mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-08-14 03:43:23 +02:00
If you restored from a backup taken from a standby, and the last record in the backup is the checkpoint record, ie. there is no redo required except for the checkpoint record, we would fail to notice that we've reached the end-of-backup point, and the database is consistent. The result was an error "WAL ends before end of online backup". To fix, move the have-we-reached-end-of-backup check into CheckRecoveryConsistency(), which is already responsible for similar checks with minRecoveryPoint, and is called in the right places. Backpatch to 9.2, this check and bug did not exist before that.
9984 lines
304 KiB
C
9984 lines
304 KiB
C
/*-------------------------------------------------------------------------
|
|
*
|
|
* xlog.c
|
|
* PostgreSQL transaction log manager
|
|
*
|
|
*
|
|
* Portions Copyright (c) 1996-2012, PostgreSQL Global Development Group
|
|
* Portions Copyright (c) 1994, Regents of the University of California
|
|
*
|
|
* src/backend/access/transam/xlog.c
|
|
*
|
|
*-------------------------------------------------------------------------
|
|
*/
|
|
|
|
#include "postgres.h"
|
|
|
|
#include <ctype.h>
|
|
#include <time.h>
|
|
#include <fcntl.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/time.h>
|
|
#include <unistd.h>
|
|
|
|
#include "access/clog.h"
|
|
#include "access/multixact.h"
|
|
#include "access/subtrans.h"
|
|
#include "access/timeline.h"
|
|
#include "access/transam.h"
|
|
#include "access/tuptoaster.h"
|
|
#include "access/twophase.h"
|
|
#include "access/xact.h"
|
|
#include "access/xlog_internal.h"
|
|
#include "access/xlogutils.h"
|
|
#include "catalog/catversion.h"
|
|
#include "catalog/pg_control.h"
|
|
#include "catalog/pg_database.h"
|
|
#include "libpq/pqsignal.h"
|
|
#include "miscadmin.h"
|
|
#include "pgstat.h"
|
|
#include "postmaster/bgwriter.h"
|
|
#include "postmaster/startup.h"
|
|
#include "replication/walreceiver.h"
|
|
#include "replication/walsender.h"
|
|
#include "storage/bufmgr.h"
|
|
#include "storage/fd.h"
|
|
#include "storage/ipc.h"
|
|
#include "storage/latch.h"
|
|
#include "storage/pmsignal.h"
|
|
#include "storage/predicate.h"
|
|
#include "storage/proc.h"
|
|
#include "storage/procarray.h"
|
|
#include "storage/reinit.h"
|
|
#include "storage/smgr.h"
|
|
#include "storage/spin.h"
|
|
#include "utils/builtins.h"
|
|
#include "utils/guc.h"
|
|
#include "utils/ps_status.h"
|
|
#include "utils/relmapper.h"
|
|
#include "utils/snapmgr.h"
|
|
#include "utils/timestamp.h"
|
|
#include "pg_trace.h"
|
|
|
|
|
|
/* File path names (all relative to $PGDATA) */
|
|
#define RECOVERY_COMMAND_FILE "recovery.conf"
|
|
#define RECOVERY_COMMAND_DONE "recovery.done"
|
|
#define PROMOTE_SIGNAL_FILE "promote"
|
|
|
|
|
|
/* User-settable parameters */
|
|
int CheckPointSegments = 3;
|
|
int wal_keep_segments = 0;
|
|
int XLOGbuffers = -1;
|
|
int XLogArchiveTimeout = 0;
|
|
bool XLogArchiveMode = false;
|
|
char *XLogArchiveCommand = NULL;
|
|
bool EnableHotStandby = false;
|
|
bool fullPageWrites = true;
|
|
bool log_checkpoints = false;
|
|
int sync_method = DEFAULT_SYNC_METHOD;
|
|
int wal_level = WAL_LEVEL_MINIMAL;
|
|
int CommitDelay = 0; /* precommit delay in microseconds */
|
|
int CommitSiblings = 5; /* # concurrent xacts needed to sleep */
|
|
|
|
#ifdef WAL_DEBUG
|
|
bool XLOG_DEBUG = false;
|
|
#endif
|
|
|
|
/*
|
|
* XLOGfileslop is the maximum number of preallocated future XLOG segments.
|
|
* When we are done with an old XLOG segment file, we will recycle it as a
|
|
* future XLOG segment as long as there aren't already XLOGfileslop future
|
|
* segments; else we'll delete it. This could be made a separate GUC
|
|
* variable, but at present I think it's sufficient to hardwire it as
|
|
* 2*CheckPointSegments+1. Under normal conditions, a checkpoint will free
|
|
* no more than 2*CheckPointSegments log segments, and we want to recycle all
|
|
* of them; the +1 allows boundary cases to happen without wasting a
|
|
* delete/create-segment cycle.
|
|
*/
|
|
#define XLOGfileslop (2*CheckPointSegments + 1)
|
|
|
|
|
|
/*
|
|
* GUC support
|
|
*/
|
|
const struct config_enum_entry sync_method_options[] = {
|
|
{"fsync", SYNC_METHOD_FSYNC, false},
|
|
#ifdef HAVE_FSYNC_WRITETHROUGH
|
|
{"fsync_writethrough", SYNC_METHOD_FSYNC_WRITETHROUGH, false},
|
|
#endif
|
|
#ifdef HAVE_FDATASYNC
|
|
{"fdatasync", SYNC_METHOD_FDATASYNC, false},
|
|
#endif
|
|
#ifdef OPEN_SYNC_FLAG
|
|
{"open_sync", SYNC_METHOD_OPEN, false},
|
|
#endif
|
|
#ifdef OPEN_DATASYNC_FLAG
|
|
{"open_datasync", SYNC_METHOD_OPEN_DSYNC, false},
|
|
#endif
|
|
{NULL, 0, false}
|
|
};
|
|
|
|
/*
|
|
* Statistics for current checkpoint are collected in this global struct.
|
|
* Because only the background writer or a stand-alone backend can perform
|
|
* checkpoints, this will be unused in normal backends.
|
|
*/
|
|
CheckpointStatsData CheckpointStats;
|
|
|
|
/*
|
|
* ThisTimeLineID will be same in all backends --- it identifies current
|
|
* WAL timeline for the database system.
|
|
*/
|
|
TimeLineID ThisTimeLineID = 0;
|
|
|
|
/*
|
|
* Are we doing recovery from XLOG?
|
|
*
|
|
* This is only ever true in the startup process; it should be read as meaning
|
|
* "this process is replaying WAL records", rather than "the system is in
|
|
* recovery mode". It should be examined primarily by functions that need
|
|
* to act differently when called from a WAL redo function (e.g., to skip WAL
|
|
* logging). To check whether the system is in recovery regardless of which
|
|
* process you're running in, use RecoveryInProgress() but only after shared
|
|
* memory startup and lock initialization.
|
|
*/
|
|
bool InRecovery = false;
|
|
|
|
/* Are we in Hot Standby mode? Only valid in startup process, see xlog.h */
|
|
HotStandbyState standbyState = STANDBY_DISABLED;
|
|
|
|
static XLogRecPtr LastRec;
|
|
|
|
/* Local copy of WalRcv->receivedUpto */
|
|
static XLogRecPtr receivedUpto = 0;
|
|
static TimeLineID receiveTLI = 0;
|
|
|
|
/*
|
|
* During recovery, lastFullPageWrites keeps track of full_page_writes that
|
|
* the replayed WAL records indicate. It's initialized with full_page_writes
|
|
* that the recovery starting checkpoint record indicates, and then updated
|
|
* each time XLOG_FPW_CHANGE record is replayed.
|
|
*/
|
|
static bool lastFullPageWrites;
|
|
|
|
/*
|
|
* Local copy of SharedRecoveryInProgress variable. True actually means "not
|
|
* known, need to check the shared state".
|
|
*/
|
|
static bool LocalRecoveryInProgress = true;
|
|
|
|
/*
|
|
* Local copy of SharedHotStandbyActive variable. False actually means "not
|
|
* known, need to check the shared state".
|
|
*/
|
|
static bool LocalHotStandbyActive = false;
|
|
|
|
/*
|
|
* Local state for XLogInsertAllowed():
|
|
* 1: unconditionally allowed to insert XLOG
|
|
* 0: unconditionally not allowed to insert XLOG
|
|
* -1: must check RecoveryInProgress(); disallow until it is false
|
|
* Most processes start with -1 and transition to 1 after seeing that recovery
|
|
* is not in progress. But we can also force the value for special cases.
|
|
* The coding in XLogInsertAllowed() depends on the first two of these states
|
|
* being numerically the same as bool true and false.
|
|
*/
|
|
static int LocalXLogInsertAllowed = -1;
|
|
|
|
/* Are we recovering using offline XLOG archives? (only valid in the startup process) */
|
|
bool InArchiveRecovery = false;
|
|
|
|
/* Was the last xlog file restored from archive, or local? */
|
|
static bool restoredFromArchive = false;
|
|
|
|
/* options taken from recovery.conf for archive recovery */
|
|
char *recoveryRestoreCommand = NULL;
|
|
static char *recoveryEndCommand = NULL;
|
|
static char *archiveCleanupCommand = NULL;
|
|
static RecoveryTargetType recoveryTarget = RECOVERY_TARGET_UNSET;
|
|
static bool recoveryTargetInclusive = true;
|
|
static bool recoveryPauseAtTarget = true;
|
|
static TransactionId recoveryTargetXid;
|
|
static TimestampTz recoveryTargetTime;
|
|
static char *recoveryTargetName;
|
|
|
|
/* options taken from recovery.conf for XLOG streaming */
|
|
bool StandbyMode = false;
|
|
static char *PrimaryConnInfo = NULL;
|
|
static char *TriggerFile = NULL;
|
|
|
|
/* if recoveryStopsHere returns true, it saves actual stop xid/time/name here */
|
|
static TransactionId recoveryStopXid;
|
|
static TimestampTz recoveryStopTime;
|
|
static char recoveryStopName[MAXFNAMELEN];
|
|
static bool recoveryStopAfter;
|
|
|
|
/*
|
|
* During normal operation, the only timeline we care about is ThisTimeLineID.
|
|
* During recovery, however, things are more complicated. To simplify life
|
|
* for rmgr code, we keep ThisTimeLineID set to the "current" timeline as we
|
|
* scan through the WAL history (that is, it is the line that was active when
|
|
* the currently-scanned WAL record was generated). We also need these
|
|
* timeline values:
|
|
*
|
|
* recoveryTargetTLI: the desired timeline that we want to end in.
|
|
*
|
|
* recoveryTargetIsLatest: was the requested target timeline 'latest'?
|
|
*
|
|
* expectedTLEs: a list of TimeLineHistoryEntries for recoveryTargetTLI and the timelines of
|
|
* its known parents, newest first (so recoveryTargetTLI is always the
|
|
* first list member). Only these TLIs are expected to be seen in the WAL
|
|
* segments we read, and indeed only these TLIs will be considered as
|
|
* candidate WAL files to open at all.
|
|
*
|
|
* curFileTLI: the TLI appearing in the name of the current input WAL file.
|
|
* (This is not necessarily the same as ThisTimeLineID, because we could
|
|
* be scanning data that was copied from an ancestor timeline when the current
|
|
* file was created.) During a sequential scan we do not allow this value
|
|
* to decrease.
|
|
*/
|
|
static TimeLineID recoveryTargetTLI;
|
|
static bool recoveryTargetIsLatest = false;
|
|
static List *expectedTLEs;
|
|
static TimeLineID curFileTLI;
|
|
|
|
/*
|
|
* ProcLastRecPtr points to the start of the last XLOG record inserted by the
|
|
* current backend. It is updated for all inserts. XactLastRecEnd points to
|
|
* end+1 of the last record, and is reset when we end a top-level transaction,
|
|
* or start a new one; so it can be used to tell if the current transaction has
|
|
* created any XLOG records.
|
|
*/
|
|
static XLogRecPtr ProcLastRecPtr = InvalidXLogRecPtr;
|
|
|
|
XLogRecPtr XactLastRecEnd = InvalidXLogRecPtr;
|
|
|
|
/*
|
|
* RedoRecPtr is this backend's local copy of the REDO record pointer
|
|
* (which is almost but not quite the same as a pointer to the most recent
|
|
* CHECKPOINT record). We update this from the shared-memory copy,
|
|
* XLogCtl->Insert.RedoRecPtr, whenever we can safely do so (ie, when we
|
|
* hold the Insert lock). See XLogInsert for details. We are also allowed
|
|
* to update from XLogCtl->Insert.RedoRecPtr if we hold the info_lck;
|
|
* see GetRedoRecPtr. A freshly spawned backend obtains the value during
|
|
* InitXLOGAccess.
|
|
*/
|
|
static XLogRecPtr RedoRecPtr;
|
|
|
|
/*
|
|
* RedoStartLSN points to the checkpoint's REDO location which is specified
|
|
* in a backup label file, backup history file or control file. In standby
|
|
* mode, XLOG streaming usually starts from the position where an invalid
|
|
* record was found. But if we fail to read even the initial checkpoint
|
|
* record, we use the REDO location instead of the checkpoint location as
|
|
* the start position of XLOG streaming. Otherwise we would have to jump
|
|
* backwards to the REDO location after reading the checkpoint record,
|
|
* because the REDO record can precede the checkpoint record.
|
|
*/
|
|
static XLogRecPtr RedoStartLSN = InvalidXLogRecPtr;
|
|
|
|
/*----------
|
|
* Shared-memory data structures for XLOG control
|
|
*
|
|
* LogwrtRqst indicates a byte position that we need to write and/or fsync
|
|
* the log up to (all records before that point must be written or fsynced).
|
|
* LogwrtResult indicates the byte positions we have already written/fsynced.
|
|
* These structs are identical but are declared separately to indicate their
|
|
* slightly different functions.
|
|
*
|
|
* To read XLogCtl->LogwrtResult, you must hold either info_lck or
|
|
* WALWriteLock. To update it, you need to hold both locks. The point of
|
|
* this arrangement is that the value can be examined by code that already
|
|
* holds WALWriteLock without needing to grab info_lck as well. In addition
|
|
* to the shared variable, each backend has a private copy of LogwrtResult,
|
|
* which is updated when convenient.
|
|
*
|
|
* The request bookkeeping is simpler: there is a shared XLogCtl->LogwrtRqst
|
|
* (protected by info_lck), but we don't need to cache any copies of it.
|
|
*
|
|
* info_lck is only held long enough to read/update the protected variables,
|
|
* so it's a plain spinlock. The other locks are held longer (potentially
|
|
* over I/O operations), so we use LWLocks for them. These locks are:
|
|
*
|
|
* WALInsertLock: must be held to insert a record into the WAL buffers.
|
|
*
|
|
* WALWriteLock: must be held to write WAL buffers to disk (XLogWrite or
|
|
* XLogFlush).
|
|
*
|
|
* ControlFileLock: must be held to read/update control file or create
|
|
* new log file.
|
|
*
|
|
* CheckpointLock: must be held to do a checkpoint or restartpoint (ensures
|
|
* only one checkpointer at a time; currently, with all checkpoints done by
|
|
* the checkpointer, this is just pro forma).
|
|
*
|
|
*----------
|
|
*/
|
|
|
|
typedef struct XLogwrtRqst
|
|
{
|
|
XLogRecPtr Write; /* last byte + 1 to write out */
|
|
XLogRecPtr Flush; /* last byte + 1 to flush */
|
|
} XLogwrtRqst;
|
|
|
|
typedef struct XLogwrtResult
|
|
{
|
|
XLogRecPtr Write; /* last byte + 1 written out */
|
|
XLogRecPtr Flush; /* last byte + 1 flushed */
|
|
} XLogwrtResult;
|
|
|
|
/*
|
|
* Shared state data for XLogInsert.
|
|
*/
|
|
typedef struct XLogCtlInsert
|
|
{
|
|
XLogRecPtr PrevRecord; /* start of previously-inserted record */
|
|
int curridx; /* current block index in cache */
|
|
XLogPageHeader currpage; /* points to header of block in cache */
|
|
char *currpos; /* current insertion point in cache */
|
|
XLogRecPtr RedoRecPtr; /* current redo point for insertions */
|
|
bool forcePageWrites; /* forcing full-page writes for PITR? */
|
|
|
|
/*
|
|
* fullPageWrites is the master copy used by all backends to determine
|
|
* whether to write full-page to WAL, instead of using process-local one.
|
|
* This is required because, when full_page_writes is changed by SIGHUP,
|
|
* we must WAL-log it before it actually affects WAL-logging by backends.
|
|
* Checkpointer sets at startup or after SIGHUP.
|
|
*/
|
|
bool fullPageWrites;
|
|
|
|
/*
|
|
* exclusiveBackup is true if a backup started with pg_start_backup() is
|
|
* in progress, and nonExclusiveBackups is a counter indicating the number
|
|
* of streaming base backups currently in progress. forcePageWrites is set
|
|
* to true when either of these is non-zero. lastBackupStart is the latest
|
|
* checkpoint redo location used as a starting point for an online backup.
|
|
*/
|
|
bool exclusiveBackup;
|
|
int nonExclusiveBackups;
|
|
XLogRecPtr lastBackupStart;
|
|
} XLogCtlInsert;
|
|
|
|
/*
|
|
* Shared state data for XLogWrite/XLogFlush.
|
|
*/
|
|
typedef struct XLogCtlWrite
|
|
{
|
|
int curridx; /* cache index of next block to write */
|
|
pg_time_t lastSegSwitchTime; /* time of last xlog segment switch */
|
|
} XLogCtlWrite;
|
|
|
|
/*
|
|
* Total shared-memory state for XLOG.
|
|
*/
|
|
typedef struct XLogCtlData
|
|
{
|
|
/* Protected by WALInsertLock: */
|
|
XLogCtlInsert Insert;
|
|
|
|
/* Protected by info_lck: */
|
|
XLogwrtRqst LogwrtRqst;
|
|
uint32 ckptXidEpoch; /* nextXID & epoch of latest checkpoint */
|
|
TransactionId ckptXid;
|
|
XLogRecPtr asyncXactLSN; /* LSN of newest async commit/abort */
|
|
XLogSegNo lastRemovedSegNo; /* latest removed/recycled XLOG segment */
|
|
|
|
/* Protected by WALWriteLock: */
|
|
XLogCtlWrite Write;
|
|
|
|
/*
|
|
* Protected by info_lck and WALWriteLock (you must hold either lock to
|
|
* read it, but both to update)
|
|
*/
|
|
XLogwrtResult LogwrtResult;
|
|
|
|
/*
|
|
* These values do not change after startup, although the pointed-to pages
|
|
* and xlblocks values certainly do. Permission to read/write the pages
|
|
* and xlblocks values depends on WALInsertLock and WALWriteLock.
|
|
*/
|
|
char *pages; /* buffers for unwritten XLOG pages */
|
|
XLogRecPtr *xlblocks; /* 1st byte ptr-s + XLOG_BLCKSZ */
|
|
int XLogCacheBlck; /* highest allocated xlog buffer index */
|
|
TimeLineID ThisTimeLineID;
|
|
|
|
/*
|
|
* archiveCleanupCommand is read from recovery.conf but needs to be in
|
|
* shared memory so that the checkpointer process can access it.
|
|
*/
|
|
char archiveCleanupCommand[MAXPGPATH];
|
|
|
|
/*
|
|
* SharedRecoveryInProgress indicates if we're still in crash or archive
|
|
* recovery. Protected by info_lck.
|
|
*/
|
|
bool SharedRecoveryInProgress;
|
|
|
|
/*
|
|
* SharedHotStandbyActive indicates if we're still in crash or archive
|
|
* recovery. Protected by info_lck.
|
|
*/
|
|
bool SharedHotStandbyActive;
|
|
|
|
/*
|
|
* WalWriterSleeping indicates whether the WAL writer is currently in
|
|
* low-power mode (and hence should be nudged if an async commit occurs).
|
|
* Protected by info_lck.
|
|
*/
|
|
bool WalWriterSleeping;
|
|
|
|
/*
|
|
* recoveryWakeupLatch is used to wake up the startup process to continue
|
|
* WAL replay, if it is waiting for WAL to arrive or failover trigger file
|
|
* to appear.
|
|
*/
|
|
Latch recoveryWakeupLatch;
|
|
|
|
/*
|
|
* During recovery, we keep a copy of the latest checkpoint record here.
|
|
* Used by the background writer when it wants to create a restartpoint.
|
|
*
|
|
* Protected by info_lck.
|
|
*/
|
|
XLogRecPtr lastCheckPointRecPtr;
|
|
CheckPoint lastCheckPoint;
|
|
|
|
/*
|
|
* lastReplayedEndRecPtr points to end+1 of the last record successfully
|
|
* replayed. When we're currently replaying a record, ie. in a redo
|
|
* function, replayEndRecPtr points to the end+1 of the record being
|
|
* replayed, otherwise it's equal to lastReplayedEndRecPtr.
|
|
*/
|
|
XLogRecPtr lastReplayedEndRecPtr;
|
|
XLogRecPtr replayEndRecPtr;
|
|
TimeLineID replayEndTLI;
|
|
/* timestamp of last COMMIT/ABORT record replayed (or being replayed) */
|
|
TimestampTz recoveryLastXTime;
|
|
/* current effective recovery target timeline */
|
|
TimeLineID RecoveryTargetTLI;
|
|
|
|
/*
|
|
* timestamp of when we started replaying the current chunk of WAL data,
|
|
* only relevant for replication or archive recovery
|
|
*/
|
|
TimestampTz currentChunkStartTime;
|
|
/* Are we requested to pause recovery? */
|
|
bool recoveryPause;
|
|
|
|
/*
|
|
* lastFpwDisableRecPtr points to the start of the last replayed
|
|
* XLOG_FPW_CHANGE record that instructs full_page_writes is disabled.
|
|
*/
|
|
XLogRecPtr lastFpwDisableRecPtr;
|
|
|
|
slock_t info_lck; /* locks shared variables shown above */
|
|
} XLogCtlData;
|
|
|
|
static XLogCtlData *XLogCtl = NULL;
|
|
|
|
/*
|
|
* We maintain an image of pg_control in shared memory.
|
|
*/
|
|
static ControlFileData *ControlFile = NULL;
|
|
|
|
/*
|
|
* Macros for managing XLogInsert state. In most cases, the calling routine
|
|
* has local copies of XLogCtl->Insert and/or XLogCtl->Insert->curridx,
|
|
* so these are passed as parameters instead of being fetched via XLogCtl.
|
|
*/
|
|
|
|
/* Free space remaining in the current xlog page buffer */
|
|
#define INSERT_FREESPACE(Insert) \
|
|
(XLOG_BLCKSZ - ((Insert)->currpos - (char *) (Insert)->currpage))
|
|
|
|
/* Construct XLogRecPtr value for current insertion point */
|
|
#define INSERT_RECPTR(recptr,Insert,curridx) \
|
|
(recptr) = XLogCtl->xlblocks[curridx] - INSERT_FREESPACE(Insert)
|
|
|
|
#define PrevBufIdx(idx) \
|
|
(((idx) == 0) ? XLogCtl->XLogCacheBlck : ((idx) - 1))
|
|
|
|
#define NextBufIdx(idx) \
|
|
(((idx) == XLogCtl->XLogCacheBlck) ? 0 : ((idx) + 1))
|
|
|
|
/*
|
|
* Private, possibly out-of-date copy of shared LogwrtResult.
|
|
* See discussion above.
|
|
*/
|
|
static XLogwrtResult LogwrtResult = {0, 0};
|
|
|
|
/*
|
|
* Codes indicating where we got a WAL file from during recovery, or where
|
|
* to attempt to get one.
|
|
*/
|
|
typedef enum
|
|
{
|
|
XLOG_FROM_ANY = 0, /* request to read WAL from any source */
|
|
XLOG_FROM_ARCHIVE, /* restored using restore_command */
|
|
XLOG_FROM_PG_XLOG, /* existing file in pg_xlog */
|
|
XLOG_FROM_STREAM, /* streamed from master */
|
|
} XLogSource;
|
|
|
|
/* human-readable names for XLogSources, for debugging output */
|
|
static const char *xlogSourceNames[] = { "any", "archive", "pg_xlog", "stream" };
|
|
|
|
/*
|
|
* openLogFile is -1 or a kernel FD for an open log file segment.
|
|
* When it's open, openLogOff is the current seek offset in the file.
|
|
* openLogSegNo identifies the segment. These variables are only
|
|
* used to write the XLOG, and so will normally refer to the active segment.
|
|
*/
|
|
static int openLogFile = -1;
|
|
static XLogSegNo openLogSegNo = 0;
|
|
static uint32 openLogOff = 0;
|
|
|
|
/*
|
|
* These variables are used similarly to the ones above, but for reading
|
|
* the XLOG. Note, however, that readOff generally represents the offset
|
|
* of the page just read, not the seek position of the FD itself, which
|
|
* will be just past that page. readLen indicates how much of the current
|
|
* page has been read into readBuf, and readSource indicates where we got
|
|
* the currently open file from.
|
|
*/
|
|
static int readFile = -1;
|
|
static XLogSegNo readSegNo = 0;
|
|
static uint32 readOff = 0;
|
|
static uint32 readLen = 0;
|
|
static bool readFileHeaderValidated = false;
|
|
static XLogSource readSource = 0; /* XLOG_FROM_* code */
|
|
|
|
/*
|
|
* Keeps track of which source we're currently reading from. This is
|
|
* different from readSource in that this is always set, even when we don't
|
|
* currently have a WAL file open. If lastSourceFailed is set, our last
|
|
* attempt to read from currentSource failed, and we should try another source
|
|
* next.
|
|
*/
|
|
static XLogSource currentSource = 0; /* XLOG_FROM_* code */
|
|
static bool lastSourceFailed = false;
|
|
|
|
/*
|
|
* These variables track when we last obtained some WAL data to process,
|
|
* and where we got it from. (XLogReceiptSource is initially the same as
|
|
* readSource, but readSource gets reset to zero when we don't have data
|
|
* to process right now. It is also different from currentSource, which
|
|
* also changes when we try to read from a source and fail, while
|
|
* XLogReceiptSource tracks where we last successfully read some WAL.)
|
|
*/
|
|
static TimestampTz XLogReceiptTime = 0;
|
|
static XLogSource XLogReceiptSource = 0; /* XLOG_FROM_* code */
|
|
|
|
/* Buffer for currently read page (XLOG_BLCKSZ bytes) */
|
|
static char *readBuf = NULL;
|
|
|
|
/* Buffer for current ReadRecord result (expandable) */
|
|
static char *readRecordBuf = NULL;
|
|
static uint32 readRecordBufSize = 0;
|
|
|
|
/* State information for XLOG reading */
|
|
static XLogRecPtr ReadRecPtr; /* start of last record read */
|
|
static XLogRecPtr EndRecPtr; /* end+1 of last record read */
|
|
static TimeLineID lastPageTLI = 0;
|
|
static TimeLineID lastSegmentTLI = 0;
|
|
|
|
static XLogRecPtr minRecoveryPoint; /* local copy of
|
|
* ControlFile->minRecoveryPoint */
|
|
static TimeLineID minRecoveryPointTLI;
|
|
static bool updateMinRecoveryPoint = true;
|
|
|
|
/*
|
|
* Have we reached a consistent database state? In crash recovery, we have
|
|
* to replay all the WAL, so reachedConsistency is never set. During archive
|
|
* recovery, the database is consistent once minRecoveryPoint is reached.
