 }
6404 /*
6405 * Perform a checkpoint --- either during shutdown, or on-the-fly
6406 *
6407 * flags is a bitwise OR of the following:
6408 * CHECKPOINT_IS_SHUTDOWN: checkpoint is for database shutdown.
6409 * CHECKPOINT_END_OF_RECOVERY: checkpoint is for end of WAL recovery.
6410 * CHECKPOINT_IMMEDIATE: finish the checkpoint ASAP,
6411 * ignoring checkpoint_completion_target parameter.
6412 * CHECKPOINT_FORCE: force a checkpoint even if no XLOG activity has occurred
6413 * since the last one (implied by CHECKPOINT_IS_SHUTDOWN or
6414 * CHECKPOINT_END_OF_RECOVERY).
6415 * CHECKPOINT_FLUSH_ALL: also flush buffers of unlogged tables.
6416 *
6417 * Note: flags contains other bits, of interest here only for logging purposes.
6418 * In particular note that this routine is synchronous and does not pay
6419 * attention to CHECKPOINT_WAIT.
6420 *
6421 * If !shutdown then we are writing an online checkpoint. This is a very special
6422 * kind of operation and WAL record because the checkpoint action occurs over
6423 * a period of time yet logically occurs at just a single LSN. The logical
6424 * position of the WAL record (redo ptr) is the same or earlier than the
6425 * physical position. When we replay WAL we locate the checkpoint via its
6426 * physical position then read the redo ptr and actually start replay at the
6427 * earlier logical position. Note that we don't write *anything* to WAL at
6428 * the logical position, so that location could be any other kind of WAL record.
6429 * All of this mechanism allows us to continue working while we checkpoint.
6430 * As a result, timing of actions is critical here and be careful to note that
6431 * this function will likely take minutes to execute on a busy system.
6432 */
6433 void
6435 {
6437 CheckPoint checkPoint;
6438 XLogRecPtr recptr;
6439 XLogSegNo _logSegNo;
6441 uint32 freespace;
6442 XLogRecPtr PriorRedoPtr;
6443 XLogRecPtr curInsert;
6444 XLogRecPtr last_important_lsn;
6449 /*
6450 * An end-of-recovery checkpoint is really a shutdown checkpoint, just
6451 * issued at a different time.
6452 */
6455 else
6458 /* sanity check */
6462 /*
6463 * Prepare to accumulate statistics.
6464 *
6465 * Note: because it is possible for log_checkpoints to change while a
6466 * checkpoint proceeds, we always accumulate stats, even if
6467 * log_checkpoints is currently off.
6468 */
6472 /*
6473 * Let smgr prepare for checkpoint; this has to happen outside the
6474 * critical section and before we determine the REDO pointer. Note that
6475 * smgr must not do anything that'd have to be undone if we decide no
6476 * checkpoint is needed.
6477 */
6480 /*
6481 * Use a critical section to force system panic if we have trouble.
6482 */
6486 {
6491 }
6493 /* Begin filling in the checkpoint WAL record */
6497 /*
6498 * For Hot Standby, derive the oldestActiveXid before we fix the redo
6499 * pointer. This allows us to begin accumulating changes to assemble our
6500 * starting snapshot of locks and transactions.
6501 */
6504 else
6507 /*
6508 * Get location of last important record before acquiring insert locks (as
6509 * GetLastImportantRecPtr() also locks WAL locks).
6510 */
6513 /*
6514 * We must block concurrent insertions while examining insert state to
6515 * determine the checkpoint REDO pointer.
6516 */
6520 /*
6521 * If this isn't a shutdown or forced checkpoint, and if there has been no
6522 * WAL activity requiring a checkpoint, skip it. The idea here is to
6523 * avoid inserting duplicate checkpoints when the system is idle.
6524 */
6527 {
6529 {
6535 }
6536 }
6538 /*
6539 * An end-of-recovery checkpoint is created before anyone is allowed to
6540 * write WAL. To allow us to write the checkpoint record, temporarily
6541 * enable XLogInsertAllowed.
6542 */
6549 else
6554 /*
6555 * Compute new REDO record ptr = location of next XLOG record.
6556 *
6557 * NB: this is NOT necessarily where the checkpoint record itself will be,
6558 * since other backends may insert more XLOG records while we're off doing
6559 * the buffer flush work. Those XLOG records are logically after the
6560 * checkpoint, even though physically before it. Got that?
6561 */
6564 {
6567 else
6569 }
6572 /*
6573 * Here we update the shared RedoRecPtr for future XLogInsert calls; this
6574 * must be done while holding all the insertion locks.
6575 *
6576 * Note: if we fail to complete the checkpoint, RedoRecPtr will be left
6577 * pointing past where it really needs to point. This is okay; the only
6578 * consequence is that XLogInsert might back up whole buffers that it
6579 * didn't really need to. We can't postpone advancing RedoRecPtr because
6580 * XLogInserts that happen while we are dumping buffers must assume that
6581 * their buffer changes are not included in the checkpoint.
6582 */
6585 /*
6586 * Now we can release the WAL insertion locks, allowing other xacts to
6587 * proceed while we are flushing disk buffers.
6588 */
6591 /* Update the info_lck-protected copy of RedoRecPtr as well */
6596 /*
6597 * If enabled, log checkpoint start. We postpone this until now so as not
6598 * to log anything if we decided to skip the checkpoint.
6599 */
6603 /* Update the process title */
6608 /*
6609 * Get the other info we need for the checkpoint record.
6610 *
6611 * We don't need to save oldestClogXid in the checkpoint, it only matters
6612 * for the short period in which clog is being truncated, and if we crash
6613 * during that we'll redo the clog truncation and fix up oldestClogXid
6614 * there.
6615 */
6639 /*
6640 * Having constructed the checkpoint record, ensure all shmem disk buffers
6641 * and commit-log buffers are flushed to disk.
6642 *
6643 * This I/O could fail for various reasons. If so, we will fail to
6644 * complete the checkpoint, but there is no reason to force a system
6645 * panic. Accordingly, exit critical section while doing it.
6646 */
6649 /*
6650 * In some cases there are groups of actions that must all occur on one
6651 * side or the other of a checkpoint record. Before flushing the
6652 * checkpoint record we must explicitly wait for any backend currently
6653 * performing those groups of actions.
6654 *
6655 * One example is end of transaction, so we must wait for any transactions
6656 * that are currently in commit critical sections. If an xact inserted
6657 * its commit record into XLOG just before the REDO point, then a crash
6658 * restart from the REDO point would not replay that record, which means
6659 * that our flushing had better include the xact's update of pg_xact. So
6660 * we wait till he's out of his commit critical section before proceeding.