|
|
*/
|
|
bool reachedConsistency = false;
|
|
|
|
static bool InRedo = false;
|
|
|
|
/* Have we launched bgwriter during recovery? */
|
|
static bool bgwriterLaunched = false;
|
|
|
|
|
|
static void readRecoveryCommandFile(void);
|
|
static void exitArchiveRecovery(TimeLineID endTLI, XLogSegNo endLogSegNo);
|
|
static bool recoveryStopsHere(XLogRecord *record, bool *includeThis);
|
|
static void recoveryPausesHere(void);
|
|
static void SetLatestXTime(TimestampTz xtime);
|
|
static void SetCurrentChunkStartTime(TimestampTz xtime);
|
|
static void CheckRequiredParameterValues(void);
|
|
static void XLogReportParameters(void);
|
|
static void checkTimeLineSwitch(XLogRecPtr lsn, TimeLineID newTLI);
|
|
static void LocalSetXLogInsertAllowed(void);
|
|
static void CheckPointGuts(XLogRecPtr checkPointRedo, int flags);
|
|
static void KeepLogSeg(XLogRecPtr recptr, XLogSegNo *logSegNo);
|
|
|
|
static bool XLogCheckBuffer(XLogRecData *rdata, bool doPageWrites,
|
|
XLogRecPtr *lsn, BkpBlock *bkpb);
|
|
static bool AdvanceXLInsertBuffer(bool new_segment);
|
|
static bool XLogCheckpointNeeded(XLogSegNo new_segno);
|
|
static void XLogWrite(XLogwrtRqst WriteRqst, bool flexible, bool xlog_switch);
|
|
static bool InstallXLogFileSegment(XLogSegNo *segno, char *tmppath,
|
|
bool find_free, int *max_advance,
|
|
bool use_lock);
|
|
static int XLogFileRead(XLogSegNo segno, int emode, TimeLineID tli,
|
|
int source, bool notexistOk);
|
|
static int XLogFileReadAnyTLI(XLogSegNo segno, int emode, int source);
|
|
static bool XLogPageRead(XLogRecPtr *RecPtr, int emode, bool fetching_ckpt,
|
|
bool randAccess);
|
|
static bool WaitForWALToBecomeAvailable(XLogRecPtr RecPtr, bool randAccess,
|
|
bool fetching_ckpt);
|
|
static int emode_for_corrupt_record(int emode, XLogRecPtr RecPtr);
|
|
static void XLogFileClose(void);
|
|
static void PreallocXlogFiles(XLogRecPtr endptr);
|
|
static void RemoveOldXlogFiles(XLogSegNo segno, XLogRecPtr endptr);
|
|
static void UpdateLastRemovedPtr(char *filename);
|
|
static void ValidateXLOGDirectoryStructure(void);
|
|
static void CleanupBackupHistory(void);
|
|
static void UpdateMinRecoveryPoint(XLogRecPtr lsn, bool force);
|
|
static XLogRecord *ReadRecord(XLogRecPtr *RecPtr, int emode, bool fetching_ckpt);
|
|
static void CheckRecoveryConsistency(void);
|
|
static bool ValidXLogPageHeader(XLogPageHeader hdr, int emode, bool segmentonly);
|
|
static bool ValidXLogRecordHeader(XLogRecPtr *RecPtr, XLogRecord *record,
|
|
int emode, bool randAccess);
|
|
static XLogRecord *ReadCheckpointRecord(XLogRecPtr RecPtr, int whichChkpt);
|
|
static bool rescanLatestTimeLine(void);
|
|
static void WriteControlFile(void);
|
|
static void ReadControlFile(void);
|
|
static char *str_time(pg_time_t tnow);
|
|
static bool CheckForStandbyTrigger(void);
|
|
|
|
#ifdef WAL_DEBUG
|
|
static void xlog_outrec(StringInfo buf, XLogRecord *record);
|
|
#endif
|
|
static void pg_start_backup_callback(int code, Datum arg);
|
|
static bool read_backup_label(XLogRecPtr *checkPointLoc,
|
|
bool *backupEndRequired, bool *backupFromStandby);
|
|
static void rm_redo_error_callback(void *arg);
|
|
static int get_sync_bit(int method);
|
|
|
|
|
|
/*
|
|
* Insert an XLOG record having the specified RMID and info bytes,
|
|
* with the body of the record being the data chunk(s) described by
|
|
* the rdata chain (see xlog.h for notes about rdata).
|
|
*
|
|
* Returns XLOG pointer to end of record (beginning of next record).
|
|
* This can be used as LSN for data pages affected by the logged action.
|
|
* (LSN is the XLOG point up to which the XLOG must be flushed to disk
|
|
* before the data page can be written out. This implements the basic
|
|
* WAL rule "write the log before the data".)
|
|
*
|
|
* NB: this routine feels free to scribble on the XLogRecData structs,
|
|
* though not on the data they reference. This is OK since the XLogRecData
|
|
* structs are always just temporaries in the calling code.
|
|
*/
|
|
XLogRecPtr
|
|
XLogInsert(RmgrId rmid, uint8 info, XLogRecData *rdata)
|
|
{
|
|
XLogCtlInsert *Insert = &XLogCtl->Insert;
|
|
XLogRecPtr RecPtr;
|
|
XLogRecPtr WriteRqst;
|
|
uint32 freespace;
|
|
int curridx;
|
|
XLogRecData *rdt;
|
|
XLogRecData *rdt_lastnormal;
|
|
Buffer dtbuf[XLR_MAX_BKP_BLOCKS];
|
|
bool dtbuf_bkp[XLR_MAX_BKP_BLOCKS];
|
|
BkpBlock dtbuf_xlg[XLR_MAX_BKP_BLOCKS];
|
|
XLogRecPtr dtbuf_lsn[XLR_MAX_BKP_BLOCKS];
|
|
XLogRecData dtbuf_rdt1[XLR_MAX_BKP_BLOCKS];
|
|
XLogRecData dtbuf_rdt2[XLR_MAX_BKP_BLOCKS];
|
|
XLogRecData dtbuf_rdt3[XLR_MAX_BKP_BLOCKS];
|
|
XLogRecData hdr_rdt;
|
|
pg_crc32 rdata_crc;
|
|
uint32 len,
|
|
write_len;
|
|
unsigned i;
|
|
bool updrqst;
|
|
bool doPageWrites;
|
|
bool isLogSwitch = (rmid == RM_XLOG_ID && info == XLOG_SWITCH);
|
|
uint8 info_orig = info;
|
|
static XLogRecord *rechdr;
|
|
|
|
if (rechdr == NULL)
|
|
{
|
|
rechdr = malloc(SizeOfXLogRecord);
|
|
if (rechdr == NULL)
|
|
elog(ERROR, "out of memory");
|
|
MemSet(rechdr, 0, SizeOfXLogRecord);
|
|
}
|
|
|
|
/* cross-check on whether we should be here or not */
|
|
if (!XLogInsertAllowed())
|
|
elog(ERROR, "cannot make new WAL entries during recovery");
|
|
|
|
/* info's high bits are reserved for use by me */
|
|
if (info & XLR_INFO_MASK)
|
|
elog(PANIC, "invalid xlog info mask %02X", info);
|
|
|
|
TRACE_POSTGRESQL_XLOG_INSERT(rmid, info);
|
|
|
|
/*
|
|
* In bootstrap mode, we don't actually log anything but XLOG resources;
|
|
* return a phony record pointer.
|
|
*/
|
|
if (IsBootstrapProcessingMode() && rmid != RM_XLOG_ID)
|
|
{
|
|
RecPtr = SizeOfXLogLongPHD; /* start of 1st chkpt record */
|
|
return RecPtr;
|
|
}
|
|
|
|
/*
|
|
* Here we scan the rdata chain, to determine which buffers must be backed
|
|
* up.
|
|
*
|
|
* We may have to loop back to here if a race condition is detected below.
|
|
* We could prevent the race by doing all this work while holding the
|
|
* insert lock, but it seems better to avoid doing CRC calculations while
|
|
* holding the lock.
|
|
*
|
|
* We add entries for backup blocks to the chain, so that they don't need
|
|
* any special treatment in the critical section where the chunks are
|
|
* copied into the WAL buffers. Those entries have to be unlinked from the
|
|
* chain if we have to loop back here.
|
|
*/
|
|
begin:;
|
|
for (i = 0; i < XLR_MAX_BKP_BLOCKS; i++)
|
|
{
|
|
dtbuf[i] = InvalidBuffer;
|
|
dtbuf_bkp[i] = false;
|
|
}
|
|
|
|
/*
|
|
* Decide if we need to do full-page writes in this XLOG record: true if
|
|
* full_page_writes is on or we have a PITR request for it. Since we
|
|
* don't yet have the insert lock, fullPageWrites and forcePageWrites
|
|
* could change under us, but we'll recheck them once we have the lock.
|
|
*/
|
|
doPageWrites = Insert->fullPageWrites || Insert->forcePageWrites;
|
|
|
|
len = 0;
|
|
for (rdt = rdata;;)
|
|
{
|
|
if (rdt->buffer == InvalidBuffer)
|
|
{
|
|
/* Simple data, just include it */
|
|
len += rdt->len;
|
|
}
|
|
else
|
|
{
|
|
/* Find info for buffer */
|
|
for (i = 0; i < XLR_MAX_BKP_BLOCKS; i++)
|
|
{
|
|
if (rdt->buffer == dtbuf[i])
|
|
{
|
|
/* Buffer already referenced by earlier chain item */
|
|
if (dtbuf_bkp[i])
|
|
{
|
|
rdt->data = NULL;
|
|
rdt->len = 0;
|
|
}
|
|
else if (rdt->data)
|
|
len += rdt->len;
|
|
break;
|
|
}
|
|
if (dtbuf[i] == InvalidBuffer)
|
|
{
|
|
/* OK, put it in this slot */
|
|
dtbuf[i] = rdt->buffer;
|
|
if (XLogCheckBuffer(rdt, doPageWrites,
|
|
&(dtbuf_lsn[i]), &(dtbuf_xlg[i])))
|
|
{
|
|
dtbuf_bkp[i] = true;
|
|
rdt->data = NULL;
|
|
rdt->len = 0;
|
|
}
|
|
else if (rdt->data)
|
|
len += rdt->len;
|
|
break;
|
|
}
|
|
}
|
|
if (i >= XLR_MAX_BKP_BLOCKS)
|
|
elog(PANIC, "can backup at most %d blocks per xlog record",
|
|
XLR_MAX_BKP_BLOCKS);
|
|
}
|
|
/* Break out of loop when rdt points to last chain item */
|
|
if (rdt->next == NULL)
|
|
break;
|
|
rdt = rdt->next;
|
|
}
|
|
|
|
/*
|
|
* NOTE: We disallow len == 0 because it provides a useful bit of extra
|
|
* error checking in ReadRecord. This means that all callers of
|
|
* XLogInsert must supply at least some not-in-a-buffer data. However, we
|
|
* make an exception for XLOG SWITCH records because we don't want them to
|
|
* ever cross a segment boundary.
|
|
*/
|
|
if (len == 0 && !isLogSwitch)
|
|
elog(PANIC, "invalid xlog record length %u", len);
|
|
|
|
/*
|
|
* Make additional rdata chain entries for the backup blocks, so that we
|
|
* don't need to special-case them in the write loop. This modifies the
|
|
* original rdata chain, but we keep a pointer to the last regular entry,
|
|
* rdt_lastnormal, so that we can undo this if we have to loop back to the
|
|
* beginning.
|
|
*
|
|
* At the exit of this loop, write_len includes the backup block data.
|
|
*
|
|
* Also set the appropriate info bits to show which buffers were backed
|
|
* up. The XLR_BKP_BLOCK(N) bit corresponds to the N'th distinct buffer
|
|
* value (ignoring InvalidBuffer) appearing in the rdata chain.
|
|
*/
|
|
rdt_lastnormal = rdt;
|
|
write_len = len;
|
|
for (i = 0; i < XLR_MAX_BKP_BLOCKS; i++)
|
|
{
|
|
BkpBlock *bkpb;
|
|
char *page;
|
|
|
|
if (!dtbuf_bkp[i])
|
|
continue;
|
|
|
|
info |= XLR_BKP_BLOCK(i);
|
|
|
|
bkpb = &(dtbuf_xlg[i]);
|
|
page = (char *) BufferGetBlock(dtbuf[i]);
|
|
|
|
rdt->next = &(dtbuf_rdt1[i]);
|
|
rdt = rdt->next;
|
|
|
|
rdt->data = (char *) bkpb;
|
|
rdt->len = sizeof(BkpBlock);
|
|
write_len += sizeof(BkpBlock);
|
|
|
|
rdt->next = &(dtbuf_rdt2[i]);
|
|
rdt = rdt->next;
|
|
|
|
if (bkpb->hole_length == 0)
|
|
{
|
|
rdt->data = page;
|
|
rdt->len = BLCKSZ;
|
|
write_len += BLCKSZ;
|
|
rdt->next = NULL;
|
|
}
|
|
else
|
|
{
|
|
/* must skip the hole */
|
|
rdt->data = page;
|
|
rdt->len = bkpb->hole_offset;
|
|
write_len += bkpb->hole_offset;
|
|
|
|
rdt->next = &(dtbuf_rdt3[i]);
|
|
rdt = rdt->next;
|
|
|
|
rdt->data = page + (bkpb->hole_offset + bkpb->hole_length);
|
|
rdt->len = BLCKSZ - (bkpb->hole_offset + bkpb->hole_length);
|
|
write_len += rdt->len;
|
|
rdt->next = NULL;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Calculate CRC of the data, including all the backup blocks
|
|
*
|
|
* Note that the record header isn't added into the CRC initially since we
|
|
* don't know the prev-link yet. Thus, the CRC will represent the CRC of
|
|
* the whole record in the order: rdata, then backup blocks, then record
|
|
* header.
|
|
*/
|
|
INIT_CRC32(rdata_crc);
|
|
for (rdt = rdata; rdt != NULL; rdt = rdt->next)
|
|
COMP_CRC32(rdata_crc, rdt->data, rdt->len);
|
|
|
|
/*
|
|
* Construct record header (prev-link and CRC are filled in later), and
|
|
* make that the first chunk in the chain.
|
|
*/
|
|
rechdr->xl_xid = GetCurrentTransactionIdIfAny();
|
|
rechdr->xl_tot_len = SizeOfXLogRecord + write_len;
|
|
rechdr->xl_len = len; /* doesn't include backup blocks */
|
|
rechdr->xl_info = info;
|
|
rechdr->xl_rmid = rmid;
|
|
|
|
hdr_rdt.next = rdata;
|
|
hdr_rdt.data = (char *) rechdr;
|
|
hdr_rdt.len = SizeOfXLogRecord;
|
|
|
|
write_len += SizeOfXLogRecord;
|
|
|
|
START_CRIT_SECTION();
|
|
|
|
/* Now wait to get insert lock */
|
|
LWLockAcquire(WALInsertLock, LW_EXCLUSIVE);
|
|
|
|
/*
|
|
* Check to see if my RedoRecPtr is out of date. If so, may have to go
|
|
* back and recompute everything. This can only happen just after a
|
|
* checkpoint, so it's better to be slow in this case and fast otherwise.
|
|
*
|
|
* If we aren't doing full-page writes then RedoRecPtr doesn't actually
|
|
* affect the contents of the XLOG record, so we'll update our local copy
|
|
* but not force a recomputation.
|
|
*/
|
|
if (!XLByteEQ(RedoRecPtr, Insert->RedoRecPtr))
|
|
{
|
|
Assert(XLByteLT(RedoRecPtr, Insert->RedoRecPtr));
|
|
RedoRecPtr = Insert->RedoRecPtr;
|
|
|
|
if (doPageWrites)
|
|
{
|
|
for (i = 0; i < XLR_MAX_BKP_BLOCKS; i++)
|
|
{
|
|
if (dtbuf[i] == InvalidBuffer)
|
|
continue;
|
|
if (dtbuf_bkp[i] == false &&
|
|
XLByteLE(dtbuf_lsn[i], RedoRecPtr))
|
|
{
|
|
/*
|
|
* Oops, this buffer now needs to be backed up, but we
|
|
* didn't think so above. Start over.
|
|
*/
|
|
LWLockRelease(WALInsertLock);
|
|
END_CRIT_SECTION();
|
|
rdt_lastnormal->next = NULL;
|
|
info = info_orig;
|
|
goto begin;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Also check to see if fullPageWrites or forcePageWrites was just turned
|
|
* on; if we weren't already doing full-page writes then go back and
|
|
* recompute. (If it was just turned off, we could recompute the record
|
|
* without full pages, but we choose not to bother.)
|
|
*/
|
|
if ((Insert->fullPageWrites || Insert->forcePageWrites) && !doPageWrites)
|
|
{
|
|
/* Oops, must redo it with full-page data. */
|
|
LWLockRelease(WALInsertLock);
|
|
END_CRIT_SECTION();
|
|
rdt_lastnormal->next = NULL;
|
|
info = info_orig;
|
|
goto begin;
|
|
}
|
|
|
|
/*
|
|
* If the current page is completely full, the record goes to the next
|
|
* page, right after the page header.
|
|
*/
|
|
updrqst = false;
|
|
freespace = INSERT_FREESPACE(Insert);
|
|
if (freespace == 0)
|
|
{
|
|
updrqst = AdvanceXLInsertBuffer(false);
|
|
freespace = INSERT_FREESPACE(Insert);
|
|
}
|
|
|
|
/* Compute record's XLOG location */
|
|
curridx = Insert->curridx;
|
|
INSERT_RECPTR(RecPtr, Insert, curridx);
|
|
|
|
/*
|
|
* If the record is an XLOG_SWITCH, and we are exactly at the start of a
|
|
* segment, we need not insert it (and don't want to because we'd like
|
|
* consecutive switch requests to be no-ops). Instead, make sure
|
|
* everything is written and flushed through the end of the prior segment,
|
|
* and return the prior segment's end address.
|
|
*/
|
|
if (isLogSwitch && (RecPtr % XLogSegSize) == SizeOfXLogLongPHD)
|
|
{
|
|
/* We can release insert lock immediately */
|
|
LWLockRelease(WALInsertLock);
|
|
|
|
RecPtr -= SizeOfXLogLongPHD;
|
|
|
|
LWLockAcquire(WALWriteLock, LW_EXCLUSIVE);
|
|
LogwrtResult = XLogCtl->LogwrtResult;
|
|
if (!XLByteLE(RecPtr, LogwrtResult.Flush))
|
|
{
|
|
XLogwrtRqst FlushRqst;
|
|
|
|
FlushRqst.Write = RecPtr;
|
|
FlushRqst.Flush = RecPtr;
|
|
XLogWrite(FlushRqst, false, false);
|
|
}
|
|
LWLockRelease(WALWriteLock);
|
|
|
|
END_CRIT_SECTION();
|
|
|
|
/* wake up walsenders now that we've released heavily contended locks */
|
|
WalSndWakeupProcessRequests();
|
|
return RecPtr;
|
|
}
|
|
|
|
/* Finish the record header */
|
|
rechdr->xl_prev = Insert->PrevRecord;
|
|
|
|
/* Now we can finish computing the record's CRC */
|
|
COMP_CRC32(rdata_crc, (char *) rechdr, offsetof(XLogRecord, xl_crc));
|
|
FIN_CRC32(rdata_crc);
|
|
rechdr->xl_crc = rdata_crc;
|
|
|
|
#ifdef WAL_DEBUG
|
|
if (XLOG_DEBUG)
|
|
{
|
|
StringInfoData buf;
|
|
|
|
initStringInfo(&buf);
|
|
appendStringInfo(&buf, "INSERT @ %X/%X: ",
|
|
(uint32) (RecPtr >> 32), (uint32) RecPtr);
|
|
xlog_outrec(&buf, rechdr);
|
|
if (rdata->data != NULL)
|
|
{
|
|
appendStringInfo(&buf, " - ");
|
|
RmgrTable[rechdr->xl_rmid].rm_desc(&buf, rechdr->xl_info, rdata->data);
|
|
}
|
|
elog(LOG, "%s", buf.data);
|
|
pfree(buf.data);
|
|
}
|
|
#endif
|
|
|
|
/* Record begin of record in appropriate places */
|
|
ProcLastRecPtr = RecPtr;
|
|
Insert->PrevRecord = RecPtr;
|
|
|
|
/*
|
|
* Append the data, including backup blocks if any
|
|
*/
|
|
rdata = &hdr_rdt;
|
|
while (write_len)
|
|
{
|
|
while (rdata->data == NULL)
|
|
rdata = rdata->next;
|
|
|
|
if (freespace > 0)
|
|
{
|
|
if (rdata->len > freespace)
|
|
{
|
|
memcpy(Insert->currpos, rdata->data, freespace);
|
|
rdata->data += freespace;
|
|
rdata->len -= freespace;
|
|
write_len -= freespace;
|
|
}
|
|
else
|
|
{
|
|
memcpy(Insert->currpos, rdata->data, rdata->len);
|
|
freespace -= rdata->len;
|
|
write_len -= rdata->len;
|
|
Insert->currpos += rdata->len;
|
|
rdata = rdata->next;
|
|
continue;
|
|
}
|
|
}
|
|
|
|
/* Use next buffer */
|
|
updrqst = AdvanceXLInsertBuffer(false);
|
|
curridx = Insert->curridx;
|
|
/* Mark page header to indicate this record continues on the page */
|
|
Insert->currpage->xlp_info |= XLP_FIRST_IS_CONTRECORD;
|
|
Insert->currpage->xlp_rem_len = write_len;
|
|
freespace = INSERT_FREESPACE(Insert);
|
|
}
|
|
|
|
/* Ensure next record will be properly aligned */
|
|
Insert->currpos = (char *) Insert->currpage +
|
|
MAXALIGN(Insert->currpos - (char *) Insert->currpage);
|
|
freespace = INSERT_FREESPACE(Insert);
|
|
|
|
/*
|
|
* The recptr I return is the beginning of the *next* record. This will be
|
|
* stored as LSN for changed data pages...
|
|
*/
|
|
INSERT_RECPTR(RecPtr, Insert, curridx);
|
|
|
|
/*
|
|
* If the record is an XLOG_SWITCH, we must now write and flush all the
|
|
* existing data, and then forcibly advance to the start of the next
|
|
* segment. It's not good to do this I/O while holding the insert lock,
|
|
* but there seems too much risk of confusion if we try to release the
|
|
* lock sooner. Fortunately xlog switch needn't be a high-performance
|
|
* operation anyway...
|
|
*/
|
|
if (isLogSwitch)
|
|
{
|
|
XLogwrtRqst FlushRqst;
|
|
XLogRecPtr OldSegEnd;
|
|
|
|
TRACE_POSTGRESQL_XLOG_SWITCH();
|
|
|
|
LWLockAcquire(WALWriteLock, LW_EXCLUSIVE);
|
|
|
|
/*
|
|
* Flush through the end of the page containing XLOG_SWITCH, and
|
|
* perform end-of-segment actions (eg, notifying archiver).
|
|
*/
|
|
WriteRqst = XLogCtl->xlblocks[curridx];
|
|
FlushRqst.Write = WriteRqst;
|
|
FlushRqst.Flush = WriteRqst;
|
|
XLogWrite(FlushRqst, false, true);
|
|
|
|
/* Set up the next buffer as first page of next segment */
|
|
/* Note: AdvanceXLInsertBuffer cannot need to do I/O here */
|
|
(void) AdvanceXLInsertBuffer(true);
|
|
|
|
/* There should be no unwritten data */
|
|
curridx = Insert->curridx;
|
|
Assert(curridx == XLogCtl->Write.curridx);
|
|
|
|
/* Compute end address of old segment */
|
|
OldSegEnd = XLogCtl->xlblocks[curridx];
|
|
OldSegEnd -= XLOG_BLCKSZ;
|
|
|
|
/* Make it look like we've written and synced all of old segment */
|
|
LogwrtResult.Write = OldSegEnd;
|
|
LogwrtResult.Flush = OldSegEnd;
|
|
|
|
/*
|
|
* Update shared-memory status --- this code should match XLogWrite
|
|
*/
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->LogwrtResult = LogwrtResult;
|
|
if (XLByteLT(xlogctl->LogwrtRqst.Write, LogwrtResult.Write))
|
|
xlogctl->LogwrtRqst.Write = LogwrtResult.Write;
|
|
if (XLByteLT(xlogctl->LogwrtRqst.Flush, LogwrtResult.Flush))
|
|
xlogctl->LogwrtRqst.Flush = LogwrtResult.Flush;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
LWLockRelease(WALWriteLock);
|
|
|
|
updrqst = false; /* done already */
|
|
}
|
|
else
|
|
{
|
|
/* normal case, ie not xlog switch */
|
|
|
|
/* Need to update shared LogwrtRqst if some block was filled up */
|
|
if (freespace == 0)
|
|
{
|
|
/* curridx is filled and available for writing out */
|
|
updrqst = true;
|
|
}
|
|
else
|
|
{
|
|
/* if updrqst already set, write through end of previous buf */
|
|
curridx = PrevBufIdx(curridx);
|
|
}
|
|
WriteRqst = XLogCtl->xlblocks[curridx];
|
|
}
|
|
|
|
LWLockRelease(WALInsertLock);
|
|
|
|
if (updrqst)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
/* advance global request to include new block(s) */
|
|
if (XLByteLT(xlogctl->LogwrtRqst.Write, WriteRqst))
|
|
xlogctl->LogwrtRqst.Write = WriteRqst;
|
|
/* update local result copy while I have the chance */
|
|
LogwrtResult = xlogctl->LogwrtResult;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
XactLastRecEnd = RecPtr;
|
|
|
|
END_CRIT_SECTION();
|
|
|
|
/* wake up walsenders now that we've released heavily contended locks */
|
|
WalSndWakeupProcessRequests();
|
|
|
|
return RecPtr;
|
|
}
|
|
|
|
/*
|
|
* Determine whether the buffer referenced by an XLogRecData item has to
|
|
* be backed up, and if so fill a BkpBlock struct for it. In any case
|
|
* save the buffer's LSN at *lsn.
|
|
*/
|
|
static bool
|
|
XLogCheckBuffer(XLogRecData *rdata, bool doPageWrites,
|
|
XLogRecPtr *lsn, BkpBlock *bkpb)
|
|
{
|
|
Page page;
|
|
|
|
page = BufferGetPage(rdata->buffer);
|
|
|
|
/*
|
|
* XXX We assume page LSN is first data on *every* page that can be passed
|
|
* to XLogInsert, whether it otherwise has the standard page layout or
|
|
* not. We don't need the buffer header lock for PageGetLSN because we
|
|
* have exclusive lock on the page and/or the relation.