6661 * See notes in RecordTransactionCommit().
6662 *
6663 * Because we've already released the insertion locks, this test is a bit
6664 * fuzzy: it is possible that we will wait for xacts we didn't really need
6665 * to wait for. But the delay should be short and it seems better to make
6666 * checkpoint take a bit longer than to hold off insertions longer than
6667 * necessary. (In fact, the whole reason we have this issue is that xact.c
6668 * does commit record XLOG insertion and clog update as two separate steps
6669 * protected by different locks, but again that seems best on grounds of
6670 * minimizing lock contention.)
6671 *
6672 * A transaction that has not yet set delayChkptFlags when we look cannot
6673 * be at risk, since it has not inserted its commit record yet; and one
6674 * that's already cleared it is not at risk either, since it's done fixing
6675 * clog and we will correctly flush the update below. So we cannot miss
6676 * any xacts we need to wait for.
6677 */
6680 {
6681 do
6682 {
6685 DELAY_CHKPT_START));
6686 }
6693 {
6694 do
6695 {
6698 DELAY_CHKPT_COMPLETE));
6699 }
6702 /*
6703 * Take a snapshot of running transactions and write this to WAL. This
6704 * allows us to reconstruct the state of running transactions during
6705 * archive recovery, if required. Skip, if this info disabled.
6706 *
6707 * If we are shutting down, or Startup process is completing crash
6708 * recovery we don't need to write running xact data.
6709 */
6715 /*
6716 * Now insert the checkpoint record into XLOG.
6717 */
6722 XLOG_CHECKPOINT_ONLINE);
6726 /*
6727 * We mustn't write any new WAL after a shutdown checkpoint, or it will be
6728 * overwritten at next startup. No-one should even try, this just allows
6729 * sanity-checking. In the case of an end-of-recovery checkpoint, we want
6730 * to just temporarily disable writing until the system has exited
6731 * recovery.
6732 */
6734 {
6737 else
6739 }
6741 /*
6742 * We now have ProcLastRecPtr = start of actual checkpoint record, recptr
6743 * = end of actual checkpoint record.
6744 */
6749 /*
6750 * Remember the prior checkpoint's redo ptr for
6751 * UpdateCheckPointDistanceEstimate()
6752 */
6755 /*
6756 * Update the control file.
6757 */
6763 /* crash recovery should always recover to the end of WAL */
6767 /*
6768 * Persist unloggedLSN value. It's reset on crash recovery, so this goes
6769 * unused on non-shutdown checkpoints, but seems useful to store it always
6770 * for debugging purposes.
6771 */
6779 /* Update shared-memory copy of checkpoint XID/epoch */
6784 /*
6785 * We are now done with critical updates; no need for system panic if we
6786 * have trouble while fooling with old log segments.
6787 */
6790 /*
6791 * Let smgr do post-checkpoint cleanup (eg, deleting old files).
6792 */
6795 /*
6796 * Update the average distance between checkpoints if the prior checkpoint
6797 * exists.
6798 */
6802 /*
6803 * Delete old log files, those no longer needed for last checkpoint to
6804 * prevent the disk holding the xlog from growing full.
6805 */
6809 {
6810 /*
6811 * Some slots have been invalidated; recalculate the old-segment
6812 * horizon, starting again from RedoRecPtr.
6813 */
6816 }
6817 _logSegNo--;
6821 /*
6822 * Make more log segments if needed. (Do this after recycling old log
6823 * segments, since that may supply some of the needed files.)
6824 */
6828 /*
6829 * Truncate pg_subtrans if possible. We can throw away all data before
6830 * the oldest XMIN of any running transaction. No future transaction will
6831 * attempt to reference any pg_subtrans entry older than that (see Asserts
6832 * in subtrans.c). During recovery, though, we mustn't do this because
6833 * StartupSUBTRANS hasn't been called yet.
6834 */
6838 /* Real work is done; log and update stats. */
6841 /* Reset the process title */
6845 NBuffers,
6849 }
6851 /*
6852 * Mark the end of recovery in WAL though without running a full checkpoint.
6853 * We can expect that a restartpoint is likely to be in progress as we
6854 * do this, though we are unwilling to wait for it to complete.
6855 *
6856 * CreateRestartPoint() allows for the case where recovery may end before
6857 * the restartpoint completes so there is no concern of concurrent behaviour.
6858 */
6859 static void
6861 {
6862 xl_end_of_recovery xlrec;
6863 XLogRecPtr recptr;
6865 /* sanity check */
6884 /*
6885 * Update the control file so that crash recovery can follow the timeline
6886 * changes to this point.
6887 */
6895 }
6897 /*
6898 * Write an OVERWRITE_CONTRECORD message.
6899 *
6900 * When on WAL replay we expect a continuation record at the start of a page
6901 * that is not there, recovery ends and WAL writing resumes at that point.
6902 * But it's wrong to resume writing new WAL back at the start of the record
6903 * that was broken, because downstream consumers of that WAL (physical
6904 * replicas) are not prepared to "rewind". So the first action after
6905 * finishing replay of all valid WAL must be to write a record of this type
6906 * at the point where the contrecord was missing; to support xlogreader
6907 * detecting the special case, XLP_FIRST_IS_OVERWRITE_CONTRECORD is also added
6908 * to the page header where the record occurs. xlogreader has an ad-hoc
6909 * mechanism to report metadata about the broken record, which is what we
6910 * use here.
6911 *
6912 * At replay time, XLP_FIRST_IS_OVERWRITE_CONTRECORD instructs xlogreader to
6913 * skip the record it was reading, and pass back the LSN of the skipped
6914 * record, so that its caller can verify (on "replay" of that record) that the
6915 * XLOG_OVERWRITE_CONTRECORD matches what was effectively overwritten.
6916 *
6917 * 'aborted_lsn' is the beginning position of the record that was incomplete.
6918 * It is included in the WAL record. 'pagePtr' and 'newTLI' point to the
6919 * beginning of the XLOG page where the record is to be inserted. They must
6920 * match the current WAL insert position, they're passed here just so that we
6921 * can verify that.
6922 */
6923 static XLogRecPtr
6925 TimeLineID newTLI)
6926 {
6927 xl_overwrite_contrecord xlrec;
6928 XLogRecPtr recptr;
6929 XLogPageHeader pagehdr;
6930 XLogRecPtr startPos;
6932 /* sanity checks */
6939 /* The current WAL insert position should be right after the page header */
6943 else
6952 /*
6953 * Initialize the XLOG page header (by GetXLogBuffer), and set the
6954 * XLP_FIRST_IS_OVERWRITE_CONTRECORD flag.
6955 *
6956 * No other backend is allowed to write WAL yet, so acquiring the WAL
6957 * insertion lock is just pro forma.
6958 */
6964 /*
6965 * Insert the XLOG_OVERWRITE_CONTRECORD record as the first record on the
6966 * page. We know it becomes the first record, because no other backend is
6967 * allowed to write WAL yet.
6968 */
6975 /* check that the record was inserted to the right place */
6985 }
6987 /*
6988 * Flush all data in shared memory to disk, and fsync
6989 *
6990 * This is the common code shared between regular checkpoints and
6991 * recovery restartpoints.
6992 */
6993 static void
6995 {
7002 /* Write out all dirty data in SLRUs and the main buffer pool */
7012 /* Perform all queued up fsyncs */
7019 /* We deliberately delay 2PC checkpointing as long as possible */
7021 }
7023 /*
7024 * Save a checkpoint for recovery restart if appropriate
7025 *
7026 * This function is called each time a checkpoint record is read from XLOG.
7027 * It must determine whether the checkpoint represents a safe restartpoint or
7028 * not. If so, the checkpoint record is stashed in shared memory so that
7029 * CreateRestartPoint can consult it. (Note that the latter function is
7030 * executed by the checkpointer, while this one will be executed by the
7031 * startup process.)
7032 */
7033 static void
7035 {
7036 /*
7037 * Also refrain from creating a restartpoint if we have seen any
7038 * references to non-existent pages. Restarting recovery from the
7039 * restartpoint would not see the references, so we would lose the
7040 * cross-check that the pages belonged to a relation that was dropped
7041 * later.
7042 */
7044 {
7046 "could not record restart point at %X/%X because there "
7050 }
7052 /*
7053 * Copy the checkpoint record to shared memory, so that checkpointer can
7054 * work out the next time it wants to perform a restartpoint.
7055 */
7061 }
7063 /*
7064 * Establish a restartpoint if possible.
7065 *
7066 * This is similar to CreateCheckPoint, but is used during WAL recovery
7067 * to establish a point from which recovery can roll forward without
7068 * replaying the entire recovery log.
7069 *
7070 * Returns true if a new restartpoint was established. We can only establish
7071 * a restartpoint if we have replayed a safe checkpoint record since last
7072 * restartpoint.
7073 */
7074 bool
7076 {
7077 XLogRecPtr lastCheckPointRecPtr;
7078 XLogRecPtr lastCheckPointEndPtr;
7079 CheckPoint lastCheckPoint;
7080 XLogRecPtr PriorRedoPtr;
7081 XLogRecPtr receivePtr;
7082 XLogRecPtr replayPtr;
7083 TimeLineID replayTLI;
7084 XLogRecPtr endptr;
7085 XLogSegNo _logSegNo;
7086 TimestampTz xtime;
7088 /* Concurrent checkpoint/restartpoint cannot happen */
7091 /* Get a local copy of the last safe checkpoint record. */
7098 /*
7099 * Check that we're still in recovery mode. It's ok if we exit recovery
7100 * mode after this check, the restart point is valid anyway.
7101 */
7103 {
7107 }
7109 /*
7110 * If the last checkpoint record we've replayed is already our last
7111 * restartpoint, we can't perform a new restart point. We still update
7112 * minRecoveryPoint in that case, so that if this is a shutdown restart
7113 * point, we won't start up earlier than before. That's not strictly
7114 * necessary, but when hot standby is enabled, it would be rather weird if
7115 * the database opened up for read-only connections at a point-in-time
7116 * before the last shutdown. Such time travel is still possible in case of
7117 * immediate shutdown, though.
7118 *
7119 * We don't explicitly advance minRecoveryPoint when we do create a
7120 * restartpoint. It's assumed that flushing the buffers will do that as a
7121 * side-effect.
7122 */
7125 {
7132 {
7137 }
7139 }
7141 /*
7142 * Update the shared RedoRecPtr so that the startup process can calculate
7143 * the number of segments replayed since last restartpoint, and request a
7144 * restartpoint if it exceeds CheckPointSegments.
7145 *
7146 * Like in CreateCheckPoint(), hold off insertions to update it, although
7147 * during recovery this is just pro forma, because no WAL insertions are
7148 * happening.
7149 */
7154 /* Also update the info_lck-protected copy */
7159 /*
7160 * Prepare to accumulate statistics.
7161 *
7162 * Note: because it is possible for log_checkpoints to change while a
7163 * checkpoint proceeds, we always accumulate stats, even if
7164 * log_checkpoints is currently off.
7165 */
7172 /* Update the process title */
7177 /*
7178 * Remember the prior checkpoint's redo ptr for
7179 * UpdateCheckPointDistanceEstimate()
7180 */
7183 /*
7184 * Update pg_control, using current time. Check that it still shows an
7185 * older checkpoint, else do nothing; this is a quick hack to make sure
7186 * nothing really bad happens if somehow we get here after the
7187 * end-of-recovery checkpoint.
7188 */
7191 {
7192 /*
7193 * Update the checkpoint information. We do this even if the cluster
7194 * does not show DB_IN_ARCHIVE_RECOVERY to match with the set of WAL
7195 * segments recycled below.
7196 */
7200 /*
7201 * Ensure minRecoveryPoint is past the checkpoint record and update it
7202 * if the control file still shows DB_IN_ARCHIVE_RECOVERY. Normally,
7203 * this will have happened already while writing out dirty buffers,
7204 * but not necessarily - e.g. because no buffers were dirtied. We do
7205 * this because a backup performed in recovery uses minRecoveryPoint
7206 * to determine which WAL files must be included in the backup, and
7207 * the file (or files) containing the checkpoint record must be
7208 * included, at a minimum. Note that for an ordinary restart of
7209 * recovery there's no value in having the minimum recovery point any
7210 * earlier than this anyway, because redo will begin just after the
7211 * checkpoint record.
7212 */
7214 {
7216 {
7220 /* update local copy */
7223 }
7226 }
7228 }
7231 /*
7232 * Update the average distance between checkpoints/restartpoints if the
7233 * prior checkpoint exists.
7234 */
7238 /*
7239 * Delete old log files, those no longer needed for last restartpoint to
7240 * prevent the disk holding the xlog from growing full.
7241 */
7244 /*
7245 * Retreat _logSegNo using the current end of xlog replayed or received,
7246 * whichever is later.