|
|
*/
|
|
*lsn = PageGetLSN(page);
|
|
|
|
if (doPageWrites &&
|
|
XLByteLE(PageGetLSN(page), RedoRecPtr))
|
|
{
|
|
/*
|
|
* The page needs to be backed up, so set up *bkpb
|
|
*/
|
|
BufferGetTag(rdata->buffer, &bkpb->node, &bkpb->fork, &bkpb->block);
|
|
|
|
if (rdata->buffer_std)
|
|
{
|
|
/* Assume we can omit data between pd_lower and pd_upper */
|
|
uint16 lower = ((PageHeader) page)->pd_lower;
|
|
uint16 upper = ((PageHeader) page)->pd_upper;
|
|
|
|
if (lower >= SizeOfPageHeaderData &&
|
|
upper > lower &&
|
|
upper <= BLCKSZ)
|
|
{
|
|
bkpb->hole_offset = lower;
|
|
bkpb->hole_length = upper - lower;
|
|
}
|
|
else
|
|
{
|
|
/* No "hole" to compress out */
|
|
bkpb->hole_offset = 0;
|
|
bkpb->hole_length = 0;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
/* Not a standard page header, don't try to eliminate "hole" */
|
|
bkpb->hole_offset = 0;
|
|
bkpb->hole_length = 0;
|
|
}
|
|
|
|
return true; /* buffer requires backup */
|
|
}
|
|
|
|
return false; /* buffer does not need to be backed up */
|
|
}
|
|
|
|
/*
|
|
* Advance the Insert state to the next buffer page, writing out the next
|
|
* buffer if it still contains unwritten data.
|
|
*
|
|
* If new_segment is TRUE then we set up the next buffer page as the first
|
|
* page of the next xlog segment file, possibly but not usually the next
|
|
* consecutive file page.
|
|
*
|
|
* The global LogwrtRqst.Write pointer needs to be advanced to include the
|
|
* just-filled page. If we can do this for free (without an extra lock),
|
|
* we do so here. Otherwise the caller must do it. We return TRUE if the
|
|
* request update still needs to be done, FALSE if we did it internally.
|
|
*
|
|
* Must be called with WALInsertLock held.
|
|
*/
|
|
static bool
|
|
AdvanceXLInsertBuffer(bool new_segment)
|
|
{
|
|
XLogCtlInsert *Insert = &XLogCtl->Insert;
|
|
int nextidx = NextBufIdx(Insert->curridx);
|
|
bool update_needed = true;
|
|
XLogRecPtr OldPageRqstPtr;
|
|
XLogwrtRqst WriteRqst;
|
|
XLogRecPtr NewPageEndPtr;
|
|
XLogRecPtr NewPageBeginPtr;
|
|
XLogPageHeader NewPage;
|
|
|
|
/*
|
|
* Get ending-offset of the buffer page we need to replace (this may be
|
|
* zero if the buffer hasn't been used yet). Fall through if it's already
|
|
* written out.
|
|
*/
|
|
OldPageRqstPtr = XLogCtl->xlblocks[nextidx];
|
|
if (!XLByteLE(OldPageRqstPtr, LogwrtResult.Write))
|
|
{
|
|
/* nope, got work to do... */
|
|
XLogRecPtr FinishedPageRqstPtr;
|
|
|
|
FinishedPageRqstPtr = XLogCtl->xlblocks[Insert->curridx];
|
|
|
|
/* Before waiting, get info_lck and update LogwrtResult */
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
if (XLByteLT(xlogctl->LogwrtRqst.Write, FinishedPageRqstPtr))
|
|
xlogctl->LogwrtRqst.Write = FinishedPageRqstPtr;
|
|
LogwrtResult = xlogctl->LogwrtResult;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
update_needed = false; /* Did the shared-request update */
|
|
|
|
/*
|
|
* Now that we have an up-to-date LogwrtResult value, see if we still
|
|
* need to write it or if someone else already did.
|
|
*/
|
|
if (!XLByteLE(OldPageRqstPtr, LogwrtResult.Write))
|
|
{
|
|
/* Must acquire write lock */
|
|
LWLockAcquire(WALWriteLock, LW_EXCLUSIVE);
|
|
LogwrtResult = XLogCtl->LogwrtResult;
|
|
if (XLByteLE(OldPageRqstPtr, LogwrtResult.Write))
|
|
{
|
|
/* OK, someone wrote it already */
|
|
LWLockRelease(WALWriteLock);
|
|
}
|
|
else
|
|
{
|
|
/*
|
|
* Have to write buffers while holding insert lock. This is
|
|
* not good, so only write as much as we absolutely must.
|
|
*/
|
|
TRACE_POSTGRESQL_WAL_BUFFER_WRITE_DIRTY_START();
|
|
WriteRqst.Write = OldPageRqstPtr;
|
|
WriteRqst.Flush = 0;
|
|
XLogWrite(WriteRqst, false, false);
|
|
LWLockRelease(WALWriteLock);
|
|
TRACE_POSTGRESQL_WAL_BUFFER_WRITE_DIRTY_DONE();
|
|
}
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Now the next buffer slot is free and we can set it up to be the next
|
|
* output page.
|
|
*/
|
|
NewPageBeginPtr = XLogCtl->xlblocks[Insert->curridx];
|
|
|
|
if (new_segment)
|
|
{
|
|
/* force it to a segment start point */
|
|
if (NewPageBeginPtr % XLogSegSize != 0)
|
|
XLByteAdvance(NewPageBeginPtr,
|
|
XLogSegSize - NewPageBeginPtr % XLogSegSize);
|
|
}
|
|
|
|
NewPageEndPtr = NewPageBeginPtr;
|
|
XLByteAdvance(NewPageEndPtr, XLOG_BLCKSZ);
|
|
XLogCtl->xlblocks[nextidx] = NewPageEndPtr;
|
|
NewPage = (XLogPageHeader) (XLogCtl->pages + nextidx * (Size) XLOG_BLCKSZ);
|
|
|
|
Insert->curridx = nextidx;
|
|
Insert->currpage = NewPage;
|
|
|
|
Insert->currpos = ((char *) NewPage) +SizeOfXLogShortPHD;
|
|
|
|
/*
|
|
* Be sure to re-zero the buffer so that bytes beyond what we've written
|
|
* will look like zeroes and not valid XLOG records...
|
|
*/
|
|
MemSet((char *) NewPage, 0, XLOG_BLCKSZ);
|
|
|
|
/*
|
|
* Fill the new page's header
|
|
*/
|
|
NewPage ->xlp_magic = XLOG_PAGE_MAGIC;
|
|
|
|
/* NewPage->xlp_info = 0; */ /* done by memset */
|
|
NewPage ->xlp_tli = ThisTimeLineID;
|
|
NewPage ->xlp_pageaddr = NewPageBeginPtr;
|
|
|
|
/*
|
|
* If online backup is not in progress, mark the header to indicate that
|
|
* WAL records beginning in this page have removable backup blocks. This
|
|
* allows the WAL archiver to know whether it is safe to compress archived
|
|
* WAL data by transforming full-block records into the non-full-block
|
|
* format. It is sufficient to record this at the page level because we
|
|
* force a page switch (in fact a segment switch) when starting a backup,
|
|
* so the flag will be off before any records can be written during the
|
|
* backup. At the end of a backup, the last page will be marked as all
|
|
* unsafe when perhaps only part is unsafe, but at worst the archiver
|
|
* would miss the opportunity to compress a few records.
|
|
*/
|
|
if (!Insert->forcePageWrites)
|
|
NewPage ->xlp_info |= XLP_BKP_REMOVABLE;
|
|
|
|
/*
|
|
* If first page of an XLOG segment file, make it a long header.
|
|
*/
|
|
if ((NewPage->xlp_pageaddr % XLogSegSize) == 0)
|
|
{
|
|
XLogLongPageHeader NewLongPage = (XLogLongPageHeader) NewPage;
|
|
|
|
NewLongPage->xlp_sysid = ControlFile->system_identifier;
|
|
NewLongPage->xlp_seg_size = XLogSegSize;
|
|
NewLongPage->xlp_xlog_blcksz = XLOG_BLCKSZ;
|
|
NewPage ->xlp_info |= XLP_LONG_HEADER;
|
|
|
|
Insert->currpos = ((char *) NewPage) +SizeOfXLogLongPHD;
|
|
}
|
|
|
|
return update_needed;
|
|
}
|
|
|
|
/*
|
|
* Check whether we've consumed enough xlog space that a checkpoint is needed.
|
|
*
|
|
* new_segno indicates a log file that has just been filled up (or read
|
|
* during recovery). We measure the distance from RedoRecPtr to new_segno
|
|
* and see if that exceeds CheckPointSegments.
|
|
*
|
|
* Note: it is caller's responsibility that RedoRecPtr is up-to-date.
|
|
*/
|
|
static bool
|
|
XLogCheckpointNeeded(XLogSegNo new_segno)
|
|
{
|
|
XLogSegNo old_segno;
|
|
|
|
XLByteToSeg(RedoRecPtr, old_segno);
|
|
|
|
if (new_segno >= old_segno + (uint64) (CheckPointSegments - 1))
|
|
return true;
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* Write and/or fsync the log at least as far as WriteRqst indicates.
|
|
*
|
|
* If flexible == TRUE, we don't have to write as far as WriteRqst, but
|
|
* may stop at any convenient boundary (such as a cache or logfile boundary).
|
|
* This option allows us to avoid uselessly issuing multiple writes when a
|
|
* single one would do.
|
|
*
|
|
* If xlog_switch == TRUE, we are intending an xlog segment switch, so
|
|
* perform end-of-segment actions after writing the last page, even if
|
|
* it's not physically the end of its segment. (NB: this will work properly
|
|
* only if caller specifies WriteRqst == page-end and flexible == false,
|
|
* and there is some data to write.)
|
|
*
|
|
* Must be called with WALWriteLock held.
|
|
*/
|
|
static void
|
|
XLogWrite(XLogwrtRqst WriteRqst, bool flexible, bool xlog_switch)
|
|
{
|
|
XLogCtlWrite *Write = &XLogCtl->Write;
|
|
bool ispartialpage;
|
|
bool last_iteration;
|
|
bool finishing_seg;
|
|
bool use_existent;
|
|
int curridx;
|
|
int npages;
|
|
int startidx;
|
|
uint32 startoffset;
|
|
|
|
/* We should always be inside a critical section here */
|
|
Assert(CritSectionCount > 0);
|
|
|
|
/*
|
|
* Update local LogwrtResult (caller probably did this already, but...)
|
|
*/
|
|
LogwrtResult = XLogCtl->LogwrtResult;
|
|
|
|
/*
|
|
* Since successive pages in the xlog cache are consecutively allocated,
|
|
* we can usually gather multiple pages together and issue just one
|
|
* write() call. npages is the number of pages we have determined can be
|
|
* written together; startidx is the cache block index of the first one,
|
|
* and startoffset is the file offset at which it should go. The latter
|
|
* two variables are only valid when npages > 0, but we must initialize
|
|
* all of them to keep the compiler quiet.
|
|
*/
|
|
npages = 0;
|
|
startidx = 0;
|
|
startoffset = 0;
|
|
|
|
/*
|
|
* Within the loop, curridx is the cache block index of the page to
|
|
* consider writing. We advance Write->curridx only after successfully
|
|
* writing pages. (Right now, this refinement is useless since we are
|
|
* going to PANIC if any error occurs anyway; but someday it may come in
|
|
* useful.)
|
|
*/
|
|
curridx = Write->curridx;
|
|
|
|
while (XLByteLT(LogwrtResult.Write, WriteRqst.Write))
|
|
{
|
|
/*
|
|
* Make sure we're not ahead of the insert process. This could happen
|
|
* if we're passed a bogus WriteRqst.Write that is past the end of the
|
|
* last page that's been initialized by AdvanceXLInsertBuffer.
|
|
*/
|
|
if (!XLByteLT(LogwrtResult.Write, XLogCtl->xlblocks[curridx]))
|
|
elog(PANIC, "xlog write request %X/%X is past end of log %X/%X",
|
|
(uint32) (LogwrtResult.Write >> 32), (uint32) LogwrtResult.Write,
|
|
(uint32) (XLogCtl->xlblocks[curridx] >> 32),
|
|
(uint32) XLogCtl->xlblocks[curridx]);
|
|
|
|
/* Advance LogwrtResult.Write to end of current buffer page */
|
|
LogwrtResult.Write = XLogCtl->xlblocks[curridx];
|
|
ispartialpage = XLByteLT(WriteRqst.Write, LogwrtResult.Write);
|
|
|
|
if (!XLByteInPrevSeg(LogwrtResult.Write, openLogSegNo))
|
|
{
|
|
/*
|
|
* Switch to new logfile segment. We cannot have any pending
|
|
* pages here (since we dump what we have at segment end).
|
|
*/
|
|
Assert(npages == 0);
|
|
if (openLogFile >= 0)
|
|
XLogFileClose();
|
|
XLByteToPrevSeg(LogwrtResult.Write, openLogSegNo);
|
|
|
|
/* create/use new log file */
|
|
use_existent = true;
|
|
openLogFile = XLogFileInit(openLogSegNo, &use_existent, true);
|
|
openLogOff = 0;
|
|
}
|
|
|
|
/* Make sure we have the current logfile open */
|
|
if (openLogFile < 0)
|
|
{
|
|
XLByteToPrevSeg(LogwrtResult.Write, openLogSegNo);
|
|
openLogFile = XLogFileOpen(openLogSegNo);
|
|
openLogOff = 0;
|
|
}
|
|
|
|
/* Add current page to the set of pending pages-to-dump */
|
|
if (npages == 0)
|
|
{
|
|
/* first of group */
|
|
startidx = curridx;
|
|
startoffset = (LogwrtResult.Write - XLOG_BLCKSZ) % XLogSegSize;
|
|
}
|
|
npages++;
|
|
|
|
/*
|
|
* Dump the set if this will be the last loop iteration, or if we are
|
|
* at the last page of the cache area (since the next page won't be
|
|
* contiguous in memory), or if we are at the end of the logfile
|
|
* segment.
|
|
*/
|
|
last_iteration = !XLByteLT(LogwrtResult.Write, WriteRqst.Write);
|
|
|
|
finishing_seg = !ispartialpage &&
|
|
(startoffset + npages * XLOG_BLCKSZ) >= XLogSegSize;
|
|
|
|
if (last_iteration ||
|
|
curridx == XLogCtl->XLogCacheBlck ||
|
|
finishing_seg)
|
|
{
|
|
char *from;
|
|
Size nbytes;
|
|
|
|
/* Need to seek in the file? */
|
|
if (openLogOff != startoffset)
|
|
{
|
|
if (lseek(openLogFile, (off_t) startoffset, SEEK_SET) < 0)
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not seek in log file %s to offset %u: %m",
|
|
XLogFileNameP(ThisTimeLineID, openLogSegNo),
|
|
startoffset)));
|
|
openLogOff = startoffset;
|
|
}
|
|
|
|
/* OK to write the page(s) */
|
|
from = XLogCtl->pages + startidx * (Size) XLOG_BLCKSZ;
|
|
nbytes = npages * (Size) XLOG_BLCKSZ;
|
|
errno = 0;
|
|
if (write(openLogFile, from, nbytes) != nbytes)
|
|
{
|
|
/* if write didn't set errno, assume no disk space */
|
|
if (errno == 0)
|
|
errno = ENOSPC;
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not write to log file %s "
|
|
"at offset %u, length %lu: %m",
|
|
XLogFileNameP(ThisTimeLineID, openLogSegNo),
|
|
openLogOff, (unsigned long) nbytes)));
|
|
}
|
|
|
|
/* Update state for write */
|
|
openLogOff += nbytes;
|
|
Write->curridx = ispartialpage ? curridx : NextBufIdx(curridx);
|
|
npages = 0;
|
|
|
|
/*
|
|
* If we just wrote the whole last page of a logfile segment,
|
|
* fsync the segment immediately. This avoids having to go back
|
|
* and re-open prior segments when an fsync request comes along
|
|
* later. Doing it here ensures that one and only one backend will
|
|
* perform this fsync.
|
|
*
|
|
* We also do this if this is the last page written for an xlog
|
|
* switch.
|
|
*
|
|
* This is also the right place to notify the Archiver that the
|
|
* segment is ready to copy to archival storage, and to update the
|
|
* timer for archive_timeout, and to signal for a checkpoint if
|
|
* too many logfile segments have been used since the last
|
|
* checkpoint.
|
|
*/
|
|
if (finishing_seg || (xlog_switch && last_iteration))
|
|
{
|
|
issue_xlog_fsync(openLogFile, openLogSegNo);
|
|
|
|
/* signal that we need to wakeup walsenders later */
|
|
WalSndWakeupRequest();
|
|
|
|
LogwrtResult.Flush = LogwrtResult.Write; /* end of page */
|
|
|
|
if (XLogArchivingActive())
|
|
XLogArchiveNotifySeg(openLogSegNo);
|
|
|
|
Write->lastSegSwitchTime = (pg_time_t) time(NULL);
|
|
|
|
/*
|
|
* Request a checkpoint if we've consumed too much xlog since
|
|
* the last one. For speed, we first check using the local
|
|
* copy of RedoRecPtr, which might be out of date; if it looks
|
|
* like a checkpoint is needed, forcibly update RedoRecPtr and
|
|
* recheck.
|
|
*/
|
|
if (IsUnderPostmaster && XLogCheckpointNeeded(openLogSegNo))
|
|
{
|
|
(void) GetRedoRecPtr();
|
|
if (XLogCheckpointNeeded(openLogSegNo))
|
|
RequestCheckpoint(CHECKPOINT_CAUSE_XLOG);
|
|
}
|
|
}
|
|
}
|
|
|
|
if (ispartialpage)
|
|
{
|
|
/* Only asked to write a partial page */
|
|
LogwrtResult.Write = WriteRqst.Write;
|
|
break;
|
|
}
|
|
curridx = NextBufIdx(curridx);
|
|
|
|
/* If flexible, break out of loop as soon as we wrote something */
|
|
if (flexible && npages == 0)
|
|
break;
|
|
}
|
|
|
|
Assert(npages == 0);
|
|
Assert(curridx == Write->curridx);
|
|
|
|
/*
|
|
* If asked to flush, do so
|
|
*/
|
|
if (XLByteLT(LogwrtResult.Flush, WriteRqst.Flush) &&
|
|
XLByteLT(LogwrtResult.Flush, LogwrtResult.Write))
|
|
{
|
|
/*
|
|
* Could get here without iterating above loop, in which case we might
|
|
* have no open file or the wrong one. However, we do not need to
|
|
* fsync more than one file.
|
|
*/
|
|
if (sync_method != SYNC_METHOD_OPEN &&
|
|
sync_method != SYNC_METHOD_OPEN_DSYNC)
|
|
{
|
|
if (openLogFile >= 0 &&
|
|
!XLByteInPrevSeg(LogwrtResult.Write, openLogSegNo))
|
|
XLogFileClose();
|
|
if (openLogFile < 0)
|
|
{
|
|
XLByteToPrevSeg(LogwrtResult.Write, openLogSegNo);
|
|
openLogFile = XLogFileOpen(openLogSegNo);
|
|
openLogOff = 0;
|
|
}
|
|
|
|
issue_xlog_fsync(openLogFile, openLogSegNo);
|
|
}
|
|
|
|
/* signal that we need to wakeup walsenders later */
|
|
WalSndWakeupRequest();
|
|
|
|
LogwrtResult.Flush = LogwrtResult.Write;
|
|
}
|
|
|
|
/*
|
|
* Update shared-memory status
|
|
*
|
|
* We make sure that the shared 'request' values do not fall behind the
|
|
* 'result' values. This is not absolutely essential, but it saves some
|
|
* code in a couple of places.
|
|
*/
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->LogwrtResult = LogwrtResult;
|
|
if (XLByteLT(xlogctl->LogwrtRqst.Write, LogwrtResult.Write))
|
|
xlogctl->LogwrtRqst.Write = LogwrtResult.Write;
|
|
if (XLByteLT(xlogctl->LogwrtRqst.Flush, LogwrtResult.Flush))
|
|
xlogctl->LogwrtRqst.Flush = LogwrtResult.Flush;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Record the LSN for an asynchronous transaction commit/abort
|
|
* and nudge the WALWriter if there is work for it to do.
|
|
* (This should not be called for synchronous commits.)
|
|
*/
|
|
void
|
|
XLogSetAsyncXactLSN(XLogRecPtr asyncXactLSN)
|
|
{
|
|
XLogRecPtr WriteRqstPtr = asyncXactLSN;
|
|
bool sleeping;
|
|
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
LogwrtResult = xlogctl->LogwrtResult;
|
|
sleeping = xlogctl->WalWriterSleeping;
|
|
if (XLByteLT(xlogctl->asyncXactLSN, asyncXactLSN))
|
|
xlogctl->asyncXactLSN = asyncXactLSN;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
/*
|
|
* If the WALWriter is sleeping, we should kick it to make it come out of
|
|
* low-power mode. Otherwise, determine whether there's a full page of
|
|
* WAL available to write.
|
|
*/
|
|
if (!sleeping)
|
|
{
|
|
/* back off to last completed page boundary */
|
|
WriteRqstPtr -= WriteRqstPtr % XLOG_BLCKSZ;
|
|
|
|
/* if we have already flushed that far, we're done */
|
|
if (XLByteLE(WriteRqstPtr, LogwrtResult.Flush))
|
|
return;
|
|
}
|
|
|
|
/*
|
|
* Nudge the WALWriter: it has a full page of WAL to write, or we want it
|
|
* to come out of low-power mode so that this async commit will reach disk
|
|
* within the expected amount of time.
|
|
*/
|
|
if (ProcGlobal->walwriterLatch)
|
|
SetLatch(ProcGlobal->walwriterLatch);
|
|
}
|
|
|
|
/*
|
|
* Advance minRecoveryPoint in control file.
|
|
*
|
|
* If we crash during recovery, we must reach this point again before the
|
|
* database is consistent.
|
|
*
|
|
* If 'force' is true, 'lsn' argument is ignored. Otherwise, minRecoveryPoint
|
|
* is only updated if it's not already greater than or equal to 'lsn'.
|
|
*/
|
|
static void
|
|
UpdateMinRecoveryPoint(XLogRecPtr lsn, bool force)
|
|
{
|
|
/* Quick check using our local copy of the variable */
|
|
if (!updateMinRecoveryPoint || (!force && XLByteLE(lsn, minRecoveryPoint)))
|
|
return;
|
|
|
|
LWLockAcquire(ControlFileLock, LW_EXCLUSIVE);
|
|
|
|
/* update local copy */
|
|
minRecoveryPoint = ControlFile->minRecoveryPoint;
|
|
minRecoveryPointTLI = ControlFile->minRecoveryPointTLI;
|
|
|
|
/*
|
|
* An invalid minRecoveryPoint means that we need to recover all the WAL,
|
|
* i.e., we're doing crash recovery. We never modify the control file's
|
|
* value in that case, so we can short-circuit future checks here too.
|
|
*/
|
|
if (minRecoveryPoint == 0)
|
|
updateMinRecoveryPoint = false;
|
|
else if (force || XLByteLT(minRecoveryPoint, lsn))
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
XLogRecPtr newMinRecoveryPoint;
|
|
TimeLineID newMinRecoveryPointTLI;
|
|
|
|
/*
|
|
* To avoid having to update the control file too often, we update it
|
|
* all the way to the last record being replayed, even though 'lsn'
|
|
* would suffice for correctness. This also allows the 'force' case
|
|
* to not need a valid 'lsn' value.
|
|
*
|
|
* Another important reason for doing it this way is that the passed
|
|
* 'lsn' value could be bogus, i.e., past the end of available WAL, if
|
|
* the caller got it from a corrupted heap page. Accepting such a
|
|
* value as the min recovery point would prevent us from coming up at
|
|
* all. Instead, we just log a warning and continue with recovery.
|
|
* (See also the comments about corrupt LSNs in XLogFlush.)
|
|
*/
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
newMinRecoveryPoint = xlogctl->replayEndRecPtr;
|
|
newMinRecoveryPointTLI = xlogctl->replayEndTLI;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
if (!force && XLByteLT(newMinRecoveryPoint, lsn))
|
|
elog(WARNING,
|
|
"xlog min recovery request %X/%X is past current point %X/%X",
|
|
(uint32) (lsn >> 32) , (uint32) lsn,
|
|
(uint32) (newMinRecoveryPoint >> 32),
|
|
(uint32) newMinRecoveryPoint);
|
|
|
|
/* update control file */
|
|
if (XLByteLT(ControlFile->minRecoveryPoint, newMinRecoveryPoint))
|
|
{
|
|
ControlFile->minRecoveryPoint = newMinRecoveryPoint;
|
|
ControlFile->minRecoveryPointTLI = newMinRecoveryPointTLI;
|
|
UpdateControlFile();
|
|
minRecoveryPoint = newMinRecoveryPoint;
|
|
minRecoveryPointTLI = newMinRecoveryPointTLI;
|
|
|
|
ereport(DEBUG2,
|
|
(errmsg("updated min recovery point to %X/%X on timeline %u",
|
|
(uint32) (minRecoveryPoint >> 32),
|
|
(uint32) minRecoveryPoint,
|
|
newMinRecoveryPointTLI)));
|
|
}
|
|
}
|
|
LWLockRelease(ControlFileLock);
|
|
}
|
|
|
|
/*
|
|
* Ensure that all XLOG data through the given position is flushed to disk.
|
|
*
|
|
* NOTE: this differs from XLogWrite mainly in that the WALWriteLock is not
|
|
* already held, and we try to avoid acquiring it if possible.
|
|
*/
|
|
void
|
|
XLogFlush(XLogRecPtr record)
|
|
{
|
|
XLogRecPtr WriteRqstPtr;
|
|
XLogwrtRqst WriteRqst;
|
|
|
|
/*
|
|
* During REDO, we are reading not writing WAL. Therefore, instead of
|
|
* trying to flush the WAL, we should update minRecoveryPoint instead. We
|
|
* test XLogInsertAllowed(), not InRecovery, because we need checkpointer
|
|
* to act this way too, and because when it tries to write the
|
|
* end-of-recovery checkpoint, it should indeed flush.