7247 */
7253 {
7254 /*
7255 * Some slots have been invalidated; recalculate the old-segment
7256 * horizon, starting again from RedoRecPtr.
7257 */
7260 }
7261 _logSegNo--;
7263 /*
7264 * Try to recycle segments on a useful timeline. If we've been promoted
7265 * since the beginning of this restartpoint, use the new timeline chosen
7266 * at end of recovery. If we're still in recovery, use the timeline we're
7267 * currently replaying.
7268 *
7269 * There is no guarantee that the WAL segments will be useful on the
7270 * current timeline; if recovery proceeds to a new timeline right after
7271 * this, the pre-allocated WAL segments on this timeline will not be used,
7272 * and will go wasted until recycled on the next restartpoint. We'll live
7273 * with that.
7274 */
7280 /*
7281 * Make more log segments if needed. (Do this after recycling old log
7282 * segments, since that may supply some of the needed files.)
7283 */
7286 /*
7287 * Truncate pg_subtrans if possible. We can throw away all data before
7288 * the oldest XMIN of any running transaction. No future transaction will
7289 * attempt to reference any pg_subtrans entry older than that (see Asserts
7290 * in subtrans.c). When hot standby is disabled, though, we mustn't do
7291 * this because StartupSUBTRANS hasn't been called yet.
7292 */
7296 /* Real work is done; log and update stats. */
7299 /* Reset the process title */
7309 /*
7310 * Finally, execute archive_cleanup_command, if any.
7311 */
7313 {
7318 }
7321 }
7323 /*
7324 * Report availability of WAL for the given target LSN
7325 * (typically a slot's restart_lsn)
7326 *
7327 * Returns one of the following enum values:
7328 *
7329 * * WALAVAIL_RESERVED means targetLSN is available and it is in the range of
7330 * max_wal_size.
7331 *
7332 * * WALAVAIL_EXTENDED means it is still available by preserving extra
7333 * segments beyond max_wal_size. If max_slot_wal_keep_size is smaller
7334 * than max_wal_size, this state is not returned.
7335 *
7336 * * WALAVAIL_UNRESERVED means it is being lost and the next checkpoint will
7337 * remove reserved segments. The walsender using this slot may return to the
7338 * above.
7339 *
7340 * * WALAVAIL_REMOVED means it has been removed. A replication stream on
7341 * a slot with this LSN cannot continue. (Any associated walsender
7342 * processes should have been terminated already.)
7343 *
7344 * * WALAVAIL_INVALID_LSN means the slot hasn't been set to reserve WAL.
7345 */
7346 WALAvailability
7348 {
7355 uint64 keepSegs;
7357 /*
7358 * slot does not reserve WAL. Either deactivated, or has never been active
7359 */
7363 /*
7364 * Calculate the oldest segment currently reserved by all slots,
7365 * considering wal_keep_size and max_slot_wal_keep_size. Initialize
7366 * oldestSlotSeg to the current segment.
7367 */
7372 /*
7373 * Find the oldest extant segment file. We get 1 until checkpoint removes
7374 * the first WAL segment file since startup, which causes the status being
7375 * wrong under certain abnormal conditions but that doesn't actually harm.
7376 */
7379 /* calculate oldest segment by max_wal_size */
7385 else
7388 /* the segment we care about */
7391 /*
7392 * No point in returning reserved or extended status values if the
7393 * targetSeg is known to be lost.
7394 */
7396 {
7397 /* show "reserved" when targetSeg is within max_wal_size */
7401 /* being retained by slots exceeding max_wal_size */
7403 }
7405 /* WAL segments are no longer retained but haven't been removed yet */
7409 /* Definitely lost */
7411 }
7414 /*
7415 * Retreat *logSegNo to the last segment that we need to retain because of
7416 * either wal_keep_size or replication slots.
7417 *
7418 * This is calculated by subtracting wal_keep_size from the given xlog
7419 * location, recptr and by making sure that that result is below the
7420 * requirement of replication slots. For the latter criterion we do consider
7421 * the effects of max_slot_wal_keep_size: reserve at most that much space back
7422 * from recptr.
7423 *
7424 * Note about replication slots: if this function calculates a value
7425 * that's further ahead than what slots need reserved, then affected
7426 * slots need to be invalidated and this function invoked again.
7427 * XXX it might be a good idea to rewrite this function so that
7428 * invalidation is optionally done here, instead.
7429 */
7430 static void
7432 {
7433 XLogSegNo currSegNo;
7434 XLogSegNo segno;
7435 XLogRecPtr keep;
7440 /*
7441 * Calculate how many segments are kept by slots first, adjusting for
7442 * max_slot_wal_keep_size.
7443 */
7446 {
7449 /* Cap by max_slot_wal_keep_size ... */
7451 {
7452 uint64 slot_keep_segs;
7454 slot_keep_segs =
7459 }
7460 }
7462 /* but, keep at least wal_keep_size if that's set */
7464 {
7465 uint64 keep_segs;
7469 {
7470 /* avoid underflow, don't go below 1 */
7473 else
7475 }
7476 }
7478 /* don't delete WAL segments newer than the calculated segment */
7481 }
7483 /*
7484 * Write a NEXTOID log record
7485 */
7486 void
7488 {
7493 /*
7494 * We need not flush the NEXTOID record immediately, because any of the
7495 * just-allocated OIDs could only reach disk as part of a tuple insert or
7496 * update that would have its own XLOG record that must follow the NEXTOID
7497 * record. Therefore, the standard buffer LSN interlock applied to those
7498 * records will ensure no such OID reaches disk before the NEXTOID record
7499 * does.
7500 *
7501 * Note, however, that the above statement only covers state "within" the
7502 * database. When we use a generated OID as a file or directory name, we
7503 * are in a sense violating the basic WAL rule, because that filesystem
7504 * change may reach disk before the NEXTOID WAL record does. The impact
7505 * of this is that if a database crash occurs immediately afterward, we
7506 * might after restart re-generate the same OID and find that it conflicts
7507 * with the leftover file or directory. But since for safety's sake we
7508 * always loop until finding a nonconflicting filename, this poses no real
7509 * problem in practice. See pgsql-hackers discussion 27-Sep-2006.
7510 */
7511 }
7513 /*
7514 * Write an XLOG SWITCH record.
7515 *
7516 * Here we just blindly issue an XLogInsert request for the record.
7517 * All the magic happens inside XLogInsert.
7518 *
7519 * The return value is either the end+1 address of the switch record,
7520 * or the end+1 address of the prior segment if we did not need to
7521 * write a switch record because we are already at segment start.