|
|
*/
|
|
if (!XLogInsertAllowed())
|
|
{
|
|
UpdateMinRecoveryPoint(record, false);
|
|
return;
|
|
}
|
|
|
|
/* Quick exit if already known flushed */
|
|
if (XLByteLE(record, LogwrtResult.Flush))
|
|
return;
|
|
|
|
#ifdef WAL_DEBUG
|
|
if (XLOG_DEBUG)
|
|
elog(LOG, "xlog flush request %X/%X; write %X/%X; flush %X/%X",
|
|
(uint32) (record >> 32), (uint32) record,
|
|
(uint32) (LogwrtResult.Write >> 32), (uint32) LogwrtResult.Write,
|
|
(uint32) (LogwrtResult.Flush >> 32), (uint32) LogwrtResult.Flush);
|
|
#endif
|
|
|
|
START_CRIT_SECTION();
|
|
|
|
/*
|
|
* Since fsync is usually a horribly expensive operation, we try to
|
|
* piggyback as much data as we can on each fsync: if we see any more data
|
|
* entered into the xlog buffer, we'll write and fsync that too, so that
|
|
* the final value of LogwrtResult.Flush is as large as possible. This
|
|
* gives us some chance of avoiding another fsync immediately after.
|
|
*/
|
|
|
|
/* initialize to given target; may increase below */
|
|
WriteRqstPtr = record;
|
|
|
|
/*
|
|
* Now wait until we get the write lock, or someone else does the flush
|
|
* for us.
|
|
*/
|
|
for (;;)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
/* read LogwrtResult and update local state */
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
if (XLByteLT(WriteRqstPtr, xlogctl->LogwrtRqst.Write))
|
|
WriteRqstPtr = xlogctl->LogwrtRqst.Write;
|
|
LogwrtResult = xlogctl->LogwrtResult;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
/* done already? */
|
|
if (XLByteLE(record, LogwrtResult.Flush))
|
|
break;
|
|
|
|
/*
|
|
* Try to get the write lock. If we can't get it immediately, wait
|
|
* until it's released, and recheck if we still need to do the flush
|
|
* or if the backend that held the lock did it for us already. This
|
|
* helps to maintain a good rate of group committing when the system
|
|
* is bottlenecked by the speed of fsyncing.
|
|
*/
|
|
if (!LWLockAcquireOrWait(WALWriteLock, LW_EXCLUSIVE))
|
|
{
|
|
/*
|
|
* The lock is now free, but we didn't acquire it yet. Before we
|
|
* do, loop back to check if someone else flushed the record for
|
|
* us already.
|
|
*/
|
|
continue;
|
|
}
|
|
|
|
/* Got the lock; recheck whether request is satisfied */
|
|
LogwrtResult = XLogCtl->LogwrtResult;
|
|
if (XLByteLE(record, LogwrtResult.Flush))
|
|
{
|
|
LWLockRelease(WALWriteLock);
|
|
break;
|
|
}
|
|
|
|
/*
|
|
* Sleep before flush! By adding a delay here, we may give further
|
|
* backends the opportunity to join the backlog of group commit
|
|
* followers; this can significantly improve transaction throughput, at
|
|
* the risk of increasing transaction latency.
|
|
*
|
|
* We do not sleep if enableFsync is not turned on, nor if there are
|
|
* fewer than CommitSiblings other backends with active transactions.
|
|
*/
|
|
if (CommitDelay > 0 && enableFsync &&
|
|
MinimumActiveBackends(CommitSiblings))
|
|
pg_usleep(CommitDelay);
|
|
|
|
/* try to write/flush later additions to XLOG as well */
|
|
if (LWLockConditionalAcquire(WALInsertLock, LW_EXCLUSIVE))
|
|
{
|
|
XLogCtlInsert *Insert = &XLogCtl->Insert;
|
|
uint32 freespace = INSERT_FREESPACE(Insert);
|
|
|
|
if (freespace == 0) /* buffer is full */
|
|
WriteRqstPtr = XLogCtl->xlblocks[Insert->curridx];
|
|
else
|
|
{
|
|
WriteRqstPtr = XLogCtl->xlblocks[Insert->curridx];
|
|
WriteRqstPtr -= freespace;
|
|
}
|
|
LWLockRelease(WALInsertLock);
|
|
WriteRqst.Write = WriteRqstPtr;
|
|
WriteRqst.Flush = WriteRqstPtr;
|
|
}
|
|
else
|
|
{
|
|
WriteRqst.Write = WriteRqstPtr;
|
|
WriteRqst.Flush = record;
|
|
}
|
|
XLogWrite(WriteRqst, false, false);
|
|
|
|
LWLockRelease(WALWriteLock);
|
|
/* done */
|
|
break;
|
|
}
|
|
|
|
END_CRIT_SECTION();
|
|
|
|
/* wake up walsenders now that we've released heavily contended locks */
|
|
WalSndWakeupProcessRequests();
|
|
|
|
/*
|
|
* If we still haven't flushed to the request point then we have a
|
|
* problem; most likely, the requested flush point is past end of XLOG.
|
|
* This has been seen to occur when a disk page has a corrupted LSN.
|
|
*
|
|
* Formerly we treated this as a PANIC condition, but that hurts the
|
|
* system's robustness rather than helping it: we do not want to take down
|
|
* the whole system due to corruption on one data page. In particular, if
|
|
* the bad page is encountered again during recovery then we would be
|
|
* unable to restart the database at all! (This scenario actually
|
|
* happened in the field several times with 7.1 releases.) As of 8.4, bad
|
|
* LSNs encountered during recovery are UpdateMinRecoveryPoint's problem;
|
|
* the only time we can reach here during recovery is while flushing the
|
|
* end-of-recovery checkpoint record, and we don't expect that to have a
|
|
* bad LSN.
|
|
*
|
|
* Note that for calls from xact.c, the ERROR will be promoted to PANIC
|
|
* since xact.c calls this routine inside a critical section. However,
|
|
* calls from bufmgr.c are not within critical sections and so we will not
|
|
* force a restart for a bad LSN on a data page.
|
|
*/
|
|
if (XLByteLT(LogwrtResult.Flush, record))
|
|
elog(ERROR,
|
|
"xlog flush request %X/%X is not satisfied --- flushed only to %X/%X",
|
|
(uint32) (record >> 32), (uint32) record,
|
|
(uint32) (LogwrtResult.Flush >> 32), (uint32) LogwrtResult.Flush);
|
|
}
|
|
|
|
/*
|
|
* Flush xlog, but without specifying exactly where to flush to.
|
|
*
|
|
* We normally flush only completed blocks; but if there is nothing to do on
|
|
* that basis, we check for unflushed async commits in the current incomplete
|
|
* block, and flush through the latest one of those. Thus, if async commits
|
|
* are not being used, we will flush complete blocks only. We can guarantee
|
|
* that async commits reach disk after at most three cycles; normally only
|
|
* one or two. (When flushing complete blocks, we allow XLogWrite to write
|
|
* "flexibly", meaning it can stop at the end of the buffer ring; this makes a
|
|
* difference only with very high load or long wal_writer_delay, but imposes
|
|
* one extra cycle for the worst case for async commits.)
|
|
*
|
|
* This routine is invoked periodically by the background walwriter process.
|
|
*
|
|
* Returns TRUE if we flushed anything.
|
|
*/
|
|
bool
|
|
XLogBackgroundFlush(void)
|
|
{
|
|
XLogRecPtr WriteRqstPtr;
|
|
bool flexible = true;
|
|
bool wrote_something = false;
|
|
|
|
/* XLOG doesn't need flushing during recovery */
|
|
if (RecoveryInProgress())
|
|
return false;
|
|
|
|
/* read LogwrtResult and update local state */
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
LogwrtResult = xlogctl->LogwrtResult;
|
|
WriteRqstPtr = xlogctl->LogwrtRqst.Write;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/* back off to last completed page boundary */
|
|
WriteRqstPtr -= WriteRqstPtr % XLOG_BLCKSZ;
|
|
|
|
/* if we have already flushed that far, consider async commit records */
|
|
if (XLByteLE(WriteRqstPtr, LogwrtResult.Flush))
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
WriteRqstPtr = xlogctl->asyncXactLSN;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
flexible = false; /* ensure it all gets written */
|
|
}
|
|
|
|
/*
|
|
* If already known flushed, we're done. Just need to check if we are
|
|
* holding an open file handle to a logfile that's no longer in use,
|
|
* preventing the file from being deleted.
|
|
*/
|
|
if (XLByteLE(WriteRqstPtr, LogwrtResult.Flush))
|
|
{
|
|
if (openLogFile >= 0)
|
|
{
|
|
if (!XLByteInPrevSeg(LogwrtResult.Write, openLogSegNo))
|
|
{
|
|
XLogFileClose();
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
|
|
#ifdef WAL_DEBUG
|
|
if (XLOG_DEBUG)
|
|
elog(LOG, "xlog bg flush request %X/%X; write %X/%X; flush %X/%X",
|
|
(uint32) (WriteRqstPtr >> 32), (uint32) WriteRqstPtr,
|
|
(uint32) (LogwrtResult.Write >> 32), (uint32) LogwrtResult.Write,
|
|
(uint32) (LogwrtResult.Flush >> 32), (uint32) LogwrtResult.Flush);
|
|
#endif
|
|
|
|
START_CRIT_SECTION();
|
|
|
|
/* now wait for the write lock */
|
|
LWLockAcquire(WALWriteLock, LW_EXCLUSIVE);
|
|
LogwrtResult = XLogCtl->LogwrtResult;
|
|
if (!XLByteLE(WriteRqstPtr, LogwrtResult.Flush))
|
|
{
|
|
XLogwrtRqst WriteRqst;
|
|
|
|
WriteRqst.Write = WriteRqstPtr;
|
|
WriteRqst.Flush = WriteRqstPtr;
|
|
XLogWrite(WriteRqst, flexible, false);
|
|
wrote_something = true;
|
|
}
|
|
LWLockRelease(WALWriteLock);
|
|
|
|
END_CRIT_SECTION();
|
|
|
|
/* wake up walsenders now that we've released heavily contended locks */
|
|
WalSndWakeupProcessRequests();
|
|
|
|
return wrote_something;
|
|
}
|
|
|
|
/*
|
|
* Test whether XLOG data has been flushed up to (at least) the given position.
|
|
*
|
|
* Returns true if a flush is still needed. (It may be that someone else
|
|
* is already in process of flushing that far, however.)
|
|
*/
|
|
bool
|
|
XLogNeedsFlush(XLogRecPtr record)
|
|
{
|
|
/*
|
|
* During recovery, we don't flush WAL but update minRecoveryPoint
|
|
* instead. So "needs flush" is taken to mean whether minRecoveryPoint
|
|
* would need to be updated.
|
|
*/
|
|
if (RecoveryInProgress())
|
|
{
|
|
/* Quick exit if already known updated */
|
|
if (XLByteLE(record, minRecoveryPoint) || !updateMinRecoveryPoint)
|
|
return false;
|
|
|
|
/*
|
|
* Update local copy of minRecoveryPoint. But if the lock is busy,
|
|
* just return a conservative guess.
|
|
*/
|
|
if (!LWLockConditionalAcquire(ControlFileLock, LW_SHARED))
|
|
return true;
|
|
minRecoveryPoint = ControlFile->minRecoveryPoint;
|
|
minRecoveryPointTLI = ControlFile->minRecoveryPointTLI;
|
|
LWLockRelease(ControlFileLock);
|
|
|
|
/*
|
|
* An invalid minRecoveryPoint means that we need to recover all the
|
|
* WAL, i.e., we're doing crash recovery. We never modify the control
|
|
* file's value in that case, so we can short-circuit future checks
|
|
* here too.
|
|
*/
|
|
if (minRecoveryPoint == 0)
|
|
updateMinRecoveryPoint = false;
|
|
|
|
/* check again */
|
|
if (XLByteLE(record, minRecoveryPoint) || !updateMinRecoveryPoint)
|
|
return false;
|
|
else
|
|
return true;
|
|
}
|
|
|
|
/* Quick exit if already known flushed */
|
|
if (XLByteLE(record, LogwrtResult.Flush))
|
|
return false;
|
|
|
|
/* read LogwrtResult and update local state */
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
LogwrtResult = xlogctl->LogwrtResult;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/* check again */
|
|
if (XLByteLE(record, LogwrtResult.Flush))
|
|
return false;
|
|
|
|
return true;
|
|
}
|
|
|
|
/*
|
|
* Create a new XLOG file segment, or open a pre-existing one.
|
|
*
|
|
* log, seg: identify segment to be created/opened.
|
|
*
|
|
* *use_existent: if TRUE, OK to use a pre-existing file (else, any
|
|
* pre-existing file will be deleted). On return, TRUE if a pre-existing
|
|
* file was used.
|
|
*
|
|
* use_lock: if TRUE, acquire ControlFileLock while moving file into
|
|
* place. This should be TRUE except during bootstrap log creation. The
|
|
* caller must *not* hold the lock at call.
|
|
*
|
|
* Returns FD of opened file.
|
|
*
|
|
* Note: errors here are ERROR not PANIC because we might or might not be
|
|
* inside a critical section (eg, during checkpoint there is no reason to
|
|
* take down the system on failure). They will promote to PANIC if we are
|
|
* in a critical section.
|
|
*/
|
|
int
|
|
XLogFileInit(XLogSegNo logsegno, bool *use_existent, bool use_lock)
|
|
{
|
|
char path[MAXPGPATH];
|
|
char tmppath[MAXPGPATH];
|
|
char *zbuffer;
|
|
XLogSegNo installed_segno;
|
|
int max_advance;
|
|
int fd;
|
|
int nbytes;
|
|
|
|
XLogFilePath(path, ThisTimeLineID, logsegno);
|
|
|
|
/*
|
|
* Try to use existent file (checkpoint maker may have created it already)
|
|
*/
|
|
if (*use_existent)
|
|
{
|
|
fd = BasicOpenFile(path, O_RDWR | PG_BINARY | get_sync_bit(sync_method),
|
|
S_IRUSR | S_IWUSR);
|
|
if (fd < 0)
|
|
{
|
|
if (errno != ENOENT)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not open file \"%s\": %m", path)));
|
|
}
|
|
else
|
|
return fd;
|
|
}
|
|
|
|
/*
|
|
* Initialize an empty (all zeroes) segment. NOTE: it is possible that
|
|
* another process is doing the same thing. If so, we will end up
|
|
* pre-creating an extra log segment. That seems OK, and better than
|
|
* holding the lock throughout this lengthy process.
|
|
*/
|
|
elog(DEBUG2, "creating and filling new WAL file");
|
|
|
|
snprintf(tmppath, MAXPGPATH, XLOGDIR "/xlogtemp.%d", (int) getpid());
|
|
|
|
unlink(tmppath);
|
|
|
|
/*
|
|
* Allocate a buffer full of zeros. This is done before opening the file
|
|
* so that we don't leak the file descriptor if palloc fails.
|
|
*
|
|
* Note: palloc zbuffer, instead of just using a local char array, to
|
|
* ensure it is reasonably well-aligned; this may save a few cycles
|
|
* transferring data to the kernel.
|
|
*/
|
|
zbuffer = (char *) palloc0(XLOG_BLCKSZ);
|
|
|
|
/* do not use get_sync_bit() here --- want to fsync only at end of fill */
|
|
fd = BasicOpenFile(tmppath, O_RDWR | O_CREAT | O_EXCL | PG_BINARY,
|
|
S_IRUSR | S_IWUSR);
|
|
if (fd < 0)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not create file \"%s\": %m", tmppath)));
|
|
|
|
/*
|
|
* Zero-fill the file. We have to do this the hard way to ensure that all
|
|
* the file space has really been allocated --- on platforms that allow
|
|
* "holes" in files, just seeking to the end doesn't allocate intermediate
|
|
* space. This way, we know that we have all the space and (after the
|
|
* fsync below) that all the indirect blocks are down on disk. Therefore,
|
|
* fdatasync(2) or O_DSYNC will be sufficient to sync future writes to the
|
|
* log file.
|
|
*/
|
|
for (nbytes = 0; nbytes < XLogSegSize; nbytes += XLOG_BLCKSZ)
|
|
{
|
|
errno = 0;
|
|
if ((int) write(fd, zbuffer, XLOG_BLCKSZ) != (int) XLOG_BLCKSZ)
|
|
{
|
|
int save_errno = errno;
|
|
|
|
/*
|
|
* If we fail to make the file, delete it to release disk space
|
|
*/
|
|
unlink(tmppath);
|
|
|
|
close(fd);
|
|
|
|
/* if write didn't set errno, assume problem is no disk space */
|
|
errno = save_errno ? save_errno : ENOSPC;
|
|
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not write to file \"%s\": %m", tmppath)));
|
|
}
|
|
}
|
|
pfree(zbuffer);
|
|
|
|
if (pg_fsync(fd) != 0)
|
|
{
|
|
close(fd);
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not fsync file \"%s\": %m", tmppath)));
|
|
}
|
|
|
|
if (close(fd))
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not close file \"%s\": %m", tmppath)));
|
|
|
|
/*
|
|
* Now move the segment into place with its final name.
|
|
*
|
|
* If caller didn't want to use a pre-existing file, get rid of any
|
|
* pre-existing file. Otherwise, cope with possibility that someone else
|
|
* has created the file while we were filling ours: if so, use ours to
|
|
* pre-create a future log segment.
|
|
*/
|
|
installed_segno = logsegno;
|
|
max_advance = XLOGfileslop;
|
|
if (!InstallXLogFileSegment(&installed_segno, tmppath,
|
|
*use_existent, &max_advance,
|
|
use_lock))
|
|
{
|
|
/*
|
|
* No need for any more future segments, or InstallXLogFileSegment()
|
|
* failed to rename the file into place. If the rename failed, opening
|
|
* the file below will fail.
|
|
*/
|
|
unlink(tmppath);
|
|
}
|
|
|
|
/* Set flag to tell caller there was no existent file */
|
|
*use_existent = false;
|
|
|
|
/* Now open original target segment (might not be file I just made) */
|
|
fd = BasicOpenFile(path, O_RDWR | PG_BINARY | get_sync_bit(sync_method),
|
|
S_IRUSR | S_IWUSR);
|
|
if (fd < 0)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not open file \"%s\": %m", path)));
|
|
|
|
elog(DEBUG2, "done creating and filling new WAL file");
|
|
|
|
return fd;
|
|
}
|
|
|
|
/*
|
|
* Create a new XLOG file segment by copying a pre-existing one.
|
|
*
|
|
* destsegno: identify segment to be created.
|
|
*
|
|
* srcTLI, srclog, srcseg: identify segment to be copied (could be from
|
|
* a different timeline)
|
|
*
|
|
* Currently this is only used during recovery, and so there are no locking
|
|
* considerations. But we should be just as tense as XLogFileInit to avoid
|
|
* emplacing a bogus file.
|
|
*/
|
|
static void
|
|
XLogFileCopy(XLogSegNo destsegno, TimeLineID srcTLI, XLogSegNo srcsegno)
|
|
{
|
|
char path[MAXPGPATH];
|
|
char tmppath[MAXPGPATH];
|
|
char buffer[XLOG_BLCKSZ];
|
|
int srcfd;
|
|
int fd;
|
|
int nbytes;
|
|
|
|
/*
|
|
* Open the source file
|
|
*/
|
|
XLogFilePath(path, srcTLI, srcsegno);
|
|
srcfd = OpenTransientFile(path, O_RDONLY | PG_BINARY, 0);
|
|
if (srcfd < 0)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not open file \"%s\": %m", path)));
|
|
|
|
/*
|
|
* Copy into a temp file name.
|
|
*/
|
|
snprintf(tmppath, MAXPGPATH, XLOGDIR "/xlogtemp.%d", (int) getpid());
|
|
|
|
unlink(tmppath);
|
|
|
|
/* do not use get_sync_bit() here --- want to fsync only at end of fill */
|
|
fd = OpenTransientFile(tmppath, O_RDWR | O_CREAT | O_EXCL | PG_BINARY,
|
|
S_IRUSR | S_IWUSR);
|
|
if (fd < 0)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not create file \"%s\": %m", tmppath)));
|
|
|
|
/*
|
|
* Do the data copying.
|
|
*/
|
|
for (nbytes = 0; nbytes < XLogSegSize; nbytes += sizeof(buffer))
|
|
{
|
|
errno = 0;
|
|
if ((int) read(srcfd, buffer, sizeof(buffer)) != (int) sizeof(buffer))
|
|
{
|
|
if (errno != 0)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not read file \"%s\": %m", path)));
|
|
else
|
|
ereport(ERROR,
|
|
(errmsg("not enough data in file \"%s\"", path)));
|
|
}
|
|
errno = 0;
|
|
if ((int) write(fd, buffer, sizeof(buffer)) != (int) sizeof(buffer))
|
|
{
|
|
int save_errno = errno;
|
|
|
|
/*
|
|
* If we fail to make the file, delete it to release disk space
|
|
*/
|
|
unlink(tmppath);
|
|
/* if write didn't set errno, assume problem is no disk space */
|
|
errno = save_errno ? save_errno : ENOSPC;
|
|
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not write to file \"%s\": %m", tmppath)));
|
|
}
|
|
}
|
|
|
|
if (pg_fsync(fd) != 0)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not fsync file \"%s\": %m", tmppath)));
|
|
|
|
if (CloseTransientFile(fd))
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not close file \"%s\": %m", tmppath)));
|
|
|
|
CloseTransientFile(srcfd);
|
|
|
|
/*
|
|
* Now move the segment into place with its final name.
|
|
*/
|
|
if (!InstallXLogFileSegment(&destsegno, tmppath, false, NULL, false))
|
|
elog(ERROR, "InstallXLogFileSegment should not have failed");
|
|
}
|
|
|
|
/*
|
|
* Install a new XLOG segment file as a current or future log segment.
|
|
*
|
|
* This is used both to install a newly-created segment (which has a temp
|
|
* filename while it's being created) and to recycle an old segment.
|
|
*
|
|
* *segno: identify segment to install as (or first possible target).
|
|
* When find_free is TRUE, this is modified on return to indicate the
|
|
* actual installation location or last segment searched.
|
|
*
|
|
* tmppath: initial name of file to install. It will be renamed into place.
|
|
*
|
|
* find_free: if TRUE, install the new segment at the first empty segno
|
|
* number at or after the passed numbers. If FALSE, install the new segment
|
|
* exactly where specified, deleting any existing segment file there.
|
|
*
|
|
* *max_advance: maximum number of segno slots to advance past the starting
|
|
* point. Fail if no free slot is found in this range. On return, reduced
|
|
* by the number of slots skipped over. (Irrelevant, and may be NULL,
|
|
* when find_free is FALSE.)
|
|
*
|
|
* use_lock: if TRUE, acquire ControlFileLock while moving file into
|
|
* place. This should be TRUE except during bootstrap log creation. The
|
|
* caller must *not* hold the lock at call.
|
|
*
|
|
* Returns TRUE if the file was installed successfully. FALSE indicates that
|
|
* max_advance limit was exceeded, or an error occurred while renaming the
|
|
* file into place.
|
|
*/
|
|
static bool
|
|
InstallXLogFileSegment(XLogSegNo *segno, char *tmppath,
|
|
bool find_free, int *max_advance,
|
|
bool use_lock)
|
|
{
|
|
char path[MAXPGPATH];
|
|
struct stat stat_buf;
|
|
|
|
XLogFilePath(path, ThisTimeLineID, *segno);
|
|
|
|
/*
|
|
* We want to be sure that only one process does this at a time.
|
|
*/
|
|
if (use_lock)
|
|
LWLockAcquire(ControlFileLock, LW_EXCLUSIVE);
|
|
|
|
if (!find_free)
|
|
{
|
|
/* Force installation: get rid of any pre-existing segment file */
|
|
unlink(path);
|
|
}
|
|
else
|
|
{
|
|
/* Find a free slot to put it in */
|
|
while (stat(path, &stat_buf) == 0)
|
|
{
|
|
if (*max_advance <= 0)
|
|
{
|
|
/* Failed to find a free slot within specified range */
|
|
if (use_lock)
|
|
LWLockRelease(ControlFileLock);
|
|
return false;
|
|
}
|
|
(*segno)++;
|
|
(*max_advance)--;
|
|
XLogFilePath(path, ThisTimeLineID, *segno);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Prefer link() to rename() here just to be really sure that we don't
|
|
* overwrite an existing logfile. However, there shouldn't be one, so
|
|
* rename() is an acceptable substitute except for the truly paranoid.
|
|
*/
|
|
#if HAVE_WORKING_LINK
|
|
if (link(tmppath, path) < 0)
|
|
{
|
|
if (use_lock)
|
|
LWLockRelease(ControlFileLock);
|
|
ereport(LOG,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not link file \"%s\" to \"%s\" (initialization of log file): %m",
|
|
tmppath, path)));
|
|
return false;
|
|
}
|
|
unlink(tmppath);
|
|
#else
|
|
if (rename(tmppath, path) < 0)
|
|
{
|
|
if (use_lock)
|
|
LWLockRelease(ControlFileLock);
|
|
ereport(LOG,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not rename file \"%s\" to \"%s\" (initialization of log file): %m",
|
|
tmppath, path)));
|
|
return false;
|
|
}
|
|
#endif
|
|
|
|
if (use_lock)
|
|
LWLockRelease(ControlFileLock);
|
|
|
|
return true;
|
|
}
|
|
|
|
/*
|
|
* Open a pre-existing logfile segment for writing.
|
|
*/
|
|
int
|
|
XLogFileOpen(XLogSegNo segno)
|
|
{
|
|
char path[MAXPGPATH];
|
|
int fd;
|
|
|
|
XLogFilePath(path, ThisTimeLineID, segno);
|
|
|
|
fd = BasicOpenFile(path, O_RDWR | PG_BINARY | get_sync_bit(sync_method),
|
|
S_IRUSR | S_IWUSR);
|
|
if (fd < 0)
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not open xlog file \"%s\": %m", path)));
|
|
|
|
return fd;
|
|
}
|
|
|
|
/*
|
|
* Open a logfile segment for reading (during recovery).
|
|
*
|
|
* If source == XLOG_FROM_ARCHIVE, the segment is retrieved from archive.
|
|
* Otherwise, it's assumed to be already available in pg_xlog.
|
|
*/
|
|
static int
|
|
XLogFileRead(XLogSegNo segno, int emode, TimeLineID tli,
|
|
int source, bool notfoundOk)
|
|
{
|
|
char xlogfname[MAXFNAMELEN];
|
|
char activitymsg[MAXFNAMELEN + 16];
|
|
char path[MAXPGPATH];
|
|
int fd;
|
|
|
|
XLogFileName(xlogfname, tli, segno);
|
|
|
|
switch (source)
|
|
{
|
|
case XLOG_FROM_ARCHIVE:
|
|
/* Report recovery progress in PS display */
|
|
snprintf(activitymsg, sizeof(activitymsg), "waiting for %s",
|
|
xlogfname);
|
|
set_ps_display(activitymsg, false);
|
|
|
|
restoredFromArchive = RestoreArchivedFile(path, xlogfname,
|
|
"RECOVERYXLOG",
|
|
XLogSegSize,
|
|
InRedo);
|
|
if (!restoredFromArchive)
|
|
return -1;
|
|
break;
|
|
|
|
case XLOG_FROM_PG_XLOG:
|
|
case XLOG_FROM_STREAM:
|
|
XLogFilePath(path, tli, segno);
|
|
restoredFromArchive = false;
|
|
break;
|
|
|
|
default:
|
|
elog(ERROR, "invalid XLogFileRead source %d", source);
|
|
}
|
|
|
|
/*
|
|
* If the segment was fetched from archival storage, replace the existing
|
|
* xlog segment (if any) with the archival version.
|
|
*/
|
|
if (source == XLOG_FROM_ARCHIVE)
|
|
{
|
|
char xlogfpath[MAXPGPATH];
|
|
bool reload = false;
|
|
struct stat statbuf;
|
|
|
|
XLogFilePath(xlogfpath, tli, segno);
|
|
if (stat(xlogfpath, &statbuf) == 0)
|
|
{
|
|
char oldpath[MAXPGPATH];
|
|
#ifdef WIN32
|
|
static unsigned int deletedcounter = 1;
|
|
/*
|
|
* On Windows, if another process (e.g a walsender process) holds
|
|
* the file open in FILE_SHARE_DELETE mode, unlink will succeed,
|
|
* but the file will still show up in directory listing until the
|
|
* last handle is closed, and we cannot rename the new file in its
|
|
* place until that. To avoid that problem, rename the old file to
|
|
* a temporary name first. Use a counter to create a unique
|
|
* filename, because the same file might be restored from the
|
|
* archive multiple times, and a walsender could still be holding
|
|
* onto an old deleted version of it.
|
|
*/
|
|
snprintf(oldpath, MAXPGPATH, "%s.deleted%u",
|
|
xlogfpath, deletedcounter++);
|
|
if (rename(xlogfpath, oldpath) != 0)
|
|
{
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not rename file \"%s\" to \"%s\": %m",
|
|
xlogfpath, oldpath)));
|
|
}
|
|
#else
|
|
strncpy(oldpath, xlogfpath, MAXPGPATH);
|
|
#endif
|
|
if (unlink(oldpath) != 0)
|
|
ereport(FATAL,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not remove file \"%s\": %m",
|
|
xlogfpath)));
|
|
reload = true;
|
|
}
|
|
|
|
if (rename(path, xlogfpath) < 0)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not rename file \"%s\" to \"%s\": %m",
|
|
path, xlogfpath)));
|
|
|
|
/*
|
|
* Set path to point at the new file in pg_xlog.
|
|
*/
|
|
strncpy(path, xlogfpath, MAXPGPATH);
|
|
|
|
/*
|
|
* If the existing segment was replaced, since walsenders might have
|
|
* it open, request them to reload a currently-open segment.
|
|
*/
|
|
if (reload)
|
|
WalSndRqstFileReload();
|
|
|
|
/* Signal walsender that new WAL has arrived */
|
|
if (AllowCascadeReplication())
|
|
WalSndWakeup();
|
|
}
|
|
|
|
fd = BasicOpenFile(path, O_RDONLY | PG_BINARY, 0);
|
|
if (fd >= 0)
|
|
{
|
|
/* Success! */
|
|
curFileTLI = tli;
|
|
|
|
/* Report recovery progress in PS display */
|
|
snprintf(activitymsg, sizeof(activitymsg), "recovering %s",
|
|
xlogfname);
|
|
set_ps_display(activitymsg, false);
|
|
|
|
/* Track source of data in assorted state variables */
|
|
readSource = source;
|
|
XLogReceiptSource = source;
|
|
/* In FROM_STREAM case, caller tracks receipt time, not me */
|
|
if (source != XLOG_FROM_STREAM)
|
|
XLogReceiptTime = GetCurrentTimestamp();
|
|
|
|
/* The file header needs to be validated on first access */
|
|
readFileHeaderValidated = false;
|
|
|
|
return fd;
|
|
}
|
|
if (errno != ENOENT || !notfoundOk) /* unexpected failure? */
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not open file \"%s\": %m", path)));
|
|
return -1;
|
|
}
|
|
|
|
/*
|
|
* Open a logfile segment for reading (during recovery).
|
|
*
|
|
* This version searches for the segment with any TLI listed in expectedTLEs.
|
|
*/
|
|
static int
|
|
XLogFileReadAnyTLI(XLogSegNo segno, int emode, int source)
|
|
{
|
|
char path[MAXPGPATH];
|
|
ListCell *cell;
|
|
int fd;
|
|
|
|
/*
|
|
* Loop looking for a suitable timeline ID: we might need to read any of
|
|
* the timelines listed in expectedTLEs.
|
|
*
|
|
* We expect curFileTLI on entry to be the TLI of the preceding file in
|
|
* sequence, or 0 if there was no predecessor. We do not allow curFileTLI
|
|
* to go backwards; this prevents us from picking up the wrong file when a
|
|
* parent timeline extends to higher segment numbers than the child we
|
|
* want to read.
|
|
*/
|
|
foreach(cell, expectedTLEs)
|
|
{
|
|
TimeLineID tli = ((TimeLineHistoryEntry *) lfirst(cell))->tli;
|
|
|
|
if (tli < curFileTLI)
|
|
break; /* don't bother looking at too-old TLIs */
|
|
|
|
if (source == XLOG_FROM_ANY || source == XLOG_FROM_ARCHIVE)
|
|
{
|
|
fd = XLogFileRead(segno, emode, tli, XLOG_FROM_ARCHIVE, true);
|
|
if (fd != -1)
|
|
{
|
|
elog(DEBUG1, "got WAL segment from archive");
|
|
return fd;
|
|
}
|
|
}
|
|
|
|
if (source == XLOG_FROM_ANY || source == XLOG_FROM_PG_XLOG)
|
|
{
|
|
fd = XLogFileRead(segno, emode, tli, XLOG_FROM_PG_XLOG, true);
|
|
if (fd != -1)
|
|
return fd;
|
|
}
|
|
}
|
|
|
|
/* Couldn't find it. For simplicity, complain about front timeline */
|
|
XLogFilePath(path, recoveryTargetTLI, segno);
|
|
errno = ENOENT;
|
|
ereport(emode,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not open file \"%s\": %m", path)));
|
|
return -1;
|
|
}
|
|
|
|
/*
|
|
* Close the current logfile segment for writing.
|
|
*/
|
|
static void
|
|
XLogFileClose(void)
|
|
{
|
|
Assert(openLogFile >= 0);
|
|
|
|
/*
|
|
* WAL segment files will not be re-read in normal operation, so we advise
|
|
* the OS to release any cached pages. But do not do so if WAL archiving
|
|
* or streaming is active, because archiver and walsender process could
|
|
* use the cache to read the WAL segment.
|
|
*/
|
|
#if defined(USE_POSIX_FADVISE) && defined(POSIX_FADV_DONTNEED)
|
|
if (!XLogIsNeeded())
|
|
(void) posix_fadvise(openLogFile, 0, 0, POSIX_FADV_DONTNEED);
|
|
#endif
|
|
|
|
if (close(openLogFile))
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not close log file %s: %m",
|
|
XLogFileNameP(ThisTimeLineID, openLogSegNo))));
|
|
openLogFile = -1;
|
|
}
|
|
|
|
/*
|
|
* Preallocate log files beyond the specified log endpoint.
|
|
*
|
|
* XXX this is currently extremely conservative, since it forces only one
|
|
* future log segment to exist, and even that only if we are 75% done with
|
|
* the current one. This is only appropriate for very low-WAL-volume systems.
|
|
* High-volume systems will be OK once they've built up a sufficient set of
|
|
* recycled log segments, but the startup transient is likely to include
|
|
* a lot of segment creations by foreground processes, which is not so good.
|
|
*/
|
|
static void
|
|
PreallocXlogFiles(XLogRecPtr endptr)
|
|
{
|
|
XLogSegNo _logSegNo;
|
|
int lf;
|
|
bool use_existent;
|
|
|
|
XLByteToPrevSeg(endptr, _logSegNo);
|
|
if ((endptr - 1) % XLogSegSize >= (uint32) (0.75 * XLogSegSize))
|
|
{
|
|
_logSegNo++;
|
|
use_existent = true;
|
|
lf = XLogFileInit(_logSegNo, &use_existent, true);
|
|
close(lf);
|
|
if (!use_existent)
|
|
CheckpointStats.ckpt_segs_added++;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Get the segno of the latest removed or recycled WAL segment.
|
|
* Returns 0/0 if no WAL segments have been removed since startup.
|
|
*/
|
|
void
|
|
XLogGetLastRemoved(XLogSegNo *segno)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
*segno = xlogctl->lastRemovedSegNo;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/*
|
|
* Update the last removed segno pointer in shared memory, to reflect
|
|
* that the given XLOG file has been removed.
|
|
*/
|
|
static void
|
|
UpdateLastRemovedPtr(char *filename)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
uint32 tli;
|
|
XLogSegNo segno;
|
|
|
|
XLogFromFileName(filename, &tli, &segno);
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
if (segno > xlogctl->lastRemovedSegNo)
|
|
xlogctl->lastRemovedSegNo = segno;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/*
|
|
* Recycle or remove all log files older or equal to passed segno
|
|
*
|
|
* endptr is current (or recent) end of xlog; this is used to determine
|
|
* whether we want to recycle rather than delete no-longer-wanted log files.
|
|
*/
|
|
static void
|
|
RemoveOldXlogFiles(XLogSegNo segno, XLogRecPtr endptr)
|
|
{
|
|
XLogSegNo endlogSegNo;
|
|
int max_advance;
|
|
DIR *xldir;
|
|
struct dirent *xlde;
|
|
char lastoff[MAXFNAMELEN];
|
|
char path[MAXPGPATH];
|
|
|
|
#ifdef WIN32
|
|
char newpath[MAXPGPATH];
|
|
#endif
|
|
struct stat statbuf;
|
|
|
|
/*
|
|
* Initialize info about where to try to recycle to. We allow recycling
|
|
* segments up to XLOGfileslop segments beyond the current XLOG location.
|
|
*/
|
|
XLByteToPrevSeg(endptr, endlogSegNo);
|
|
max_advance = XLOGfileslop;
|
|
|
|
xldir = AllocateDir(XLOGDIR);
|
|
if (xldir == NULL)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not open transaction log directory \"%s\": %m",
|
|
XLOGDIR)));
|
|
|
|
XLogFileName(lastoff, ThisTimeLineID, segno);
|
|
|
|
elog(DEBUG2, "attempting to remove WAL segments older than log file %s",
|
|
lastoff);
|
|
|
|
while ((xlde = ReadDir(xldir, XLOGDIR)) != NULL)
|
|
{
|
|
/*
|
|
* We ignore the timeline part of the XLOG segment identifiers in
|
|
* deciding whether a segment is still needed. This ensures that we
|
|
* won't prematurely remove a segment from a parent timeline. We could
|
|
* probably be a little more proactive about removing segments of
|
|
* non-parent timelines, but that would be a whole lot more
|
|
* complicated.
|
|
*
|
|
* We use the alphanumeric sorting property of the filenames to decide
|
|
* which ones are earlier than the lastoff segment.
|
|
*/
|
|
if (strlen(xlde->d_name) == 24 &&
|
|
strspn(xlde->d_name, "0123456789ABCDEF") == 24 &&
|
|
strcmp(xlde->d_name + 8, lastoff + 8) <= 0)
|
|
{
|
|
if (RecoveryInProgress() || XLogArchiveCheckDone(xlde->d_name))
|
|
{
|
|
snprintf(path, MAXPGPATH, XLOGDIR "/%s", xlde->d_name);
|
|
|
|
/* Update the last removed location in shared memory first */
|
|
UpdateLastRemovedPtr(xlde->d_name);
|
|
|
|
/*
|
|
* Before deleting the file, see if it can be recycled as a
|
|
* future log segment. Only recycle normal files, pg_standby
|
|
* for example can create symbolic links pointing to a
|
|
* separate archive directory.
|
|
*/
|
|
if (lstat(path, &statbuf) == 0 && S_ISREG(statbuf.st_mode) &&
|
|
InstallXLogFileSegment(&endlogSegNo, path,
|
|
true, &max_advance, true))
|
|
{
|
|
ereport(DEBUG2,
|
|
(errmsg("recycled transaction log file \"%s\"",
|
|
xlde->d_name)));
|
|
CheckpointStats.ckpt_segs_recycled++;
|
|
/* Needn't recheck that slot on future iterations */
|
|
if (max_advance > 0)
|
|
{
|
|
endlogSegNo++;
|
|
max_advance--;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
/* No need for any more future segments... */
|
|
int rc;
|
|
|
|
ereport(DEBUG2,
|
|
(errmsg("removing transaction log file \"%s\"",
|
|
xlde->d_name)));
|
|
|
|
#ifdef WIN32
|
|
|
|
/*
|
|
* On Windows, if another process (e.g another backend)
|
|
* holds the file open in FILE_SHARE_DELETE mode, unlink
|
|
* will succeed, but the file will still show up in
|
|
* directory listing until the last handle is closed. To
|
|
* avoid confusing the lingering deleted file for a live
|
|
* WAL file that needs to be archived, rename it before
|
|
* deleting it.
|
|
*
|
|
* If another process holds the file open without
|
|
* FILE_SHARE_DELETE flag, rename will fail. We'll try
|
|
* again at the next checkpoint.
|
|
*/
|
|
snprintf(newpath, MAXPGPATH, "%s.deleted", path);
|
|
if (rename(path, newpath) != 0)
|
|
{
|
|
ereport(LOG,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not rename old transaction log file \"%s\": %m",
|
|
path)));
|
|
continue;
|
|
}
|
|
rc = unlink(newpath);
|
|
#else
|
|
rc = unlink(path);
|
|
#endif
|
|
if (rc != 0)
|
|
{
|
|
ereport(LOG,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not remove old transaction log file \"%s\": %m",
|
|
path)));
|
|
continue;
|
|
}
|
|
CheckpointStats.ckpt_segs_removed++;
|
|
}
|
|
|
|
XLogArchiveCleanup(xlde->d_name);
|
|
}
|
|
}
|
|
}
|
|
|
|
FreeDir(xldir);
|
|
}
|
|
|
|
/*
|
|
* Verify whether pg_xlog and pg_xlog/archive_status exist.
|
|
* If the latter does not exist, recreate it.
|
|
*
|
|
* It is not the goal of this function to verify the contents of these
|
|
* directories, but to help in cases where someone has performed a cluster
|
|
* copy for PITR purposes but omitted pg_xlog from the copy.
|
|
*
|
|
* We could also recreate pg_xlog if it doesn't exist, but a deliberate
|
|
* policy decision was made not to. It is fairly common for pg_xlog to be
|
|
* a symlink, and if that was the DBA's intent then automatically making a
|
|
* plain directory would result in degraded performance with no notice.
|
|
*/
|
|
static void
|
|
ValidateXLOGDirectoryStructure(void)
|
|
{
|
|
char path[MAXPGPATH];
|
|
struct stat stat_buf;
|
|
|
|
/* Check for pg_xlog; if it doesn't exist, error out */
|
|
if (stat(XLOGDIR, &stat_buf) != 0 ||
|
|
!S_ISDIR(stat_buf.st_mode))
|
|
ereport(FATAL,
|
|
(errmsg("required WAL directory \"%s\" does not exist",
|
|
XLOGDIR)));
|
|
|
|
/* Check for archive_status */
|
|
snprintf(path, MAXPGPATH, XLOGDIR "/archive_status");
|
|
if (stat(path, &stat_buf) == 0)
|
|
{
|
|
/* Check for weird cases where it exists but isn't a directory */
|
|
if (!S_ISDIR(stat_buf.st_mode))
|
|
ereport(FATAL,
|
|
(errmsg("required WAL directory \"%s\" does not exist",
|
|
path)));
|
|
}
|
|
else
|
|
{
|
|
ereport(LOG,
|
|
(errmsg("creating missing WAL directory \"%s\"", path)));
|
|
if (mkdir(path, S_IRWXU) < 0)
|
|
ereport(FATAL,
|
|
(errmsg("could not create missing directory \"%s\": %m",
|
|
path)));
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Remove previous backup history files. This also retries creation of
|
|
* .ready files for any backup history files for which XLogArchiveNotify
|
|
* failed earlier.
|
|
*/
|
|
static void
|
|
CleanupBackupHistory(void)
|
|
{
|
|
DIR *xldir;
|
|
struct dirent *xlde;
|
|
char path[MAXPGPATH];
|
|
|
|
xldir = AllocateDir(XLOGDIR);
|
|
if (xldir == NULL)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not open transaction log directory \"%s\": %m",
|
|
XLOGDIR)));
|
|
|
|
while ((xlde = ReadDir(xldir, XLOGDIR)) != NULL)
|
|
{
|
|
if (strlen(xlde->d_name) > 24 &&
|
|
strspn(xlde->d_name, "0123456789ABCDEF") == 24 &&
|
|
strcmp(xlde->d_name + strlen(xlde->d_name) - strlen(".backup"),
|
|
".backup") == 0)
|
|
{
|
|
if (XLogArchiveCheckDone(xlde->d_name))
|
|
{
|
|
ereport(DEBUG2,
|
|
(errmsg("removing transaction log backup history file \"%s\"",
|
|
xlde->d_name)));
|
|
snprintf(path, MAXPGPATH, XLOGDIR "/%s", xlde->d_name);
|
|
unlink(path);
|
|
XLogArchiveCleanup(xlde->d_name);
|
|
}
|
|
}
|
|
}
|
|
|
|
FreeDir(xldir);
|
|
}
|
|
|
|
/*
|
|
* Restore a full-page image from a backup block attached to an XLOG record.
|
|
*
|
|
* lsn: LSN of the XLOG record being replayed
|
|
* record: the complete XLOG record
|
|
* block_index: which backup block to restore (0 .. XLR_MAX_BKP_BLOCKS - 1)
|
|
* get_cleanup_lock: TRUE to get a cleanup rather than plain exclusive lock
|
|
* keep_buffer: TRUE to return the buffer still locked and pinned
|
|
*
|
|
* Returns the buffer number containing the page. Note this is not terribly
|
|
* useful unless keep_buffer is specified as TRUE.
|
|
*
|
|
* Note: when a backup block is available in XLOG, we restore it
|
|
* unconditionally, even if the page in the database appears newer.
|
|
* This is to protect ourselves against database pages that were partially
|
|
* or incorrectly written during a crash. We assume that the XLOG data
|
|
* must be good because it has passed a CRC check, while the database
|
|
* page might not be. This will force us to replay all subsequent
|
|
* modifications of the page that appear in XLOG, rather than possibly
|
|
* ignoring them as already applied, but that's not a huge drawback.
|
|
*
|
|
* If 'get_cleanup_lock' is true, a cleanup lock is obtained on the buffer,
|
|
* else a normal exclusive lock is used. During crash recovery, that's just
|
|
* pro forma because there can't be any regular backends in the system, but
|
|
* in hot standby mode the distinction is important.
|
|
*
|
|
* If 'keep_buffer' is true, return without releasing the buffer lock and pin;
|
|
* then caller is responsible for doing UnlockReleaseBuffer() later. This
|
|
* is needed in some cases when replaying XLOG records that touch multiple
|
|
* pages, to prevent inconsistent states from being visible to other backends.
|
|
* (Again, that's only important in hot standby mode.)
|
|
*/
|
|
Buffer
|
|
RestoreBackupBlock(XLogRecPtr lsn, XLogRecord *record, int block_index,
|
|
bool get_cleanup_lock, bool keep_buffer)
|
|
{
|
|
Buffer buffer;
|
|
Page page;
|
|
BkpBlock bkpb;
|
|
char *blk;
|
|
int i;
|
|
|
|
/* Locate requested BkpBlock in the record */
|
|
blk = (char *) XLogRecGetData(record) + record->xl_len;
|
|
for (i = 0; i < XLR_MAX_BKP_BLOCKS; i++)
|
|
{
|
|
if (!(record->xl_info & XLR_BKP_BLOCK(i)))
|
|
continue;
|
|
|
|
memcpy(&bkpb, blk, sizeof(BkpBlock));
|
|
blk += sizeof(BkpBlock);
|
|
|
|
if (i == block_index)
|
|
{
|
|
/* Found it, apply the update */
|
|
buffer = XLogReadBufferExtended(bkpb.node, bkpb.fork, bkpb.block,
|
|
RBM_ZERO);
|
|
Assert(BufferIsValid(buffer));
|
|
if (get_cleanup_lock)
|
|
LockBufferForCleanup(buffer);
|
|
else
|
|
LockBuffer(buffer, BUFFER_LOCK_EXCLUSIVE);
|
|
|
|
page = (Page) BufferGetPage(buffer);
|
|
|
|
if (bkpb.hole_length == 0)
|
|
{
|
|
memcpy((char *) page, blk, BLCKSZ);
|
|
}
|
|
else
|
|
{
|
|
memcpy((char *) page, blk, bkpb.hole_offset);
|
|
/* must zero-fill the hole */
|
|
MemSet((char *) page + bkpb.hole_offset, 0, bkpb.hole_length);
|
|
memcpy((char *) page + (bkpb.hole_offset + bkpb.hole_length),
|
|
blk + bkpb.hole_offset,
|
|
BLCKSZ - (bkpb.hole_offset + bkpb.hole_length));
|
|
}
|
|
|
|
PageSetLSN(page, lsn);
|
|
PageSetTLI(page, ThisTimeLineID);
|
|
MarkBufferDirty(buffer);
|
|
|
|
if (!keep_buffer)
|
|
UnlockReleaseBuffer(buffer);
|
|
|
|
return buffer;
|
|
}
|
|
|
|
blk += BLCKSZ - bkpb.hole_length;
|
|
}
|
|
|
|
/* Caller specified a bogus block_index */
|
|
elog(ERROR, "failed to restore block_index %d", block_index);
|
|
return InvalidBuffer; /* keep compiler quiet */
|
|
}
|
|
|
|
/*
|
|
* CRC-check an XLOG record. We do not believe the contents of an XLOG
|
|
* record (other than to the minimal extent of computing the amount of
|
|
* data to read in) until we've checked the CRCs.
|
|
*
|
|
* We assume all of the record (that is, xl_tot_len bytes) has been read
|
|
* into memory at *record. Also, ValidXLogRecordHeader() has accepted the
|
|
* record's header, which means in particular that xl_tot_len is at least
|
|
* SizeOfXlogRecord, so it is safe to fetch xl_len.
|
|
*/
|
|
static bool
|
|
RecordIsValid(XLogRecord *record, XLogRecPtr recptr, int emode)
|
|
{
|
|
pg_crc32 crc;
|
|
int i;
|
|
uint32 len = record->xl_len;
|
|
BkpBlock bkpb;
|
|
char *blk;
|
|
size_t remaining = record->xl_tot_len;
|
|
|
|
/* First the rmgr data */
|
|
if (remaining < SizeOfXLogRecord + len)
|
|
{
|
|
/* ValidXLogRecordHeader() should've caught this already... */
|
|
ereport(emode_for_corrupt_record(emode, recptr),
|
|
(errmsg("invalid record length at %X/%X",
|
|
(uint32) (recptr >> 32), (uint32) recptr)));
|
|
return false;
|
|
}
|
|
remaining -= SizeOfXLogRecord + len;
|
|
INIT_CRC32(crc);
|
|
COMP_CRC32(crc, XLogRecGetData(record), len);
|
|
|
|
/* Add in the backup blocks, if any */
|
|
blk = (char *) XLogRecGetData(record) + len;
|
|
for (i = 0; i < XLR_MAX_BKP_BLOCKS; i++)
|
|
{
|
|
uint32 blen;
|
|
|
|
if (!(record->xl_info & XLR_BKP_BLOCK(i)))
|
|
continue;
|
|
|
|
if (remaining < sizeof(BkpBlock))
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, recptr),
|
|
(errmsg("invalid backup block size in record at %X/%X",
|
|
(uint32) (recptr >> 32), (uint32) recptr)));
|
|
return false;
|
|
}
|
|
memcpy(&bkpb, blk, sizeof(BkpBlock));
|
|
|
|
if (bkpb.hole_offset + bkpb.hole_length > BLCKSZ)
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, recptr),
|
|
(errmsg("incorrect hole size in record at %X/%X",
|
|
(uint32) (recptr >> 32), (uint32) recptr)));
|
|
return false;
|
|
}
|
|
blen = sizeof(BkpBlock) + BLCKSZ - bkpb.hole_length;
|
|
|
|
if (remaining < blen)
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, recptr),
|
|
(errmsg("invalid backup block size in record at %X/%X",
|
|
(uint32) (recptr >> 32), (uint32) recptr)));
|
|
return false;
|
|
}
|
|
remaining -= blen;
|
|
COMP_CRC32(crc, blk, blen);
|
|
blk += blen;
|
|
}
|
|
|
|
/* Check that xl_tot_len agrees with our calculation */
|
|
if (remaining != 0)
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, recptr),
|
|
(errmsg("incorrect total length in record at %X/%X",
|
|
(uint32) (recptr >> 32), (uint32) recptr)));
|
|
return false;
|
|
}
|
|
|
|
/* Finally include the record header */
|
|
COMP_CRC32(crc, (char *) record, offsetof(XLogRecord, xl_crc));
|
|
FIN_CRC32(crc);
|
|
|
|
if (!EQ_CRC32(record->xl_crc, crc))
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, recptr),
|
|
(errmsg("incorrect resource manager data checksum in record at %X/%X",
|
|
(uint32) (recptr >> 32), (uint32) recptr)));
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
/*
|
|
* Attempt to read an XLOG record.
|
|
*
|
|
* If RecPtr is not NULL, try to read a record at that position. Otherwise
|
|
* try to read a record just after the last one previously read.
|
|
*
|
|
* If no valid record is available, returns NULL, or fails if emode is PANIC.
|
|
* (emode must be either PANIC, LOG)
|
|
*
|
|
* The record is copied into readRecordBuf, so that on successful return,
|
|
* the returned record pointer always points there.
|
|
*/
|
|
static XLogRecord *
|
|
ReadRecord(XLogRecPtr *RecPtr, int emode, bool fetching_ckpt)
|
|
{
|
|
XLogRecord *record;
|
|
XLogRecPtr tmpRecPtr = EndRecPtr;
|
|
bool randAccess = false;
|
|
uint32 len,
|
|
total_len;
|
|
uint32 targetRecOff;
|
|
uint32 pageHeaderSize;
|
|
bool gotheader;
|
|
|
|
if (readBuf == NULL)
|
|
{
|
|
/*
|
|
* First time through, permanently allocate readBuf. We do it this
|
|
* way, rather than just making a static array, for two reasons: (1)
|
|
* no need to waste the storage in most instantiations of the backend;
|
|
* (2) a static char array isn't guaranteed to have any particular
|
|
* alignment, whereas malloc() will provide MAXALIGN'd storage.
|
|
*/
|
|
readBuf = (char *) malloc(XLOG_BLCKSZ);
|
|
Assert(readBuf != NULL);
|
|
}
|
|
|
|
if (RecPtr == NULL)
|
|
{
|
|
RecPtr = &tmpRecPtr;
|
|
|
|
/*
|
|
* RecPtr is pointing to end+1 of the previous WAL record. If
|
|
* we're at a page boundary, no more records can fit on the current
|
|
* page. We must skip over the page header, but we can't do that
|
|
* until we've read in the page, since the header size is variable.