7522 */
7523 XLogRecPtr
7525 {
7526 XLogRecPtr RecPtr;
7528 /* XLOG SWITCH has no data */
7536 }
7538 /*
7539 * Write a RESTORE POINT record
7540 */
7541 XLogRecPtr
7543 {
7544 XLogRecPtr RecPtr;
7545 xl_restore_point xlrec;
7560 }
7562 /*
7563 * Check if any of the GUC parameters that are critical for hot standby
7564 * have changed, and update the value in pg_control file if necessary.
7565 */
7566 static void
7568 {
7577 {
7578 /*
7579 * The change in number of backend slots doesn't need to be WAL-logged
7580 * if archiving is not enabled, as you can't start archive recovery
7581 * with wal_level=minimal anyway. We don't really care about the
7582 * values in pg_control either if wal_level=minimal, but seems better
7583 * to keep them up-to-date to avoid confusion.
7584 */
7586 {
7587 xl_parameter_change xlrec;
7588 XLogRecPtr recptr;
7604 }
7619 }
7620 }
7622 /*
7623 * Update full_page_writes in shared memory, and write an
7624 * XLOG_FPW_CHANGE record if necessary.
7625 *
7626 * Note: this function assumes there is no other process running
7627 * concurrently that could update it.
7628 */
7629 void
7631 {
7635 /*
7636 * Do nothing if full_page_writes has not been changed.
7637 *
7638 * It's safe to check the shared full_page_writes without the lock,
7639 * because we assume that there is no concurrently running process which
7640 * can update it.
7641 */
7645 /*
7646 * Perform this outside critical section so that the WAL insert
7647 * initialization done by RecoveryInProgress() doesn't trigger an
7648 * assertion failure.
7649 */
7654 /*
7655 * It's always safe to take full page images, even when not strictly
7656 * required, but not the other round. So if we're setting full_page_writes
7657 * to true, first set it true and then write the WAL record. If we're
7658 * setting it to false, first write the WAL record and then set the global
7659 * flag.
7660 */
7662 {
7666 }
7668 /*
7669 * Write an XLOG_FPW_CHANGE record. This allows us to keep track of
7670 * full_page_writes during archive recovery, if required.
7671 */
7673 {
7678 }
7681 {
7685 }
7687 }
7689 /*
7690 * XLOG resource manager's routines
7691 *
7692 * Definitions of info values are in include/catalog/pg_control.h, though
7693 * not all record types are related to control file updates.
7694 *
7695 * NOTE: Some XLOG record types that are directly related to WAL recovery
7696 * are handled in xlogrecovery_redo().
7697 */
7698 void
7700 {
7704 /*
7705 * In XLOG rmgr, backup blocks are only used by XLOG_FPI and
7706 * XLOG_FPI_FOR_HINT records.
7707 */
7712 {
7713 Oid nextOid;
7715 /*
7716 * We used to try to take the maximum of ShmemVariableCache->nextOid
7717 * and the recorded nextOid, but that fails if the OID counter wraps
7718 * around. Since no OID allocation should be happening during replay
7719 * anyway, better to just believe the record exactly. We still take
7720 * OidGenLock while setting the variable, just in case.
7721 */
7727 }
7729 {
7730 CheckPoint checkPoint;
7731 TimeLineID replayTLI;
7734 /* In a SHUTDOWN checkpoint, believe the counters exactly */
7748 /*
7749 * No need to set oldestClogXid here as well; it'll be set when we
7750 * redo an xl_clog_truncate if it changed since initialization.
7751 */
7754 /*
7755 * If we see a shutdown checkpoint while waiting for an end-of-backup
7756 * record, the backup was canceled and the end-of-backup record will
7757 * never arrive.
7758 */
7765 /*
7766 * If we see a shutdown checkpoint, we know that nothing was running
7767 * on the primary at this point. So fake-up an empty running-xacts
7768 * record and use that here and now. Recover additional standby state
7769 * for prepared transactions.
7770 */
7772 {
7775 TransactionId oldestActiveXID;
7776 TransactionId latestCompletedXid;
7777 RunningTransactionsData running;
7781 /*
7782 * Construct a RunningTransactions snapshot representing a shut
7783 * down server, with only prepared transactions still alive. We're
7784 * never overflowed at this point because all subxids are listed
7785 * with their parent prepared transactions.
7786 */
7801 }
7803 /* ControlFile->checkPointCopy always tracks the latest ckpt XID */
7808 /* Update shared-memory copy of checkpoint XID/epoch */
7813 /*
7814 * We should've already switched to the new TLI before replaying this
7815 * record.
7816 */
7824 }
7826 {
7827 CheckPoint checkPoint;
7828 TimeLineID replayTLI;
7831 /* In an ONLINE checkpoint, treat the XID counter as a minimum */
7838 /*
7839 * We ignore the nextOid counter in an ONLINE checkpoint, preferring
7840 * to track OID assignment through XLOG_NEXTOID records. The nextOid
7841 * counter is from the start of the checkpoint and might well be stale
7842 * compared to later XLOG_NEXTOID records. We could try to take the
7843 * maximum of the nextOid counter and our latest value, but since
7844 * there's no particular guarantee about the speed with which the OID
7845 * counter wraps around, that's a risky thing to do. In any case,
7846 * users of the nextOid counter are required to avoid assignment of
7847 * duplicates, so that a somewhat out-of-date value should be safe.
7848 */
7850 /* Handle multixact */
7854 /*
7855 * NB: This may perform multixact truncation when replaying WAL
7856 * generated by an older primary.
7857 */
7864 /* ControlFile->checkPointCopy always tracks the latest ckpt XID */
7869 /* Update shared-memory copy of checkpoint XID/epoch */
7874 /* TLI should not change in an on-line checkpoint */
7882 }
7884 {
7885 /* nothing to do here, handled in xlogrecovery_redo() */
7886 }
7888 {
7889 xl_end_of_recovery xlrec;
7890 TimeLineID replayTLI;
7894 /*
7895 * For Hot Standby, we could treat this like a Shutdown Checkpoint,
7896 * but this case is rarer and harder to test, so the benefit doesn't
7897 * outweigh the potential extra cost of maintenance.
7898 */
7900 /*
7901 * We should've already switched to the new TLI before replaying this
7902 * record.
7903 */
7909 }
7911 {
7912 /* nothing to do here */
7913 }
7915 {
7916 /* nothing to do here */
7917 }
7919 {
7920 /* nothing to do here, handled in xlogrecovery.c */
7921 }
7923 {
7924 /*
7925 * XLOG_FPI records contain nothing else but one or more block
7926 * references. Every block reference must include a full-page image
7927 * even if full_page_writes was disabled when the record was generated
7928 * - otherwise there would be no point in this record.
7929 *
7930 * XLOG_FPI_FOR_HINT records are generated when a page needs to be
7931 * WAL-logged because of a hint bit update. They are only generated
7932 * when checksums and/or wal_log_hints are enabled. They may include
7933 * no full-page images if full_page_writes was disabled when they were
7934 * generated. In this case there is nothing to do here.
7935 *
7936 * No recovery conflicts are generated by these generic records - if a
7937 * resource manager needs to generate conflicts, it has to define a
7938 * separate WAL record type and redo routine.
7939 */
7941 {
7942 Buffer buffer;
7945 {
7949 }
7954 }
7955 }
7957 {
7958 /* nothing to do here, handled in xlogrecovery_redo() */
7959 }
7961 {
7962 xl_parameter_change xlrec;
7964 /* Update our copy of the parameters in pg_control */
7976 /*
7977 * Update minRecoveryPoint to ensure that if recovery is aborted, we
7978 * recover back up to this point before allowing hot standby again.
7979 * This is important if the max_* settings are decreased, to ensure
7980 * you don't run queries against the WAL preceding the change. The
7981 * local copies cannot be updated as long as crash recovery is
7982 * happening and we expect all the WAL to be replayed.
7983 */
7985 {
7988 }
7990 {
7991 TimeLineID replayTLI;
7996 }
8005 /* Check to see if any parameter change gives a problem on recovery */
8007 }
8009 {
8014 /*
8015 * Update the LSN of the last replayed XLOG_FPW_CHANGE record so that
8016 * do_pg_backup_start() and do_pg_backup_stop() can check whether
8017 * full_page_writes has been disabled during online backup.
8018 */
8020 {
8025 }
8027 /* Keep track of full_page_writes */
8029 }
8030 }
8032 /*
8033 * Return the (possible) sync flag used for opening a file, depending on the
8034 * value of the GUC wal_sync_method.
8035 */
8036 static int
8038 {
8041 /* If fsync is disabled, never open in sync mode */
8045 /*
8046 * Optimize writes by bypassing kernel cache with O_DIRECT when using
8047 * O_SYNC and O_DSYNC. But only if archiving and streaming are disabled,
8048 * otherwise the archive command or walsender process will read the WAL
8049 * soon after writing it, which is guaranteed to cause a physical read if
8050 * we bypassed the kernel cache. We also skip the
8051 * posix_fadvise(POSIX_FADV_DONTNEED) call in XLogFileClose() for the same
8052 * reason.
8053 *
8054 * Never use O_DIRECT in walreceiver process for similar reasons; the WAL
8055 * written by walreceiver is normally read by the startup process soon
8056 * after it's written. Also, walreceiver performs unaligned writes, which
8057 * don't work with O_DIRECT, so it is required for correctness too.
8058 */
8063 {
8064 /*
8065 * enum values for all sync options are defined even if they are
8066 * not supported on the current platform. But if not, they are
8067 * not included in the enum option array, and therefore will never
8068 * be seen here.
8069 */
8074 #ifdef O_SYNC
8077 #endif
8078 #ifdef O_DSYNC
8081 #endif
8083 /* can't happen (unless we are out of sync with option array) */
8086 }
8087 }
8089 /*
8090 * GUC support
8091 */
8092 void
8094 {
8096 {
8097 /*
8098 * To ensure that no blocks escape unsynced, force an fsync on the
8099 * currently open log segment (if any). Also, if the open flag is
8100 * changing, close the log file so it will be reopened (with new flag
8101 * bit) at next use.
8102 */
8104 {
8107 {
8113 wal_segment_size);
8118 }
8123 }
8124 }
8125 }
8128 /*
8129 * Issue appropriate kind of fsync (if any) for an XLOG output file.
8130 *
8131 * 'fd' is a file descriptor for the XLOG file to be fsync'd.
8132 * 'segno' is for error reporting purposes.
8133 */
8134 void
8136 {
8138 instr_time start;
8142 /*
8143 * Quick exit if fsync is disabled or write() has already synced the WAL
8144 * file.
8145 */
8151 /* Measure I/O timing to sync the WAL file */
8157 {
8162 #ifdef HAVE_FSYNC_WRITETHROUGH
8167 #endif
8174 /* not reachable */
8180 }
8182 /* PANIC if failed to fsync */
8184 {
8193 }
8197 /*
8198 * Increment the I/O timing and the number of times WAL files were synced.
8199 */
8201 {
8202 instr_time duration;
8207 }
8210 }
8212 /*
8213 * do_pg_backup_start is the workhorse of the user-visible pg_backup_start()
8214 * function. It creates the necessary starting checkpoint and constructs the
8215 * backup state and tablespace map.
8216 *
8217 * Input parameters are "state" (the backup state), "fast" (if true, we do
8218 * the checkpoint in immediate mode to make it faster), and "tablespaces"
8219 * (if non-NULL, indicates a list of tablespaceinfo structs describing the
8220 * cluster's tablespaces.).
8221 *
8222 * The tablespace map contents are appended to passed-in parameter
8223 * tablespace_map and the caller is responsible for including it in the backup
8224 * archive as 'tablespace_map'. The tablespace_map file is required mainly for
8225 * tar format in windows as native windows utilities are not able to create
8226 * symlinks while extracting files from tar. However for consistency and
8227 * platform-independence, we do it the same way everywhere.
8228 *
8229 * It fills in "state" with the information required for the backup, such
8230 * as the minimum WAL location that must be present to restore from this
8231 * backup (starttli) and the corresponding timeline ID (starttli).
8232 *
8233 * Every successfully started backup must be stopped by calling
8234 * do_pg_backup_stop() or do_pg_abort_backup(). There can be many
8235 * backups active at the same time.
8236 *
8237 * It is the responsibility of the caller of this function to verify the
8238 * permissions of the calling user!
8239 */
8240 void
8243 {
8249 /*
8250 * During recovery, we don't need to check WAL level. Because, if WAL
8251 * level is not sufficient, it's impossible to get here during recovery.
8252 */
8263 MAXPGPATH)));
8267 /*
8268 * Mark backup active in shared memory. We must do full-page WAL writes
8269 * during an on-line backup even if not doing so at other times, because
8270 * it's quite possible for the backup dump to obtain a "torn" (partially
8271 * written) copy of a database page if it reads the page concurrently with
8272 * our write to the same page. This can be fixed as long as the first
8273 * write to the page in the WAL sequence is a full-page write. Hence, we
8274 * increment runningBackups then force a CHECKPOINT, to ensure there are
8275 * no dirty pages in shared memory that might get dumped while the backup
8276 * is in progress without having a corresponding WAL record. (Once the
8277 * backup is complete, we need not force full-page writes anymore, since
8278 * we expect that any pages not modified during the backup interval must
8279 * have been correctly captured by the backup.)