|
|
*/
|
|
}
|
|
else
|
|
{
|
|
/*
|
|
* In this case, the passed-in record pointer should already be
|
|
* pointing to a valid record starting position.
|
|
*/
|
|
if (!XRecOffIsValid(*RecPtr))
|
|
ereport(PANIC,
|
|
(errmsg("invalid record offset at %X/%X",
|
|
(uint32) (*RecPtr >> 32), (uint32) *RecPtr)));
|
|
|
|
/*
|
|
* Since we are going to a random position in WAL, forget any prior
|
|
* state about what timeline we were in, and allow it to be any
|
|
* timeline in expectedTLEs. We also set a flag to allow curFileTLI
|
|
* to go backwards (but we can't reset that variable right here, since
|
|
* we might not change files at all).
|
|
*/
|
|
/* see comment in ValidXLogPageHeader */
|
|
lastPageTLI = lastSegmentTLI = 0;
|
|
randAccess = true; /* allow curFileTLI to go backwards too */
|
|
}
|
|
|
|
/* This is the first try to read this page. */
|
|
lastSourceFailed = false;
|
|
retry:
|
|
/* Read the page containing the record */
|
|
if (!XLogPageRead(RecPtr, emode, fetching_ckpt, randAccess))
|
|
return NULL;
|
|
|
|
pageHeaderSize = XLogPageHeaderSize((XLogPageHeader) readBuf);
|
|
targetRecOff = (*RecPtr) % XLOG_BLCKSZ;
|
|
if (targetRecOff == 0)
|
|
{
|
|
/*
|
|
* At page start, so skip over page header. The Assert checks that
|
|
* we're not scribbling on caller's record pointer; it's OK because we
|
|
* can only get here in the continuing-from-prev-record case, since
|
|
* XRecOffIsValid rejected the zero-page-offset case otherwise.
|
|
*/
|
|
Assert(RecPtr == &tmpRecPtr);
|
|
(*RecPtr) += pageHeaderSize;
|
|
targetRecOff = pageHeaderSize;
|
|
}
|
|
else if (targetRecOff < pageHeaderSize)
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errmsg("invalid record offset at %X/%X",
|
|
(uint32) ((*RecPtr) >> 32), (uint32) *RecPtr)));
|
|
goto next_record_is_invalid;
|
|
}
|
|
if ((((XLogPageHeader) readBuf)->xlp_info & XLP_FIRST_IS_CONTRECORD) &&
|
|
targetRecOff == pageHeaderSize)
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errmsg("contrecord is requested by %X/%X",
|
|
(uint32) ((*RecPtr) >> 32), (uint32) *RecPtr)));
|
|
goto next_record_is_invalid;
|
|
}
|
|
|
|
/*
|
|
* Read the record length.
|
|
*
|
|
* NB: Even though we use an XLogRecord pointer here, the whole record
|
|
* header might not fit on this page. xl_tot_len is the first field of
|
|
* the struct, so it must be on this page (the records are MAXALIGNed),
|
|
* but we cannot access any other fields until we've verified that we
|
|
* got the whole header.
|
|
*/
|
|
record = (XLogRecord *) (readBuf + (*RecPtr) % XLOG_BLCKSZ);
|
|
total_len = record->xl_tot_len;
|
|
|
|
/*
|
|
* If the whole record header is on this page, validate it immediately.
|
|
* Otherwise do just a basic sanity check on xl_tot_len, and validate the
|
|
* rest of the header after reading it from the next page. The xl_tot_len
|
|
* check is necessary here to ensure that we enter the "Need to reassemble
|
|
* record" code path below; otherwise we might fail to apply
|
|
* ValidXLogRecordHeader at all.
|
|
*/
|
|
if (targetRecOff <= XLOG_BLCKSZ - SizeOfXLogRecord)
|
|
{
|
|
if (!ValidXLogRecordHeader(RecPtr, record, emode, randAccess))
|
|
goto next_record_is_invalid;
|
|
gotheader = true;
|
|
}
|
|
else
|
|
{
|
|
if (total_len < SizeOfXLogRecord)
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errmsg("invalid record length at %X/%X",
|
|
(uint32) ((*RecPtr) >> 32), (uint32) *RecPtr)));
|
|
goto next_record_is_invalid;
|
|
}
|
|
gotheader = false;
|
|
}
|
|
|
|
/*
|
|
* Allocate or enlarge readRecordBuf as needed. To avoid useless small
|
|
* increases, round its size to a multiple of XLOG_BLCKSZ, and make sure
|
|
* it's at least 4*Max(BLCKSZ, XLOG_BLCKSZ) to start with. (That is
|
|
* enough for all "normal" records, but very large commit or abort records
|
|
* might need more space.)
|
|
*/
|
|
if (total_len > readRecordBufSize)
|
|
{
|
|
uint32 newSize = total_len;
|
|
|
|
newSize += XLOG_BLCKSZ - (newSize % XLOG_BLCKSZ);
|
|
newSize = Max(newSize, 4 * Max(BLCKSZ, XLOG_BLCKSZ));
|
|
if (readRecordBuf)
|
|
free(readRecordBuf);
|
|
readRecordBuf = (char *) malloc(newSize);
|
|
if (!readRecordBuf)
|
|
{
|
|
readRecordBufSize = 0;
|
|
/* We treat this as a "bogus data" condition */
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errmsg("record length %u at %X/%X too long",
|
|
total_len, (uint32) ((*RecPtr) >> 32), (uint32) *RecPtr)));
|
|
goto next_record_is_invalid;
|
|
}
|
|
readRecordBufSize = newSize;
|
|
}
|
|
|
|
len = XLOG_BLCKSZ - (*RecPtr) % XLOG_BLCKSZ;
|
|
if (total_len > len)
|
|
{
|
|
/* Need to reassemble record */
|
|
char *contrecord;
|
|
XLogPageHeader pageHeader;
|
|
XLogRecPtr pagelsn;
|
|
char *buffer;
|
|
uint32 gotlen;
|
|
|
|
/* Initialize pagelsn to the beginning of the page this record is on */
|
|
pagelsn = ((*RecPtr) / XLOG_BLCKSZ) * XLOG_BLCKSZ;
|
|
|
|
/* Copy the first fragment of the record from the first page. */
|
|
memcpy(readRecordBuf, readBuf + (*RecPtr) % XLOG_BLCKSZ, len);
|
|
buffer = readRecordBuf + len;
|
|
gotlen = len;
|
|
|
|
do
|
|
{
|
|
/* Calculate pointer to beginning of next page */
|
|
XLByteAdvance(pagelsn, XLOG_BLCKSZ);
|
|
/* Wait for the next page to become available */
|
|
if (!XLogPageRead(&pagelsn, emode, false, false))
|
|
return NULL;
|
|
|
|
/* Check that the continuation on next page looks valid */
|
|
pageHeader = (XLogPageHeader) readBuf;
|
|
if (!(pageHeader->xlp_info & XLP_FIRST_IS_CONTRECORD))
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errmsg("there is no contrecord flag in log segment %s, offset %u",
|
|
XLogFileNameP(curFileTLI, readSegNo),
|
|
readOff)));
|
|
goto next_record_is_invalid;
|
|
}
|
|
/*
|
|
* Cross-check that xlp_rem_len agrees with how much of the record
|
|
* we expect there to be left.
|
|
*/
|
|
if (pageHeader->xlp_rem_len == 0 ||
|
|
total_len != (pageHeader->xlp_rem_len + gotlen))
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errmsg("invalid contrecord length %u in log segment %s, offset %u",
|
|
pageHeader->xlp_rem_len,
|
|
XLogFileNameP(curFileTLI, readSegNo),
|
|
readOff)));
|
|
goto next_record_is_invalid;
|
|
}
|
|
|
|
/* Append the continuation from this page to the buffer */
|
|
pageHeaderSize = XLogPageHeaderSize(pageHeader);
|
|
contrecord = (char *) readBuf + pageHeaderSize;
|
|
len = XLOG_BLCKSZ - pageHeaderSize;
|
|
if (pageHeader->xlp_rem_len < len)
|
|
len = pageHeader->xlp_rem_len;
|
|
memcpy(buffer, (char *) contrecord, len);
|
|
buffer += len;
|
|
gotlen += len;
|
|
|
|
/* If we just reassembled the record header, validate it. */
|
|
if (!gotheader)
|
|
{
|
|
record = (XLogRecord *) readRecordBuf;
|
|
if (!ValidXLogRecordHeader(RecPtr, record, emode, randAccess))
|
|
goto next_record_is_invalid;
|
|
gotheader = true;
|
|
}
|
|
} while (pageHeader->xlp_rem_len > len);
|
|
|
|
record = (XLogRecord *) readRecordBuf;
|
|
if (!RecordIsValid(record, *RecPtr, emode))
|
|
goto next_record_is_invalid;
|
|
pageHeaderSize = XLogPageHeaderSize((XLogPageHeader) readBuf);
|
|
XLogSegNoOffsetToRecPtr(
|
|
readSegNo,
|
|
readOff + pageHeaderSize + MAXALIGN(pageHeader->xlp_rem_len),
|
|
EndRecPtr);
|
|
ReadRecPtr = *RecPtr;
|
|
}
|
|
else
|
|
{
|
|
/* Record does not cross a page boundary */
|
|
if (!RecordIsValid(record, *RecPtr, emode))
|
|
goto next_record_is_invalid;
|
|
EndRecPtr = *RecPtr + MAXALIGN(total_len);
|
|
|
|
ReadRecPtr = *RecPtr;
|
|
memcpy(readRecordBuf, record, total_len);
|
|
}
|
|
|
|
/*
|
|
* Special processing if it's an XLOG SWITCH record
|
|
*/
|
|
if (record->xl_rmid == RM_XLOG_ID && record->xl_info == XLOG_SWITCH)
|
|
{
|
|
/* Pretend it extends to end of segment */
|
|
EndRecPtr += XLogSegSize - 1;
|
|
EndRecPtr -= EndRecPtr % XLogSegSize;
|
|
|
|
/*
|
|
* Pretend that readBuf contains the last page of the segment. This is
|
|
* just to avoid Assert failure in StartupXLOG if XLOG ends with this
|
|
* segment.
|
|
*/
|
|
readOff = XLogSegSize - XLOG_BLCKSZ;
|
|
}
|
|
return record;
|
|
|
|
next_record_is_invalid:
|
|
lastSourceFailed = true;
|
|
|
|
if (readFile >= 0)
|
|
{
|
|
close(readFile);
|
|
readFile = -1;
|
|
}
|
|
|
|
/* In standby-mode, keep trying */
|
|
if (StandbyMode)
|
|
goto retry;
|
|
else
|
|
return NULL;
|
|
}
|
|
|
|
/*
|
|
* Check whether the xlog header of a page just read in looks valid.
|
|
*
|
|
* This is just a convenience subroutine to avoid duplicated code in
|
|
* ReadRecord. It's not intended for use from anywhere else.
|
|
*/
|
|
static bool
|
|
ValidXLogPageHeader(XLogPageHeader hdr, int emode, bool segmentonly)
|
|
{
|
|
XLogRecPtr recaddr;
|
|
|
|
XLogSegNoOffsetToRecPtr(readSegNo, readOff, recaddr);
|
|
|
|
if (hdr->xlp_magic != XLOG_PAGE_MAGIC)
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, recaddr),
|
|
(errmsg("invalid magic number %04X in log segment %s, offset %u",
|
|
hdr->xlp_magic,
|
|
XLogFileNameP(curFileTLI, readSegNo),
|
|
readOff)));
|
|
return false;
|
|
}
|
|
if ((hdr->xlp_info & ~XLP_ALL_FLAGS) != 0)
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, recaddr),
|
|
(errmsg("invalid info bits %04X in log segment %s, offset %u",
|
|
hdr->xlp_info,
|
|
XLogFileNameP(curFileTLI, readSegNo),
|
|
readOff)));
|
|
return false;
|
|
}
|
|
if (hdr->xlp_info & XLP_LONG_HEADER)
|
|
{
|
|
XLogLongPageHeader longhdr = (XLogLongPageHeader) hdr;
|
|
|
|
if (longhdr->xlp_sysid != ControlFile->system_identifier)
|
|
{
|
|
char fhdrident_str[32];
|
|
char sysident_str[32];
|
|
|
|
/*
|
|
* Format sysids separately to keep platform-dependent format code
|
|
* out of the translatable message string.
|
|
*/
|
|
snprintf(fhdrident_str, sizeof(fhdrident_str), UINT64_FORMAT,
|
|
longhdr->xlp_sysid);
|
|
snprintf(sysident_str, sizeof(sysident_str), UINT64_FORMAT,
|
|
ControlFile->system_identifier);
|
|
ereport(emode_for_corrupt_record(emode, recaddr),
|
|
(errmsg("WAL file is from different database system"),
|
|
errdetail("WAL file database system identifier is %s, pg_control database system identifier is %s.",
|
|
fhdrident_str, sysident_str)));
|
|
return false;
|
|
}
|
|
if (longhdr->xlp_seg_size != XLogSegSize)
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, recaddr),
|
|
(errmsg("WAL file is from different database system"),
|
|
errdetail("Incorrect XLOG_SEG_SIZE in page header.")));
|
|
return false;
|
|
}
|
|
if (longhdr->xlp_xlog_blcksz != XLOG_BLCKSZ)
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, recaddr),
|
|
(errmsg("WAL file is from different database system"),
|
|
errdetail("Incorrect XLOG_BLCKSZ in page header.")));
|
|
return false;
|
|
}
|
|
}
|
|
else if (readOff == 0)
|
|
{
|
|
/* hmm, first page of file doesn't have a long header? */
|
|
ereport(emode_for_corrupt_record(emode, recaddr),
|
|
(errmsg("invalid info bits %04X in log segment %s, offset %u",
|
|
hdr->xlp_info,
|
|
XLogFileNameP(curFileTLI, readSegNo),
|
|
readOff)));
|
|
return false;
|
|
}
|
|
|
|
if (!XLByteEQ(hdr->xlp_pageaddr, recaddr))
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, recaddr),
|
|
(errmsg("unexpected pageaddr %X/%X in log segment %s, offset %u",
|
|
(uint32) (hdr->xlp_pageaddr >> 32), (uint32) hdr->xlp_pageaddr,
|
|
XLogFileNameP(curFileTLI, readSegNo),
|
|
readOff)));
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* Check page TLI is one of the expected values.
|
|
*/
|
|
if (!tliInHistory(hdr->xlp_tli, expectedTLEs))
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, recaddr),
|
|
(errmsg("unexpected timeline ID %u in log segment %s, offset %u",
|
|
hdr->xlp_tli,
|
|
XLogFileNameP(curFileTLI, readSegNo),
|
|
readOff)));
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* Since child timelines are always assigned a TLI greater than their
|
|
* immediate parent's TLI, we should never see TLI go backwards across
|
|
* successive pages of a consistent WAL sequence.
|
|
*
|
|
* Of course this check should only be applied when advancing sequentially
|
|
* across pages; therefore ReadRecord resets lastPageTLI and
|
|
* lastSegmentTLI to zero when going to a random page.
|
|
*
|
|
* Sometimes we re-open a segment that's already been partially replayed.
|
|
* In that case we cannot perform the normal TLI check: if there is a
|
|
* timeline switch within the segment, the first page has a smaller TLI
|
|
* than later pages following the timeline switch, and we might've read
|
|
* them already. As a weaker test, we still check that it's not smaller
|
|
* than the TLI we last saw at the beginning of a segment. Pass
|
|
* segmentonly = true when re-validating the first page like that, and the
|
|
* page you're actually interested in comes later.
|
|
*/
|
|
if (hdr->xlp_tli < (segmentonly ? lastSegmentTLI : lastPageTLI))
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, recaddr),
|
|
(errmsg("out-of-sequence timeline ID %u (after %u) in log segment %s, offset %u",
|
|
hdr->xlp_tli,
|
|
segmentonly ? lastSegmentTLI : lastPageTLI,
|
|
XLogFileNameP(curFileTLI, readSegNo),
|
|
readOff)));
|
|
return false;
|
|
}
|
|
lastPageTLI = hdr->xlp_tli;
|
|
if (readOff == 0)
|
|
lastSegmentTLI = hdr->xlp_tli;
|
|
|
|
return true;
|
|
}
|
|
|
|
/*
|
|
* Validate an XLOG record header.
|
|
*
|
|
* This is just a convenience subroutine to avoid duplicated code in
|
|
* ReadRecord. It's not intended for use from anywhere else.
|
|
*/
|
|
static bool
|
|
ValidXLogRecordHeader(XLogRecPtr *RecPtr, XLogRecord *record, int emode,
|
|
bool randAccess)
|
|
{
|
|
/*
|
|
* xl_len == 0 is bad data for everything except XLOG SWITCH, where it is
|
|
* required.
|
|
*/
|
|
if (record->xl_rmid == RM_XLOG_ID && record->xl_info == XLOG_SWITCH)
|
|
{
|
|
if (record->xl_len != 0)
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errmsg("invalid xlog switch record at %X/%X",
|
|
(uint32) ((*RecPtr) >> 32), (uint32) *RecPtr)));
|
|
return false;
|
|
}
|
|
}
|
|
else if (record->xl_len == 0)
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errmsg("record with zero length at %X/%X",
|
|
(uint32) ((*RecPtr) >> 32), (uint32) *RecPtr)));
|
|
return false;
|
|
}
|
|
if (record->xl_tot_len < SizeOfXLogRecord + record->xl_len ||
|
|
record->xl_tot_len > SizeOfXLogRecord + record->xl_len +
|
|
XLR_MAX_BKP_BLOCKS * (sizeof(BkpBlock) + BLCKSZ))
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errmsg("invalid record length at %X/%X",
|
|
(uint32) ((*RecPtr) >> 32), (uint32) *RecPtr)));
|
|
return false;
|
|
}
|
|
if (record->xl_rmid > RM_MAX_ID)
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errmsg("invalid resource manager ID %u at %X/%X",
|
|
record->xl_rmid, (uint32) ((*RecPtr) >> 32), (uint32) *RecPtr)));
|
|
return false;
|
|
}
|
|
if (randAccess)
|
|
{
|
|
/*
|
|
* We can't exactly verify the prev-link, but surely it should be less
|
|
* than the record's own address.
|
|
*/
|
|
if (!XLByteLT(record->xl_prev, *RecPtr))
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errmsg("record with incorrect prev-link %X/%X at %X/%X",
|
|
(uint32) (record->xl_prev >> 32), (uint32) record->xl_prev,
|
|
(uint32) ((*RecPtr) >> 32), (uint32) *RecPtr)));
|
|
return false;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
/*
|
|
* Record's prev-link should exactly match our previous location. This
|
|
* check guards against torn WAL pages where a stale but valid-looking
|
|
* WAL record starts on a sector boundary.
|
|
*/
|
|
if (!XLByteEQ(record->xl_prev, ReadRecPtr))
|
|
{
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errmsg("record with incorrect prev-link %X/%X at %X/%X",
|
|
(uint32) (record->xl_prev >> 32), (uint32) record->xl_prev,
|
|
(uint32) ((*RecPtr) >> 32), (uint32) *RecPtr)));
|
|
return false;
|
|
}
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
/*
|
|
* Scan for new timelines that might have appeared in the archive since we
|
|
* started recovery.
|
|
*
|
|
* If there are any, the function changes recovery target TLI to the latest
|
|
* one and returns 'true'.
|
|
*/
|
|
static bool
|
|
rescanLatestTimeLine(void)
|
|
{
|
|
List *newExpectedTLEs;
|
|
bool found;
|
|
ListCell *cell;
|
|
TimeLineID newtarget;
|
|
TimeLineHistoryEntry *currentTle = NULL;
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
newtarget = findNewestTimeLine(recoveryTargetTLI);
|
|
if (newtarget == recoveryTargetTLI)
|
|
{
|
|
/* No new timelines found */
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* Determine the list of expected TLIs for the new TLI
|
|
*/
|
|
|
|
newExpectedTLEs = readTimeLineHistory(newtarget);
|
|
|
|
/*
|
|
* If the current timeline is not part of the history of the new
|
|
* timeline, we cannot proceed to it.
|
|
*/
|
|
found = false;
|
|
foreach (cell, newExpectedTLEs)
|
|
{
|
|
currentTle = (TimeLineHistoryEntry *) lfirst(cell);
|
|
|
|
if (currentTle->tli == recoveryTargetTLI)
|
|
{
|
|
found = true;
|
|
break;
|
|
}
|
|
}
|
|
if (!found)
|
|
{
|
|
ereport(LOG,
|
|
(errmsg("new timeline %u is not a child of database system timeline %u",
|
|
newtarget,
|
|
ThisTimeLineID)));
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* The current timeline was found in the history file, but check that the
|
|
* next timeline was forked off from it *after* the current recovery
|
|
* location.
|
|
*/
|
|
if (XLByteLT(currentTle->end, EndRecPtr))
|
|
{
|
|
ereport(LOG,
|
|
(errmsg("new timeline %u forked off current database system timeline %u before current recovery point %X/%X",
|
|
newtarget,
|
|
ThisTimeLineID,
|
|
(uint32) (EndRecPtr >> 32), (uint32) EndRecPtr)));
|
|
return false;
|
|
}
|
|
|
|
/* The new timeline history seems valid. Switch target */
|
|
recoveryTargetTLI = newtarget;
|
|
list_free_deep(expectedTLEs);
|
|
expectedTLEs = newExpectedTLEs;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->RecoveryTargetTLI = recoveryTargetTLI;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
ereport(LOG,
|
|
(errmsg("new target timeline is %u",
|
|
recoveryTargetTLI)));
|
|
|
|
/*
|
|
* Wake up any walsenders to notice that we have a new target timeline.
|
|
*/
|
|
if (AllowCascadeReplication())
|
|
WalSndWakeup();
|
|
|
|
return true;
|
|
}
|
|
|
|
/*
|
|
* I/O routines for pg_control
|
|
*
|
|
* *ControlFile is a buffer in shared memory that holds an image of the
|
|
* contents of pg_control. WriteControlFile() initializes pg_control
|
|
* given a preloaded buffer, ReadControlFile() loads the buffer from
|
|
* the pg_control file (during postmaster or standalone-backend startup),
|
|
* and UpdateControlFile() rewrites pg_control after we modify xlog state.
|
|
*
|
|
* For simplicity, WriteControlFile() initializes the fields of pg_control
|
|
* that are related to checking backend/database compatibility, and
|
|
* ReadControlFile() verifies they are correct. We could split out the
|
|
* I/O and compatibility-check functions, but there seems no need currently.
|
|
*/
|
|
static void
|
|
WriteControlFile(void)
|
|
{
|
|
int fd;
|
|
char buffer[PG_CONTROL_SIZE]; /* need not be aligned */
|
|
|
|
/*
|
|
* Initialize version and compatibility-check fields
|
|
*/
|
|
ControlFile->pg_control_version = PG_CONTROL_VERSION;
|
|
ControlFile->catalog_version_no = CATALOG_VERSION_NO;
|
|
|
|
ControlFile->maxAlign = MAXIMUM_ALIGNOF;
|
|
ControlFile->floatFormat = FLOATFORMAT_VALUE;
|
|
|
|
ControlFile->blcksz = BLCKSZ;
|
|
ControlFile->relseg_size = RELSEG_SIZE;
|
|
ControlFile->xlog_blcksz = XLOG_BLCKSZ;
|
|
ControlFile->xlog_seg_size = XLOG_SEG_SIZE;
|
|
|
|
ControlFile->nameDataLen = NAMEDATALEN;
|
|
ControlFile->indexMaxKeys = INDEX_MAX_KEYS;
|
|
|
|
ControlFile->toast_max_chunk_size = TOAST_MAX_CHUNK_SIZE;
|
|
|
|
#ifdef HAVE_INT64_TIMESTAMP
|
|
ControlFile->enableIntTimes = true;
|
|
#else
|
|
ControlFile->enableIntTimes = false;
|
|
#endif
|
|
ControlFile->float4ByVal = FLOAT4PASSBYVAL;
|
|
ControlFile->float8ByVal = FLOAT8PASSBYVAL;
|
|
|
|
/* Contents are protected with a CRC */
|
|
INIT_CRC32(ControlFile->crc);
|
|
COMP_CRC32(ControlFile->crc,
|
|
(char *) ControlFile,
|
|
offsetof(ControlFileData, crc));
|
|
FIN_CRC32(ControlFile->crc);
|
|
|
|
/*
|
|
* We write out PG_CONTROL_SIZE bytes into pg_control, zero-padding the
|
|
* excess over sizeof(ControlFileData). This reduces the odds of
|
|
* premature-EOF errors when reading pg_control. We'll still fail when we
|
|
* check the contents of the file, but hopefully with a more specific
|
|
* error than "couldn't read pg_control".
|
|
*/
|
|
if (sizeof(ControlFileData) > PG_CONTROL_SIZE)
|
|
elog(PANIC, "sizeof(ControlFileData) is larger than PG_CONTROL_SIZE; fix either one");
|
|
|
|
memset(buffer, 0, PG_CONTROL_SIZE);
|
|
memcpy(buffer, ControlFile, sizeof(ControlFileData));
|
|
|
|
fd = BasicOpenFile(XLOG_CONTROL_FILE,
|
|
O_RDWR | O_CREAT | O_EXCL | PG_BINARY,
|
|
S_IRUSR | S_IWUSR);
|
|
if (fd < 0)
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not create control file \"%s\": %m",
|
|
XLOG_CONTROL_FILE)));
|
|
|
|
errno = 0;
|
|
if (write(fd, buffer, PG_CONTROL_SIZE) != PG_CONTROL_SIZE)
|
|
{
|
|
/* if write didn't set errno, assume problem is no disk space */
|
|
if (errno == 0)
|
|
errno = ENOSPC;
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not write to control file: %m")));
|
|
}
|
|
|
|
if (pg_fsync(fd) != 0)
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not fsync control file: %m")));
|
|
|
|
if (close(fd))
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not close control file: %m")));
|
|
}
|
|
|
|
static void
|
|
ReadControlFile(void)
|
|
{
|
|
pg_crc32 crc;
|
|
int fd;
|
|
|
|
/*
|
|
* Read data...
|
|
*/
|
|
fd = BasicOpenFile(XLOG_CONTROL_FILE,
|
|
O_RDWR | PG_BINARY,
|
|
S_IRUSR | S_IWUSR);
|
|
if (fd < 0)
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not open control file \"%s\": %m",
|
|
XLOG_CONTROL_FILE)));
|
|
|
|
if (read(fd, ControlFile, sizeof(ControlFileData)) != sizeof(ControlFileData))
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not read from control file: %m")));
|
|
|
|
close(fd);
|
|
|
|
/*
|
|
* Check for expected pg_control format version. If this is wrong, the
|
|
* CRC check will likely fail because we'll be checking the wrong number
|
|
* of bytes. Complaining about wrong version will probably be more
|
|
* enlightening than complaining about wrong CRC.