8280 *
8281 * Note that forcing full-page writes has no effect during an online
8282 * backup from the standby.
8283 *
8284 * We must hold all the insertion locks to change the value of
8285 * runningBackups, to ensure adequate interlocking against
8286 * XLogInsertRecord().
8287 */
8292 /*
8293 * Ensure we decrement runningBackups if we fail below. NB -- for this to
8294 * work correctly, it is critical that sessionBackupState is only updated
8295 * after this block is over.
8296 */
8298 {
8305 /*
8306 * Force an XLOG file switch before the checkpoint, to ensure that the
8307 * WAL segment the checkpoint is written to doesn't contain pages with
8308 * old timeline IDs. That would otherwise happen if you called
8309 * pg_backup_start() right after restoring from a PITR archive: the
8310 * first WAL segment containing the startup checkpoint has pages in
8311 * the beginning with the old timeline ID. That can cause trouble at
8312 * recovery: we won't have a history file covering the old timeline if
8313 * pg_wal directory was not included in the base backup and the WAL
8314 * archive was cleared too before starting the backup.
8315 *
8316 * This also ensures that we have emitted a WAL page header that has
8317 * XLP_BKP_REMOVABLE off before we emit the checkpoint record.
8318 * Therefore, if a WAL archiver (such as pglesslog) is trying to
8319 * compress out removable backup blocks, it won't remove any that
8320 * occur after this point.
8321 *
8322 * During recovery, we skip forcing XLOG file switch, which means that
8323 * the backup taken during recovery is not available for the special
8324 * recovery case described above.
8325 */
8329 do
8330 {
8333 /*
8334 * Force a CHECKPOINT. Aside from being necessary to prevent torn
8335 * page problems, this guarantees that two successive backup runs
8336 * will have different checkpoint positions and hence different
8337 * history file names, even if nothing happened in between.
8338 *
8339 * During recovery, establish a restartpoint if possible. We use
8340 * the last restartpoint as the backup starting checkpoint. This
8341 * means that two successive backup runs can have same checkpoint
8342 * positions.
8343 *
8344 * Since the fact that we are executing do_pg_backup_start()
8345 * during recovery means that checkpointer is running, we can use
8346 * RequestCheckpoint() to establish a restartpoint.
8347 *
8348 * We use CHECKPOINT_IMMEDIATE only if requested by user (via
8349 * passing fast = true). Otherwise this can take awhile.
8350 */
8354 /*
8355 * Now we need to fetch the checkpoint record location, and also
8356 * its REDO pointer. The oldest point in WAL that would be needed
8357 * to restore starting from the checkpoint is precisely the REDO
8358 * pointer.
8359 */
8368 {
8369 XLogRecPtr recptr;
8371 /*
8372 * Check to see if all WAL replayed during online backup
8373 * (i.e., since last restartpoint used as backup starting
8374 * checkpoint) contain full-page writes.
8375 */
8386 "is corrupt and should not be used. "
8387 "Enable full_page_writes and run CHECKPOINT on the primary, "
8390 /*
8391 * During recovery, since we don't use the end-of-backup WAL
8392 * record and don't write the backup history file, the
8393 * starting WAL location doesn't need to be unique. This means
8394 * that two base backups started at the same time might use
8395 * the same checkpoint as starting locations.
8396 */
8398 }
8400 /*
8401 * If two base backups are started at the same time (in WAL sender
8402 * processes), we need to make sure that they use different
8403 * checkpoints as starting locations, because we use the starting
8404 * WAL location as a unique identifier for the base backup in the
8405 * end-of-backup WAL record and when we write the backup history
8406 * file. Perhaps it would be better generate a separate unique ID
8407 * for each backup instead of forcing another checkpoint, but
8408 * taking a checkpoint right after another is not that expensive
8409 * either because only few buffers have been dirtied yet.
8410 */
8413 {
8416 }
8420 /*
8421 * Construct tablespace_map file.
8422 */
8425 /* Collect information about all tablespaces */
8428 {
8433 StringInfoData escapedpath;
8436 /* Skip anything that doesn't look like a tablespace */
8442 /*
8443 * Skip anything that isn't a symlink/junction. For testing only,
8444 * we sometimes use allow_in_place_tablespaces to create
8445 * directories directly under pg_tblspc, which would fail below.
8446 */
8452 {
8455 fullpath)));
8457 }
8459 {
8462 fullpath)));
8464 }
8467 /*
8468 * Build a backslash-escaped version of the link path to include
8469 * in the tablespace map file.
8470 */
8473 {
8477 }
8479 /*
8480 * Relpath holds the relative path of the tablespace directory
8481 * when it's located within PGDATA, or NULL if it's located
8482 * elsewhere.
8483 */
8502 }
8506 }
8511 /*
8512 * Mark that the start phase has correctly finished for the backup.
8513 */
8515 }
8517 /*
8518 * Utility routine to fetch the session-level status of a backup running.
8519 */
8520 SessionBackupState
8522 {
8524 }
8526 /*
8527 * do_pg_backup_stop
8528 *
8529 * Utility function called at the end of an online backup. It creates history
8530 * file (if required), resets sessionBackupState and so on. It can optionally
8531 * wait for WAL segments to be archived.
8532 *
8533 * "state" is filled with the information necessary to restore from this
8534 * backup with its stop LSN (stoppoint), its timeline ID (stoptli), etc.
8535 *
8536 * It is the responsibility of the caller of this function to verify the
8537 * permissions of the calling user!
8538 */
8539 void
8541 {
8546 XLogSegNo _logSegNo;
8556 /*
8557 * During recovery, we don't need to check WAL level. Because, if WAL
8558 * level is not sufficient, it's impossible to get here during recovery.
8559 */
8566 /*
8567 * OK to update backup counter and session-level lock.
8568 *
8569 * Note that CHECK_FOR_INTERRUPTS() must not occur while updating them,
8570 * otherwise they can be updated inconsistently, which might cause
8571 * do_pg_abort_backup() to fail.
8572 */
8575 /*
8576 * It is expected that each do_pg_backup_start() call is matched by
8577 * exactly one do_pg_backup_stop() call.
8578 */
8582 /*
8583 * Clean up session-level lock.