|
|
*/
|
|
|
|
if (ControlFile->pg_control_version != PG_CONTROL_VERSION && ControlFile->pg_control_version % 65536 == 0 && ControlFile->pg_control_version / 65536 != 0)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with PG_CONTROL_VERSION %d (0x%08x),"
|
|
" but the server was compiled with PG_CONTROL_VERSION %d (0x%08x).",
|
|
ControlFile->pg_control_version, ControlFile->pg_control_version,
|
|
PG_CONTROL_VERSION, PG_CONTROL_VERSION),
|
|
errhint("This could be a problem of mismatched byte ordering. It looks like you need to initdb.")));
|
|
|
|
if (ControlFile->pg_control_version != PG_CONTROL_VERSION)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with PG_CONTROL_VERSION %d,"
|
|
" but the server was compiled with PG_CONTROL_VERSION %d.",
|
|
ControlFile->pg_control_version, PG_CONTROL_VERSION),
|
|
errhint("It looks like you need to initdb.")));
|
|
|
|
/* Now check the CRC. */
|
|
INIT_CRC32(crc);
|
|
COMP_CRC32(crc,
|
|
(char *) ControlFile,
|
|
offsetof(ControlFileData, crc));
|
|
FIN_CRC32(crc);
|
|
|
|
if (!EQ_CRC32(crc, ControlFile->crc))
|
|
ereport(FATAL,
|
|
(errmsg("incorrect checksum in control file")));
|
|
|
|
/*
|
|
* Do compatibility checking immediately. If the database isn't
|
|
* compatible with the backend executable, we want to abort before we can
|
|
* possibly do any damage.
|
|
*/
|
|
if (ControlFile->catalog_version_no != CATALOG_VERSION_NO)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with CATALOG_VERSION_NO %d,"
|
|
" but the server was compiled with CATALOG_VERSION_NO %d.",
|
|
ControlFile->catalog_version_no, CATALOG_VERSION_NO),
|
|
errhint("It looks like you need to initdb.")));
|
|
if (ControlFile->maxAlign != MAXIMUM_ALIGNOF)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with MAXALIGN %d,"
|
|
" but the server was compiled with MAXALIGN %d.",
|
|
ControlFile->maxAlign, MAXIMUM_ALIGNOF),
|
|
errhint("It looks like you need to initdb.")));
|
|
if (ControlFile->floatFormat != FLOATFORMAT_VALUE)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster appears to use a different floating-point number format than the server executable."),
|
|
errhint("It looks like you need to initdb.")));
|
|
if (ControlFile->blcksz != BLCKSZ)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with BLCKSZ %d,"
|
|
" but the server was compiled with BLCKSZ %d.",
|
|
ControlFile->blcksz, BLCKSZ),
|
|
errhint("It looks like you need to recompile or initdb.")));
|
|
if (ControlFile->relseg_size != RELSEG_SIZE)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with RELSEG_SIZE %d,"
|
|
" but the server was compiled with RELSEG_SIZE %d.",
|
|
ControlFile->relseg_size, RELSEG_SIZE),
|
|
errhint("It looks like you need to recompile or initdb.")));
|
|
if (ControlFile->xlog_blcksz != XLOG_BLCKSZ)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with XLOG_BLCKSZ %d,"
|
|
" but the server was compiled with XLOG_BLCKSZ %d.",
|
|
ControlFile->xlog_blcksz, XLOG_BLCKSZ),
|
|
errhint("It looks like you need to recompile or initdb.")));
|
|
if (ControlFile->xlog_seg_size != XLOG_SEG_SIZE)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with XLOG_SEG_SIZE %d,"
|
|
" but the server was compiled with XLOG_SEG_SIZE %d.",
|
|
ControlFile->xlog_seg_size, XLOG_SEG_SIZE),
|
|
errhint("It looks like you need to recompile or initdb.")));
|
|
if (ControlFile->nameDataLen != NAMEDATALEN)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with NAMEDATALEN %d,"
|
|
" but the server was compiled with NAMEDATALEN %d.",
|
|
ControlFile->nameDataLen, NAMEDATALEN),
|
|
errhint("It looks like you need to recompile or initdb.")));
|
|
if (ControlFile->indexMaxKeys != INDEX_MAX_KEYS)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with INDEX_MAX_KEYS %d,"
|
|
" but the server was compiled with INDEX_MAX_KEYS %d.",
|
|
ControlFile->indexMaxKeys, INDEX_MAX_KEYS),
|
|
errhint("It looks like you need to recompile or initdb.")));
|
|
if (ControlFile->toast_max_chunk_size != TOAST_MAX_CHUNK_SIZE)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with TOAST_MAX_CHUNK_SIZE %d,"
|
|
" but the server was compiled with TOAST_MAX_CHUNK_SIZE %d.",
|
|
ControlFile->toast_max_chunk_size, (int) TOAST_MAX_CHUNK_SIZE),
|
|
errhint("It looks like you need to recompile or initdb.")));
|
|
|
|
#ifdef HAVE_INT64_TIMESTAMP
|
|
if (ControlFile->enableIntTimes != true)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized without HAVE_INT64_TIMESTAMP"
|
|
" but the server was compiled with HAVE_INT64_TIMESTAMP."),
|
|
errhint("It looks like you need to recompile or initdb.")));
|
|
#else
|
|
if (ControlFile->enableIntTimes != false)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with HAVE_INT64_TIMESTAMP"
|
|
" but the server was compiled without HAVE_INT64_TIMESTAMP."),
|
|
errhint("It looks like you need to recompile or initdb.")));
|
|
#endif
|
|
|
|
#ifdef USE_FLOAT4_BYVAL
|
|
if (ControlFile->float4ByVal != true)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized without USE_FLOAT4_BYVAL"
|
|
" but the server was compiled with USE_FLOAT4_BYVAL."),
|
|
errhint("It looks like you need to recompile or initdb.")));
|
|
#else
|
|
if (ControlFile->float4ByVal != false)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with USE_FLOAT4_BYVAL"
|
|
" but the server was compiled without USE_FLOAT4_BYVAL."),
|
|
errhint("It looks like you need to recompile or initdb.")));
|
|
#endif
|
|
|
|
#ifdef USE_FLOAT8_BYVAL
|
|
if (ControlFile->float8ByVal != true)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized without USE_FLOAT8_BYVAL"
|
|
" but the server was compiled with USE_FLOAT8_BYVAL."),
|
|
errhint("It looks like you need to recompile or initdb.")));
|
|
#else
|
|
if (ControlFile->float8ByVal != false)
|
|
ereport(FATAL,
|
|
(errmsg("database files are incompatible with server"),
|
|
errdetail("The database cluster was initialized with USE_FLOAT8_BYVAL"
|
|
" but the server was compiled without USE_FLOAT8_BYVAL."),
|
|
errhint("It looks like you need to recompile or initdb.")));
|
|
#endif
|
|
}
|
|
|
|
void
|
|
UpdateControlFile(void)
|
|
{
|
|
int fd;
|
|
|
|
INIT_CRC32(ControlFile->crc);
|
|
COMP_CRC32(ControlFile->crc,
|
|
(char *) ControlFile,
|
|
offsetof(ControlFileData, crc));
|
|
FIN_CRC32(ControlFile->crc);
|
|
|
|
fd = BasicOpenFile(XLOG_CONTROL_FILE,
|
|
O_RDWR | PG_BINARY,
|
|
S_IRUSR | S_IWUSR);
|
|
if (fd < 0)
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not open control file \"%s\": %m",
|
|
XLOG_CONTROL_FILE)));
|
|
|
|
errno = 0;
|
|
if (write(fd, ControlFile, sizeof(ControlFileData)) != sizeof(ControlFileData))
|
|
{
|
|
/* if write didn't set errno, assume problem is no disk space */
|
|
if (errno == 0)
|
|
errno = ENOSPC;
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not write to control file: %m")));
|
|
}
|
|
|
|
if (pg_fsync(fd) != 0)
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not fsync control file: %m")));
|
|
|
|
if (close(fd))
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not close control file: %m")));
|
|
}
|
|
|
|
/*
|
|
* Returns the unique system identifier from control file.
|
|
*/
|
|
uint64
|
|
GetSystemIdentifier(void)
|
|
{
|
|
Assert(ControlFile != NULL);
|
|
return ControlFile->system_identifier;
|
|
}
|
|
|
|
/*
|
|
* Auto-tune the number of XLOG buffers.
|
|
*
|
|
* The preferred setting for wal_buffers is about 3% of shared_buffers, with
|
|
* a maximum of one XLOG segment (there is little reason to think that more
|
|
* is helpful, at least so long as we force an fsync when switching log files)
|
|
* and a minimum of 8 blocks (which was the default value prior to PostgreSQL
|
|
* 9.1, when auto-tuning was added).
|
|
*
|
|
* This should not be called until NBuffers has received its final value.
|
|
*/
|
|
static int
|
|
XLOGChooseNumBuffers(void)
|
|
{
|
|
int xbuffers;
|
|
|
|
xbuffers = NBuffers / 32;
|
|
if (xbuffers > XLOG_SEG_SIZE / XLOG_BLCKSZ)
|
|
xbuffers = XLOG_SEG_SIZE / XLOG_BLCKSZ;
|
|
if (xbuffers < 8)
|
|
xbuffers = 8;
|
|
return xbuffers;
|
|
}
|
|
|
|
/*
|
|
* GUC check_hook for wal_buffers
|
|
*/
|
|
bool
|
|
check_wal_buffers(int *newval, void **extra, GucSource source)
|
|
{
|
|
/*
|
|
* -1 indicates a request for auto-tune.
|
|
*/
|
|
if (*newval == -1)
|
|
{
|
|
/*
|
|
* If we haven't yet changed the boot_val default of -1, just let it
|
|
* be. We'll fix it when XLOGShmemSize is called.
|
|
*/
|
|
if (XLOGbuffers == -1)
|
|
return true;
|
|
|
|
/* Otherwise, substitute the auto-tune value */
|
|
*newval = XLOGChooseNumBuffers();
|
|
}
|
|
|
|
/*
|
|
* We clamp manually-set values to at least 4 blocks. Prior to PostgreSQL
|
|
* 9.1, a minimum of 4 was enforced by guc.c, but since that is no longer
|
|
* the case, we just silently treat such values as a request for the
|
|
* minimum. (We could throw an error instead, but that doesn't seem very
|
|
* helpful.)
|
|
*/
|
|
if (*newval < 4)
|
|
*newval = 4;
|
|
|
|
return true;
|
|
}
|
|
|
|
/*
|
|
* Initialization of shared memory for XLOG
|
|
*/
|
|
Size
|
|
XLOGShmemSize(void)
|
|
{
|
|
Size size;
|
|
|
|
/*
|
|
* If the value of wal_buffers is -1, use the preferred auto-tune value.
|
|
* This isn't an amazingly clean place to do this, but we must wait till
|
|
* NBuffers has received its final value, and must do it before using the
|
|
* value of XLOGbuffers to do anything important.
|
|
*/
|
|
if (XLOGbuffers == -1)
|
|
{
|
|
char buf[32];
|
|
|
|
snprintf(buf, sizeof(buf), "%d", XLOGChooseNumBuffers());
|
|
SetConfigOption("wal_buffers", buf, PGC_POSTMASTER, PGC_S_OVERRIDE);
|
|
}
|
|
Assert(XLOGbuffers > 0);
|
|
|
|
/* XLogCtl */
|
|
size = sizeof(XLogCtlData);
|
|
/* xlblocks array */
|
|
size = add_size(size, mul_size(sizeof(XLogRecPtr), XLOGbuffers));
|
|
/* extra alignment padding for XLOG I/O buffers */
|
|
size = add_size(size, ALIGNOF_XLOG_BUFFER);
|
|
/* and the buffers themselves */
|
|
size = add_size(size, mul_size(XLOG_BLCKSZ, XLOGbuffers));
|
|
|
|
/*
|
|
* Note: we don't count ControlFileData, it comes out of the "slop factor"
|
|
* added by CreateSharedMemoryAndSemaphores. This lets us use this
|
|
* routine again below to compute the actual allocation size.
|
|
*/
|
|
|
|
return size;
|
|
}
|
|
|
|
void
|
|
XLOGShmemInit(void)
|
|
{
|
|
bool foundCFile,
|
|
foundXLog;
|
|
char *allocptr;
|
|
|
|
ControlFile = (ControlFileData *)
|
|
ShmemInitStruct("Control File", sizeof(ControlFileData), &foundCFile);
|
|
XLogCtl = (XLogCtlData *)
|
|
ShmemInitStruct("XLOG Ctl", XLOGShmemSize(), &foundXLog);
|
|
|
|
if (foundCFile || foundXLog)
|
|
{
|
|
/* both should be present or neither */
|
|
Assert(foundCFile && foundXLog);
|
|
return;
|
|
}
|
|
|
|
memset(XLogCtl, 0, sizeof(XLogCtlData));
|
|
|
|
/*
|
|
* Since XLogCtlData contains XLogRecPtr fields, its sizeof should be a
|
|
* multiple of the alignment for same, so no extra alignment padding is
|
|
* needed here.
|
|
*/
|
|
allocptr = ((char *) XLogCtl) + sizeof(XLogCtlData);
|
|
XLogCtl->xlblocks = (XLogRecPtr *) allocptr;
|
|
memset(XLogCtl->xlblocks, 0, sizeof(XLogRecPtr) * XLOGbuffers);
|
|
allocptr += sizeof(XLogRecPtr) * XLOGbuffers;
|
|
|
|
/*
|
|
* Align the start of the page buffers to an ALIGNOF_XLOG_BUFFER boundary.
|
|
*/
|
|
allocptr = (char *) TYPEALIGN(ALIGNOF_XLOG_BUFFER, allocptr);
|
|
XLogCtl->pages = allocptr;
|
|
memset(XLogCtl->pages, 0, (Size) XLOG_BLCKSZ * XLOGbuffers);
|
|
|
|
/*
|
|
* Do basic initialization of XLogCtl shared data. (StartupXLOG will fill
|
|
* in additional info.)
|
|
*/
|
|
XLogCtl->XLogCacheBlck = XLOGbuffers - 1;
|
|
XLogCtl->SharedRecoveryInProgress = true;
|
|
XLogCtl->SharedHotStandbyActive = false;
|
|
XLogCtl->WalWriterSleeping = false;
|
|
XLogCtl->Insert.currpage = (XLogPageHeader) (XLogCtl->pages);
|
|
SpinLockInit(&XLogCtl->info_lck);
|
|
InitSharedLatch(&XLogCtl->recoveryWakeupLatch);
|
|
|
|
/*
|
|
* If we are not in bootstrap mode, pg_control should already exist. Read
|
|
* and validate it immediately (see comments in ReadControlFile() for the
|
|
* reasons why).
|
|
*/
|
|
if (!IsBootstrapProcessingMode())
|
|
ReadControlFile();
|
|
}
|
|
|
|
/*
|
|
* This func must be called ONCE on system install. It creates pg_control
|
|
* and the initial XLOG segment.
|
|
*/
|
|
void
|
|
BootStrapXLOG(void)
|
|
{
|
|
CheckPoint checkPoint;
|
|
char *buffer;
|
|
XLogPageHeader page;
|
|
XLogLongPageHeader longpage;
|
|
XLogRecord *record;
|
|
bool use_existent;
|
|
uint64 sysidentifier;
|
|
struct timeval tv;
|
|
pg_crc32 crc;
|
|
|
|
/*
|
|
* Select a hopefully-unique system identifier code for this installation.
|
|
* We use the result of gettimeofday(), including the fractional seconds
|
|
* field, as being about as unique as we can easily get. (Think not to
|
|
* use random(), since it hasn't been seeded and there's no portable way
|
|
* to seed it other than the system clock value...) The upper half of the
|
|
* uint64 value is just the tv_sec part, while the lower half is the XOR
|
|
* of tv_sec and tv_usec. This is to ensure that we don't lose uniqueness
|
|
* unnecessarily if "uint64" is really only 32 bits wide. A person
|
|
* knowing this encoding can determine the initialization time of the
|
|
* installation, which could perhaps be useful sometimes.
|
|
*/
|
|
gettimeofday(&tv, NULL);
|
|
sysidentifier = ((uint64) tv.tv_sec) << 32;
|
|
sysidentifier |= (uint32) (tv.tv_sec | tv.tv_usec);
|
|
|
|
/* First timeline ID is always 1 */
|
|
ThisTimeLineID = 1;
|
|
|
|
/* page buffer must be aligned suitably for O_DIRECT */
|
|
buffer = (char *) palloc(XLOG_BLCKSZ + ALIGNOF_XLOG_BUFFER);
|
|
page = (XLogPageHeader) TYPEALIGN(ALIGNOF_XLOG_BUFFER, buffer);
|
|
memset(page, 0, XLOG_BLCKSZ);
|
|
|
|
/*
|
|
* Set up information for the initial checkpoint record
|
|
*
|
|
* The initial checkpoint record is written to the beginning of the WAL
|
|
* segment with logid=0 logseg=1. The very first WAL segment, 0/0, is not
|
|
* used, so that we can use 0/0 to mean "before any valid WAL segment".
|
|
*/
|
|
checkPoint.redo = XLogSegSize + SizeOfXLogLongPHD;
|
|
checkPoint.ThisTimeLineID = ThisTimeLineID;
|
|
checkPoint.fullPageWrites = fullPageWrites;
|
|
checkPoint.nextXidEpoch = 0;
|
|
checkPoint.nextXid = FirstNormalTransactionId;
|
|
checkPoint.nextOid = FirstBootstrapObjectId;
|
|
checkPoint.nextMulti = FirstMultiXactId;
|
|
checkPoint.nextMultiOffset = 0;
|
|
checkPoint.oldestXid = FirstNormalTransactionId;
|
|
checkPoint.oldestXidDB = TemplateDbOid;
|
|
checkPoint.time = (pg_time_t) time(NULL);
|
|
checkPoint.oldestActiveXid = InvalidTransactionId;
|
|
|
|
ShmemVariableCache->nextXid = checkPoint.nextXid;
|
|
ShmemVariableCache->nextOid = checkPoint.nextOid;
|
|
ShmemVariableCache->oidCount = 0;
|
|
MultiXactSetNextMXact(checkPoint.nextMulti, checkPoint.nextMultiOffset);
|
|
SetTransactionIdLimit(checkPoint.oldestXid, checkPoint.oldestXidDB);
|
|
|
|
/* Set up the XLOG page header */
|
|
page->xlp_magic = XLOG_PAGE_MAGIC;
|
|
page->xlp_info = XLP_LONG_HEADER;
|
|
page->xlp_tli = ThisTimeLineID;
|
|
page->xlp_pageaddr = XLogSegSize;
|
|
longpage = (XLogLongPageHeader) page;
|
|
longpage->xlp_sysid = sysidentifier;
|
|
longpage->xlp_seg_size = XLogSegSize;
|
|
longpage->xlp_xlog_blcksz = XLOG_BLCKSZ;
|
|
|
|
/* Insert the initial checkpoint record */
|
|
record = (XLogRecord *) ((char *) page + SizeOfXLogLongPHD);
|
|
record->xl_prev = 0;
|
|
record->xl_xid = InvalidTransactionId;
|
|
record->xl_tot_len = SizeOfXLogRecord + sizeof(checkPoint);
|
|
record->xl_len = sizeof(checkPoint);
|
|
record->xl_info = XLOG_CHECKPOINT_SHUTDOWN;
|
|
record->xl_rmid = RM_XLOG_ID;
|
|
memcpy(XLogRecGetData(record), &checkPoint, sizeof(checkPoint));
|
|
|
|
INIT_CRC32(crc);
|
|
COMP_CRC32(crc, &checkPoint, sizeof(checkPoint));
|
|
COMP_CRC32(crc, (char *) record, offsetof(XLogRecord, xl_crc));
|
|
FIN_CRC32(crc);
|
|
record->xl_crc = crc;
|
|
|
|
/* Create first XLOG segment file */
|
|
use_existent = false;
|
|
openLogFile = XLogFileInit(1, &use_existent, false);
|
|
|
|
/* Write the first page with the initial record */
|
|
errno = 0;
|
|
if (write(openLogFile, page, XLOG_BLCKSZ) != XLOG_BLCKSZ)
|
|
{
|
|
/* if write didn't set errno, assume problem is no disk space */
|
|
if (errno == 0)
|
|
errno = ENOSPC;
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not write bootstrap transaction log file: %m")));
|
|
}
|
|
|
|
if (pg_fsync(openLogFile) != 0)
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not fsync bootstrap transaction log file: %m")));
|
|
|
|
if (close(openLogFile))
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not close bootstrap transaction log file: %m")));
|
|
|
|
openLogFile = -1;
|
|
|
|
/* Now create pg_control */
|
|
|
|
memset(ControlFile, 0, sizeof(ControlFileData));
|
|
/* Initialize pg_control status fields */
|
|
ControlFile->system_identifier = sysidentifier;
|
|
ControlFile->state = DB_SHUTDOWNED;
|
|
ControlFile->time = checkPoint.time;
|
|
ControlFile->checkPoint = checkPoint.redo;
|
|
ControlFile->checkPointCopy = checkPoint;
|
|
|
|
/* Set important parameter values for use when replaying WAL */
|
|
ControlFile->MaxConnections = MaxConnections;
|
|
ControlFile->max_prepared_xacts = max_prepared_xacts;
|
|
ControlFile->max_locks_per_xact = max_locks_per_xact;
|
|
ControlFile->wal_level = wal_level;
|
|
|
|
/* some additional ControlFile fields are set in WriteControlFile() */
|
|
|
|
WriteControlFile();
|
|
|
|
/* Bootstrap the commit log, too */
|
|
BootStrapCLOG();
|
|
BootStrapSUBTRANS();
|
|
BootStrapMultiXact();
|
|
|
|
pfree(buffer);
|
|
}
|
|
|
|
static char *
|
|
str_time(pg_time_t tnow)
|
|
{
|
|
static char buf[128];
|
|
|
|
pg_strftime(buf, sizeof(buf),
|
|
"%Y-%m-%d %H:%M:%S %Z",
|
|
pg_localtime(&tnow, log_timezone));
|
|
|
|
return buf;
|
|
}
|
|
|
|
/*
|
|
* See if there is a recovery command file (recovery.conf), and if so
|
|
* read in parameters for archive recovery and XLOG streaming.
|
|
*
|
|
* The file is parsed using the main configuration parser.
|
|
*/
|
|
static void
|
|
readRecoveryCommandFile(void)
|
|
{
|
|
FILE *fd;
|
|
TimeLineID rtli = 0;
|
|
bool rtliGiven = false;
|
|
ConfigVariable *item,
|
|
*head = NULL,
|
|
*tail = NULL;
|
|
|
|
fd = AllocateFile(RECOVERY_COMMAND_FILE, "r");
|
|
if (fd == NULL)
|
|
{
|
|
if (errno == ENOENT)
|
|
return; /* not there, so no archive recovery */
|
|
ereport(FATAL,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not open recovery command file \"%s\": %m",
|
|
RECOVERY_COMMAND_FILE)));
|
|
}
|
|
|
|
/*
|
|
* Since we're asking ParseConfigFp() to report errors as FATAL, there's
|
|
* no need to check the return value.
|
|
*/
|
|
(void) ParseConfigFp(fd, RECOVERY_COMMAND_FILE, 0, FATAL, &head, &tail);
|
|
|
|
FreeFile(fd);
|
|
|
|
for (item = head; item; item = item->next)
|
|
{
|
|
if (strcmp(item->name, "restore_command") == 0)
|
|
{
|
|
recoveryRestoreCommand = pstrdup(item->value);
|
|
ereport(DEBUG2,
|
|
(errmsg_internal("restore_command = '%s'",
|
|
recoveryRestoreCommand)));
|
|
}
|
|
else if (strcmp(item->name, "recovery_end_command") == 0)
|
|
{
|
|
recoveryEndCommand = pstrdup(item->value);
|
|
ereport(DEBUG2,
|
|
(errmsg_internal("recovery_end_command = '%s'",
|
|
recoveryEndCommand)));
|
|
}
|
|
else if (strcmp(item->name, "archive_cleanup_command") == 0)
|
|
{
|
|
archiveCleanupCommand = pstrdup(item->value);
|
|
ereport(DEBUG2,
|
|
(errmsg_internal("archive_cleanup_command = '%s'",
|
|
archiveCleanupCommand)));
|
|
}
|
|
else if (strcmp(item->name, "pause_at_recovery_target") == 0)
|
|
{
|
|
if (!parse_bool(item->value, &recoveryPauseAtTarget))
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
|
|
errmsg("parameter \"%s\" requires a Boolean value", "pause_at_recovery_target")));
|
|
ereport(DEBUG2,
|
|
(errmsg_internal("pause_at_recovery_target = '%s'",
|
|
item->value)));
|
|
}
|
|
else if (strcmp(item->name, "recovery_target_timeline") == 0)
|
|
{
|
|
rtliGiven = true;
|
|
if (strcmp(item->value, "latest") == 0)
|
|
rtli = 0;
|
|
else
|
|
{
|
|
errno = 0;
|
|
rtli = (TimeLineID) strtoul(item->value, NULL, 0);
|
|
if (errno == EINVAL || errno == ERANGE)
|
|
ereport(FATAL,
|
|
(errmsg("recovery_target_timeline is not a valid number: \"%s\"",
|
|
item->value)));
|
|
}
|
|
if (rtli)
|
|
ereport(DEBUG2,
|
|
(errmsg_internal("recovery_target_timeline = %u", rtli)));
|
|
else
|
|
ereport(DEBUG2,
|
|
(errmsg_internal("recovery_target_timeline = latest")));
|
|
}
|
|
else if (strcmp(item->name, "recovery_target_xid") == 0)
|
|
{
|
|
errno = 0;
|
|
recoveryTargetXid = (TransactionId) strtoul(item->value, NULL, 0);
|
|
if (errno == EINVAL || errno == ERANGE)
|
|
ereport(FATAL,
|
|
(errmsg("recovery_target_xid is not a valid number: \"%s\"",
|
|
item->value)));
|
|
ereport(DEBUG2,
|
|
(errmsg_internal("recovery_target_xid = %u",
|
|
recoveryTargetXid)));
|
|
recoveryTarget = RECOVERY_TARGET_XID;
|
|
}
|
|
else if (strcmp(item->name, "recovery_target_time") == 0)
|
|
{
|
|
/*
|
|
* if recovery_target_xid or recovery_target_name specified, then
|
|
* this overrides recovery_target_time
|
|
*/
|
|
if (recoveryTarget == RECOVERY_TARGET_XID ||
|
|
recoveryTarget == RECOVERY_TARGET_NAME)
|
|
continue;
|
|
recoveryTarget = RECOVERY_TARGET_TIME;
|
|
|
|
/*
|
|
* Convert the time string given by the user to TimestampTz form.