8584 *
8585 * You might think that WALInsertLockRelease() can be called before
8586 * cleaning up session-level lock because session-level lock doesn't need
8587 * to be protected with WAL insertion lock. But since
8588 * CHECK_FOR_INTERRUPTS() can occur in it, session-level lock must be
8589 * cleaned up before it.
8590 */
8595 /*
8596 * If we are taking an online backup from the standby, we confirm that the
8597 * standby has not been promoted during the backup.
8598 */
8604 "and should not be used. "
8607 /*
8608 * During recovery, we don't write an end-of-backup record. We assume that
8609 * pg_control was backed up last and its minimum recovery point can be
8610 * available as the backup end location. Since we don't have an
8611 * end-of-backup record, we use the pg_control value to check whether
8612 * we've reached the end of backup when starting recovery from this
8613 * backup. We have no way of checking if pg_control wasn't backed up last
8614 * however.
8615 *
8616 * We don't force a switch to new WAL file but it is still possible to
8617 * wait for all the required files to be archived if waitforarchive is
8618 * true. This is okay if we use the backup to start a standby and fetch
8619 * the missing WAL using streaming replication. But in the case of an
8620 * archive recovery, a user should set waitforarchive to true and wait for
8621 * them to be archived to ensure that all the required files are
8622 * available.
8623 *
8624 * We return the current minimum recovery point as the backup end
8625 * location. Note that it can be greater than the exact backup end
8626 * location if the minimum recovery point is updated after the backup of
8627 * pg_control. This is harmless for current uses.
8628 *
8629 * XXX currently a backup history file is for informational and debug
8630 * purposes only. It's not essential for an online backup. Furthermore,
8631 * even if it's created, it will not be archived during recovery because
8632 * an archiver is not invoked. So it doesn't seem worthwhile to write a
8633 * backup history file during recovery.
8634 */
8636 {
8637 XLogRecPtr recptr;
8639 /*
8640 * Check to see if all WAL replayed during online backup contain
8641 * full-page writes.
8642 */
8653 "is corrupt and should not be used. "
8654 "Enable full_page_writes and run CHECKPOINT on the primary, "
8662 }
8663 else
8664 {
8667 /*
8668 * Write the backup-end xlog record
8669 */
8675 /*
8676 * Given that we're not in recovery, InsertTimeLineID is set and can't
8677 * change, so we can read it without a lock.
8678 */
8681 /*
8682 * Force a switch to a new xlog segment file, so that the backup is
8683 * valid as soon as archiver moves out the current segment file.
8684 */
8689 /*
8690 * Write the backup history file
8691 */
8700 histfilepath)));
8702 /* Build and save the contents of the backup history file */
8711 histfilepath)));
8713 /*
8714 * Clean out any no-longer-needed history files. As a side effect,
8715 * this will post a .ready file for the newly created history file,
8716 * notifying the archiver that history file may be archived
8717 * immediately.
8718 */
8720 }
8722 /*
8723 * If archiving is enabled, wait for all the required WAL files to be
8724 * archived before returning. If archiving isn't enabled, the required WAL
8725 * needs to be transported via streaming replication (hopefully with
8726 * wal_keep_size set high enough), or some more exotic mechanism like
8727 * polling and copying files from pg_wal with script. We have no knowledge
8728 * of those mechanisms, so it's up to the user to ensure that he gets all
8729 * the required WAL.
8730 *
8731 * We wait until both the last WAL file filled during backup and the
8732 * history file have been archived, and assume that the alphabetic sorting
8733 * property of the WAL files ensures any earlier WAL files are safely
8734 * archived as well.
8735 *
8736 * We wait forever, since archive_command is supposed to work and we
8737 * assume the admin wanted his backup to work completely. If you don't
8738 * wish to wait, then either waitforarchive should be passed in as false,
8739 * or you can set statement_timeout. Also, some notices are issued to
8740 * clue in anyone who might be doing this interactively.
8741 */
8746 {
8749 wal_segment_size);
8760 {
8764 {
8768 }
8773 WAIT_EVENT_BACKUP_WAIT_WAL_ARCHIVE);
8777 {
8781 waits),
8783 "You can safely cancel this backup, "
8785 }
8786 }
8790 }
8793 (errmsg("WAL archiving is not enabled; you must ensure that all required WAL segments are copied through other means to complete the backup")));
8794 }
8797 /*
8798 * do_pg_abort_backup: abort a running backup
8799 *
8800 * This does just the most basic steps of do_pg_backup_stop(), by taking the
8801 * system out of backup mode, thus making it a lot more safe to call from
8802 * an error handler.
8803 *
8804 * 'arg' indicates that it's being called during backup setup; so
8805 * sessionBackupState has not been modified yet, but runningBackups has
8806 * already been incremented. When it's false, then it's invoked as a
8807 * before_shmem_exit handler, and therefore we must not change state
8808 * unless sessionBackupState indicates that a backup is actually running.
8809 *
8810 * NB: This gets used as a PG_ENSURE_ERROR_CLEANUP callback and
8811 * before_shmem_exit handler, hence the odd-looking signature.
8812 */
8813 void
8815 {
8818 /* If called during backup start, there shouldn't be one already running */
8822 {
8833 }
8834 }
8836 /*
8837 * Register a handler that will warn about unterminated backups at end of
8838 * session, unless this has already been done.
8839 */
8840 void
8842 {
8849 }
8851 /*
8852 * Get latest WAL insert pointer
8853 */
8854 XLogRecPtr
8856 {
8858 uint64 current_bytepos;
8865 }
8867 /*
8868 * Get latest WAL write pointer
8869 */
8870 XLogRecPtr
8872 {
8878 }
8880 /*
8881 * Returns the redo pointer of the last checkpoint or restartpoint. This is
8882 * the oldest point in WAL that we still need, if we have to restart recovery.
8883 */
8884 void
8886 {
8891 }
8893 /*
8894 * Returns the WAL file name for the last checkpoint or restartpoint. This is
8895 * the oldest WAL file that we still need if we have to restart recovery.
8896 */
8897 static void
8899 {
8900 XLogRecPtr restartRedoPtr;
8901 TimeLineID restartTli;
8902 XLogSegNo restartSegNo;
8907 }
8909 /* Thin wrapper around ShutdownWalRcv(). */
8910 void
8912 {
8918 }
8920 /* Enable WAL file recycling and preallocation. */
8921 void
8923 {
8927 }
8929 bool
8931 {
8939 }
8941 /*
8942 * Update the WalWriterSleeping flag.
8943 */
8944 void
8946 {
8950 }