|
|
*/
|
|
recoveryTargetTime =
|
|
DatumGetTimestampTz(DirectFunctionCall3(timestamptz_in,
|
|
CStringGetDatum(item->value),
|
|
ObjectIdGetDatum(InvalidOid),
|
|
Int32GetDatum(-1)));
|
|
ereport(DEBUG2,
|
|
(errmsg_internal("recovery_target_time = '%s'",
|
|
timestamptz_to_str(recoveryTargetTime))));
|
|
}
|
|
else if (strcmp(item->name, "recovery_target_name") == 0)
|
|
{
|
|
/*
|
|
* if recovery_target_xid specified, then this overrides
|
|
* recovery_target_name
|
|
*/
|
|
if (recoveryTarget == RECOVERY_TARGET_XID)
|
|
continue;
|
|
recoveryTarget = RECOVERY_TARGET_NAME;
|
|
|
|
recoveryTargetName = pstrdup(item->value);
|
|
if (strlen(recoveryTargetName) >= MAXFNAMELEN)
|
|
ereport(FATAL,
|
|
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
|
|
errmsg("recovery_target_name is too long (maximum %d characters)",
|
|
MAXFNAMELEN - 1)));
|
|
|
|
ereport(DEBUG2,
|
|
(errmsg_internal("recovery_target_name = '%s'",
|
|
recoveryTargetName)));
|
|
}
|
|
else if (strcmp(item->name, "recovery_target_inclusive") == 0)
|
|
{
|
|
/*
|
|
* does nothing if a recovery_target is not also set
|
|
*/
|
|
if (!parse_bool(item->value, &recoveryTargetInclusive))
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
|
|
errmsg("parameter \"%s\" requires a Boolean value",
|
|
"recovery_target_inclusive")));
|
|
ereport(DEBUG2,
|
|
(errmsg_internal("recovery_target_inclusive = %s",
|
|
item->value)));
|
|
}
|
|
else if (strcmp(item->name, "standby_mode") == 0)
|
|
{
|
|
if (!parse_bool(item->value, &StandbyMode))
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
|
|
errmsg("parameter \"%s\" requires a Boolean value",
|
|
"standby_mode")));
|
|
ereport(DEBUG2,
|
|
(errmsg_internal("standby_mode = '%s'", item->value)));
|
|
}
|
|
else if (strcmp(item->name, "primary_conninfo") == 0)
|
|
{
|
|
PrimaryConnInfo = pstrdup(item->value);
|
|
ereport(DEBUG2,
|
|
(errmsg_internal("primary_conninfo = '%s'",
|
|
PrimaryConnInfo)));
|
|
}
|
|
else if (strcmp(item->name, "trigger_file") == 0)
|
|
{
|
|
TriggerFile = pstrdup(item->value);
|
|
ereport(DEBUG2,
|
|
(errmsg_internal("trigger_file = '%s'",
|
|
TriggerFile)));
|
|
}
|
|
else
|
|
ereport(FATAL,
|
|
(errmsg("unrecognized recovery parameter \"%s\"",
|
|
item->name)));
|
|
}
|
|
|
|
/*
|
|
* Check for compulsory parameters
|
|
*/
|
|
if (StandbyMode)
|
|
{
|
|
if (PrimaryConnInfo == NULL && recoveryRestoreCommand == NULL)
|
|
ereport(WARNING,
|
|
(errmsg("recovery command file \"%s\" specified neither primary_conninfo nor restore_command",
|
|
RECOVERY_COMMAND_FILE),
|
|
errhint("The database server will regularly poll the pg_xlog subdirectory to check for files placed there.")));
|
|
}
|
|
else
|
|
{
|
|
if (recoveryRestoreCommand == NULL)
|
|
ereport(FATAL,
|
|
(errmsg("recovery command file \"%s\" must specify restore_command when standby mode is not enabled",
|
|
RECOVERY_COMMAND_FILE)));
|
|
}
|
|
|
|
/* Enable fetching from archive recovery area */
|
|
InArchiveRecovery = true;
|
|
|
|
/*
|
|
* If user specified recovery_target_timeline, validate it or compute the
|
|
* "latest" value. We can't do this until after we've gotten the restore
|
|
* command and set InArchiveRecovery, because we need to fetch timeline
|
|
* history files from the archive.
|
|
*/
|
|
if (rtliGiven)
|
|
{
|
|
if (rtli)
|
|
{
|
|
/* Timeline 1 does not have a history file, all else should */
|
|
if (rtli != 1 && !existsTimeLineHistory(rtli))
|
|
ereport(FATAL,
|
|
(errmsg("recovery target timeline %u does not exist",
|
|
rtli)));
|
|
recoveryTargetTLI = rtli;
|
|
recoveryTargetIsLatest = false;
|
|
}
|
|
else
|
|
{
|
|
/* We start the "latest" search from pg_control's timeline */
|
|
recoveryTargetTLI = findNewestTimeLine(recoveryTargetTLI);
|
|
recoveryTargetIsLatest = true;
|
|
}
|
|
}
|
|
|
|
FreeConfigVariables(head);
|
|
}
|
|
|
|
/*
|
|
* Exit archive-recovery state
|
|
*/
|
|
static void
|
|
exitArchiveRecovery(TimeLineID endTLI, XLogSegNo endLogSegNo)
|
|
{
|
|
char recoveryPath[MAXPGPATH];
|
|
char xlogpath[MAXPGPATH];
|
|
|
|
/*
|
|
* We are no longer in archive recovery state.
|
|
*/
|
|
InArchiveRecovery = false;
|
|
|
|
/*
|
|
* Update min recovery point one last time.
|
|
*/
|
|
UpdateMinRecoveryPoint(InvalidXLogRecPtr, true);
|
|
|
|
/*
|
|
* If the ending log segment is still open, close it (to avoid problems on
|
|
* Windows with trying to rename or delete an open file).
|
|
*/
|
|
if (readFile >= 0)
|
|
{
|
|
close(readFile);
|
|
readFile = -1;
|
|
}
|
|
|
|
/*
|
|
* If we are establishing a new timeline, we have to copy data from the
|
|
* last WAL segment of the old timeline to create a starting WAL segment
|
|
* for the new timeline.
|
|
*
|
|
* Notify the archiver that the last WAL segment of the old timeline is
|
|
* ready to copy to archival storage. Otherwise, it is not archived for a
|
|
* while.
|
|
*/
|
|
if (endTLI != ThisTimeLineID)
|
|
{
|
|
XLogFileCopy(endLogSegNo, endTLI, endLogSegNo);
|
|
|
|
if (XLogArchivingActive())
|
|
{
|
|
XLogFileName(xlogpath, endTLI, endLogSegNo);
|
|
XLogArchiveNotify(xlogpath);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Let's just make real sure there are not .ready or .done flags posted
|
|
* for the new segment.
|
|
*/
|
|
XLogFileName(xlogpath, ThisTimeLineID, endLogSegNo);
|
|
XLogArchiveCleanup(xlogpath);
|
|
|
|
/*
|
|
* Since there might be a partial WAL segment named RECOVERYXLOG, get rid
|
|
* of it.
|
|
*/
|
|
snprintf(recoveryPath, MAXPGPATH, XLOGDIR "/RECOVERYXLOG");
|
|
unlink(recoveryPath); /* ignore any error */
|
|
|
|
/* Get rid of any remaining recovered timeline-history file, too */
|
|
snprintf(recoveryPath, MAXPGPATH, XLOGDIR "/RECOVERYHISTORY");
|
|
unlink(recoveryPath); /* ignore any error */
|
|
|
|
/*
|
|
* Rename the config file out of the way, so that we don't accidentally
|
|
* re-enter archive recovery mode in a subsequent crash.
|
|
*/
|
|
unlink(RECOVERY_COMMAND_DONE);
|
|
if (rename(RECOVERY_COMMAND_FILE, RECOVERY_COMMAND_DONE) != 0)
|
|
ereport(FATAL,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not rename file \"%s\" to \"%s\": %m",
|
|
RECOVERY_COMMAND_FILE, RECOVERY_COMMAND_DONE)));
|
|
|
|
ereport(LOG,
|
|
(errmsg("archive recovery complete")));
|
|
}
|
|
|
|
/*
|
|
* For point-in-time recovery, this function decides whether we want to
|
|
* stop applying the XLOG at or after the current record.
|
|
*
|
|
* Returns TRUE if we are stopping, FALSE otherwise. On TRUE return,
|
|
* *includeThis is set TRUE if we should apply this record before stopping.
|
|
*
|
|
* We also track the timestamp of the latest applied COMMIT/ABORT
|
|
* record in XLogCtl->recoveryLastXTime, for logging purposes.
|
|
* Also, some information is saved in recoveryStopXid et al for use in
|
|
* annotating the new timeline's history file.
|
|
*/
|
|
static bool
|
|
recoveryStopsHere(XLogRecord *record, bool *includeThis)
|
|
{
|
|
bool stopsHere;
|
|
uint8 record_info;
|
|
TimestampTz recordXtime;
|
|
char recordRPName[MAXFNAMELEN];
|
|
|
|
/* We only consider stopping at COMMIT, ABORT or RESTORE POINT records */
|
|
if (record->xl_rmid != RM_XACT_ID && record->xl_rmid != RM_XLOG_ID)
|
|
return false;
|
|
record_info = record->xl_info & ~XLR_INFO_MASK;
|
|
if (record->xl_rmid == RM_XACT_ID && record_info == XLOG_XACT_COMMIT_COMPACT)
|
|
{
|
|
xl_xact_commit_compact *recordXactCommitData;
|
|
|
|
recordXactCommitData = (xl_xact_commit_compact *) XLogRecGetData(record);
|
|
recordXtime = recordXactCommitData->xact_time;
|
|
}
|
|
else if (record->xl_rmid == RM_XACT_ID && record_info == XLOG_XACT_COMMIT)
|
|
{
|
|
xl_xact_commit *recordXactCommitData;
|
|
|
|
recordXactCommitData = (xl_xact_commit *) XLogRecGetData(record);
|
|
recordXtime = recordXactCommitData->xact_time;
|
|
}
|
|
else if (record->xl_rmid == RM_XACT_ID && record_info == XLOG_XACT_ABORT)
|
|
{
|
|
xl_xact_abort *recordXactAbortData;
|
|
|
|
recordXactAbortData = (xl_xact_abort *) XLogRecGetData(record);
|
|
recordXtime = recordXactAbortData->xact_time;
|
|
}
|
|
else if (record->xl_rmid == RM_XLOG_ID && record_info == XLOG_RESTORE_POINT)
|
|
{
|
|
xl_restore_point *recordRestorePointData;
|
|
|
|
recordRestorePointData = (xl_restore_point *) XLogRecGetData(record);
|
|
recordXtime = recordRestorePointData->rp_time;
|
|
strncpy(recordRPName, recordRestorePointData->rp_name, MAXFNAMELEN);
|
|
}
|
|
else
|
|
return false;
|
|
|
|
/* Do we have a PITR target at all? */
|
|
if (recoveryTarget == RECOVERY_TARGET_UNSET)
|
|
{
|
|
/*
|
|
* Save timestamp of latest transaction commit/abort if this is a
|
|
* transaction record
|
|
*/
|
|
if (record->xl_rmid == RM_XACT_ID)
|
|
SetLatestXTime(recordXtime);
|
|
return false;
|
|
}
|
|
|
|
if (recoveryTarget == RECOVERY_TARGET_XID)
|
|
{
|
|
/*
|
|
* There can be only one transaction end record with this exact
|
|
* transactionid
|
|
*
|
|
* when testing for an xid, we MUST test for equality only, since
|
|
* transactions are numbered in the order they start, not the order
|
|
* they complete. A higher numbered xid will complete before you about
|
|
* 50% of the time...
|
|
*/
|
|
stopsHere = (record->xl_xid == recoveryTargetXid);
|
|
if (stopsHere)
|
|
*includeThis = recoveryTargetInclusive;
|
|
}
|
|
else if (recoveryTarget == RECOVERY_TARGET_NAME)
|
|
{
|
|
/*
|
|
* There can be many restore points that share the same name, so we
|
|
* stop at the first one
|
|
*/
|
|
stopsHere = (strcmp(recordRPName, recoveryTargetName) == 0);
|
|
|
|
/*
|
|
* Ignore recoveryTargetInclusive because this is not a transaction
|
|
* record
|
|
*/
|
|
*includeThis = false;
|
|
}
|
|
else
|
|
{
|
|
/*
|
|
* There can be many transactions that share the same commit time, so
|
|
* we stop after the last one, if we are inclusive, or stop at the
|
|
* first one if we are exclusive
|
|
*/
|
|
if (recoveryTargetInclusive)
|
|
stopsHere = (recordXtime > recoveryTargetTime);
|
|
else
|
|
stopsHere = (recordXtime >= recoveryTargetTime);
|
|
if (stopsHere)
|
|
*includeThis = false;
|
|
}
|
|
|
|
if (stopsHere)
|
|
{
|
|
recoveryStopXid = record->xl_xid;
|
|
recoveryStopTime = recordXtime;
|
|
recoveryStopAfter = *includeThis;
|
|
|
|
if (record_info == XLOG_XACT_COMMIT_COMPACT || record_info == XLOG_XACT_COMMIT)
|
|
{
|
|
if (recoveryStopAfter)
|
|
ereport(LOG,
|
|
(errmsg("recovery stopping after commit of transaction %u, time %s",
|
|
recoveryStopXid,
|
|
timestamptz_to_str(recoveryStopTime))));
|
|
else
|
|
ereport(LOG,
|
|
(errmsg("recovery stopping before commit of transaction %u, time %s",
|
|
recoveryStopXid,
|
|
timestamptz_to_str(recoveryStopTime))));
|
|
}
|
|
else if (record_info == XLOG_XACT_ABORT)
|
|
{
|
|
if (recoveryStopAfter)
|
|
ereport(LOG,
|
|
(errmsg("recovery stopping after abort of transaction %u, time %s",
|
|
recoveryStopXid,
|
|
timestamptz_to_str(recoveryStopTime))));
|
|
else
|
|
ereport(LOG,
|
|
(errmsg("recovery stopping before abort of transaction %u, time %s",
|
|
recoveryStopXid,
|
|
timestamptz_to_str(recoveryStopTime))));
|
|
}
|
|
else
|
|
{
|
|
strncpy(recoveryStopName, recordRPName, MAXFNAMELEN);
|
|
|
|
ereport(LOG,
|
|
(errmsg("recovery stopping at restore point \"%s\", time %s",
|
|
recoveryStopName,
|
|
timestamptz_to_str(recoveryStopTime))));
|
|
}
|
|
|
|
/*
|
|
* Note that if we use a RECOVERY_TARGET_TIME then we can stop at a
|
|
* restore point since they are timestamped, though the latest
|
|
* transaction time is not updated.
|
|
*/
|
|
if (record->xl_rmid == RM_XACT_ID && recoveryStopAfter)
|
|
SetLatestXTime(recordXtime);
|
|
}
|
|
else if (record->xl_rmid == RM_XACT_ID)
|
|
SetLatestXTime(recordXtime);
|
|
|
|
return stopsHere;
|
|
}
|
|
|
|
/*
|
|
* Wait until shared recoveryPause flag is cleared.
|
|
*
|
|
* XXX Could also be done with shared latch, avoiding the pg_usleep loop.
|
|
* Probably not worth the trouble though. This state shouldn't be one that
|
|
* anyone cares about server power consumption in.
|
|
*/
|
|
static void
|
|
recoveryPausesHere(void)
|
|
{
|
|
/* Don't pause unless users can connect! */
|
|
if (!LocalHotStandbyActive)
|
|
return;
|
|
|
|
ereport(LOG,
|
|
(errmsg("recovery has paused"),
|
|
errhint("Execute pg_xlog_replay_resume() to continue.")));
|
|
|
|
while (RecoveryIsPaused())
|
|
{
|
|
pg_usleep(1000000L); /* 1000 ms */
|
|
HandleStartupProcInterrupts();
|
|
}
|
|
}
|
|
|
|
bool
|
|
RecoveryIsPaused(void)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
bool recoveryPause;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
recoveryPause = xlogctl->recoveryPause;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
return recoveryPause;
|
|
}
|
|
|
|
void
|
|
SetRecoveryPause(bool recoveryPause)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->recoveryPause = recoveryPause;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/*
|
|
* Save timestamp of latest processed commit/abort record.
|
|
*
|
|
* We keep this in XLogCtl, not a simple static variable, so that it can be
|
|
* seen by processes other than the startup process. Note in particular
|
|
* that CreateRestartPoint is executed in the checkpointer.
|
|
*/
|
|
static void
|
|
SetLatestXTime(TimestampTz xtime)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->recoveryLastXTime = xtime;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/*
|
|
* Fetch timestamp of latest processed commit/abort record.
|
|
*/
|
|
TimestampTz
|
|
GetLatestXTime(void)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
TimestampTz xtime;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xtime = xlogctl->recoveryLastXTime;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
return xtime;
|
|
}
|
|
|
|
/*
|
|
* Save timestamp of the next chunk of WAL records to apply.
|
|
*
|
|
* We keep this in XLogCtl, not a simple static variable, so that it can be
|
|
* seen by all backends.
|
|
*/
|
|
static void
|
|
SetCurrentChunkStartTime(TimestampTz xtime)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->currentChunkStartTime = xtime;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/*
|
|
* Fetch timestamp of latest processed commit/abort record.
|
|
* Startup process maintains an accurate local copy in XLogReceiptTime
|
|
*/
|
|
TimestampTz
|
|
GetCurrentChunkReplayStartTime(void)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
TimestampTz xtime;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xtime = xlogctl->currentChunkStartTime;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
return xtime;
|
|
}
|
|
|
|
/*
|
|
* Returns time of receipt of current chunk of XLOG data, as well as
|
|
* whether it was received from streaming replication or from archives.
|
|
*/
|
|
void
|
|
GetXLogReceiptTime(TimestampTz *rtime, bool *fromStream)
|
|
{
|
|
/*
|
|
* This must be executed in the startup process, since we don't export the
|
|
* relevant state to shared memory.
|
|
*/
|
|
Assert(InRecovery);
|
|
|
|
*rtime = XLogReceiptTime;
|
|
*fromStream = (XLogReceiptSource == XLOG_FROM_STREAM);
|
|
}
|
|
|
|
/*
|
|
* Note that text field supplied is a parameter name and does not require
|
|
* translation
|
|
*/
|
|
#define RecoveryRequiresIntParameter(param_name, currValue, minValue) \
|
|
do { \
|
|
if ((currValue) < (minValue)) \
|
|
ereport(ERROR, \
|
|
(errcode(ERRCODE_INVALID_PARAMETER_VALUE), \
|
|
errmsg("hot standby is not possible because " \
|
|
"%s = %d is a lower setting than on the master server " \
|
|
"(its value was %d)", \
|
|
param_name, \
|
|
currValue, \
|
|
minValue))); \
|
|
} while(0)
|
|
|
|
/*
|
|
* Check to see if required parameters are set high enough on this server
|
|
* for various aspects of recovery operation.
|
|
*/
|
|
static void
|
|
CheckRequiredParameterValues(void)
|
|
{
|
|
/*
|
|
* For archive recovery, the WAL must be generated with at least 'archive'
|
|
* wal_level.
|
|
*/
|
|
if (InArchiveRecovery && ControlFile->wal_level == WAL_LEVEL_MINIMAL)
|
|
{
|
|
ereport(WARNING,
|
|
(errmsg("WAL was generated with wal_level=minimal, data may be missing"),
|
|
errhint("This happens if you temporarily set wal_level=minimal without taking a new base backup.")));
|
|
}
|
|
|
|
/*
|
|
* For Hot Standby, the WAL must be generated with 'hot_standby' mode, and
|
|
* we must have at least as many backend slots as the primary.
|
|
*/
|
|
if (InArchiveRecovery && EnableHotStandby)
|
|
{
|
|
if (ControlFile->wal_level < WAL_LEVEL_HOT_STANDBY)
|
|
ereport(ERROR,
|
|
(errmsg("hot standby is not possible because wal_level was not set to \"hot_standby\" on the master server"),
|
|
errhint("Either set wal_level to \"hot_standby\" on the master, or turn off hot_standby here.")));
|
|
|
|
/* We ignore autovacuum_max_workers when we make this test. */
|
|
RecoveryRequiresIntParameter("max_connections",
|
|
MaxConnections,
|
|
ControlFile->MaxConnections);
|
|
RecoveryRequiresIntParameter("max_prepared_transactions",
|
|
max_prepared_xacts,
|
|
ControlFile->max_prepared_xacts);
|
|
RecoveryRequiresIntParameter("max_locks_per_transaction",
|
|
max_locks_per_xact,
|
|
ControlFile->max_locks_per_xact);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* This must be called ONCE during postmaster or standalone-backend startup
|
|
*/
|
|
void
|
|
StartupXLOG(void)
|
|
{
|
|
XLogCtlInsert *Insert;
|
|
CheckPoint checkPoint;
|
|
bool wasShutdown;
|
|
bool reachedStopPoint = false;
|
|
bool haveBackupLabel = false;
|
|
XLogRecPtr RecPtr,
|
|
checkPointLoc,
|
|
EndOfLog;
|
|
XLogSegNo endLogSegNo;
|
|
XLogRecord *record;
|
|
uint32 freespace;
|
|
TransactionId oldestActiveXID;
|
|
bool backupEndRequired = false;
|
|
bool backupFromStandby = false;
|
|
DBState dbstate_at_startup;
|
|
|
|
/*
|
|
* Read control file and check XLOG status looks valid.
|
|
*
|
|
* Note: in most control paths, *ControlFile is already valid and we need
|
|
* not do ReadControlFile() here, but might as well do it to be sure.
|
|
*/
|
|
ReadControlFile();
|
|
|
|
if (ControlFile->state < DB_SHUTDOWNED ||
|
|
ControlFile->state > DB_IN_PRODUCTION ||
|
|
!XRecOffIsValid(ControlFile->checkPoint))
|
|
ereport(FATAL,
|
|
(errmsg("control file contains invalid data")));
|
|
|
|
if (ControlFile->state == DB_SHUTDOWNED)
|
|
ereport(LOG,
|
|
(errmsg("database system was shut down at %s",
|
|
str_time(ControlFile->time))));
|
|
else if (ControlFile->state == DB_SHUTDOWNED_IN_RECOVERY)
|
|
ereport(LOG,
|
|
(errmsg("database system was shut down in recovery at %s",
|
|
str_time(ControlFile->time))));
|
|
else if (ControlFile->state == DB_SHUTDOWNING)
|
|
ereport(LOG,
|
|
(errmsg("database system shutdown was interrupted; last known up at %s",
|
|
str_time(ControlFile->time))));
|
|
else if (ControlFile->state == DB_IN_CRASH_RECOVERY)
|
|
ereport(LOG,
|
|
(errmsg("database system was interrupted while in recovery at %s",
|
|
str_time(ControlFile->time)),
|
|
errhint("This probably means that some data is corrupted and"
|
|
" you will have to use the last backup for recovery.")));
|
|
else if (ControlFile->state == DB_IN_ARCHIVE_RECOVERY)
|
|
ereport(LOG,
|
|
(errmsg("database system was interrupted while in recovery at log time %s",
|
|
str_time(ControlFile->checkPointCopy.time)),
|
|
errhint("If this has occurred more than once some data might be corrupted"
|
|
" and you might need to choose an earlier recovery target.")));
|
|
else if (ControlFile->state == DB_IN_PRODUCTION)
|
|
ereport(LOG,
|
|
(errmsg("database system was interrupted; last known up at %s",
|
|
str_time(ControlFile->time))));
|
|
|
|
/* This is just to allow attaching to startup process with a debugger */
|
|
#ifdef XLOG_REPLAY_DELAY
|
|
if (ControlFile->state != DB_SHUTDOWNED)
|
|
pg_usleep(60000000L);
|
|
#endif
|
|
|
|
/*
|
|
* Verify that pg_xlog and pg_xlog/archive_status exist. In cases where
|
|
* someone has performed a copy for PITR, these directories may have been
|
|
* excluded and need to be re-created.
|
|
*/
|
|
ValidateXLOGDirectoryStructure();
|
|
|
|
/*
|
|
* Clear out any old relcache cache files. This is *necessary* if we do
|
|
* any WAL replay, since that would probably result in the cache files
|
|
* being out of sync with database reality. In theory we could leave them
|
|
* in place if the database had been cleanly shut down, but it seems
|
|
* safest to just remove them always and let them be rebuilt during the
|
|
* first backend startup.
|
|
*/
|
|
RelationCacheInitFileRemove();
|
|
|
|
/*
|
|
* Initialize on the assumption we want to recover to the same timeline
|
|
* that's active according to pg_control.
|
|
*/
|
|
recoveryTargetTLI = ControlFile->checkPointCopy.ThisTimeLineID;
|
|
|
|
/*
|
|
* Check for recovery control file, and if so set up state for offline
|
|
* recovery
|
|
*/
|
|
readRecoveryCommandFile();
|
|
|
|
/* Now we can determine the list of expected TLIs */
|
|
expectedTLEs = readTimeLineHistory(recoveryTargetTLI);
|
|
|
|
/*
|
|
* If the location of the checkpoint record is not on the expected
|
|
* timeline in the history of the requested timeline, we cannot proceed:
|
|
* the backup is not part of the history of the requested timeline.
|
|
*/
|
|
if (tliOfPointInHistory(ControlFile->checkPoint, expectedTLEs) !=
|
|
ControlFile->checkPointCopy.ThisTimeLineID)
|
|
{
|
|
XLogRecPtr switchpoint;
|
|
|
|
/*
|
|
* tliSwitchPoint will throw an error if the checkpoint's timeline
|
|
* is not in expectedTLEs at all.
|
|
*/
|
|
switchpoint = tliSwitchPoint(ControlFile->checkPointCopy.ThisTimeLineID, expectedTLEs);
|
|
ereport(FATAL,
|
|
(errmsg("requested timeline %u is not a child of this server's history",
|
|
recoveryTargetTLI),
|
|
errdetail("Latest checkpoint is at %X/%X on timeline %u, but in the history of the requested timeline, the server forked off from that timeline at %X/%X",
|
|
(uint32) (ControlFile->checkPoint >> 32),
|
|
(uint32) ControlFile->checkPoint,
|
|
ControlFile->checkPointCopy.ThisTimeLineID,
|
|
(uint32) (switchpoint >> 32),
|
|
(uint32) switchpoint)));
|
|
}
|
|
|
|
/*
|
|
* The min recovery point should be part of the requested timeline's
|
|
* history, too.
|
|
*/
|
|
if (!XLogRecPtrIsInvalid(ControlFile->minRecoveryPoint) &&
|
|
tliOfPointInHistory(ControlFile->minRecoveryPoint - 1, expectedTLEs) !=
|
|
ControlFile->minRecoveryPointTLI)
|
|
ereport(FATAL,
|
|
(errmsg("requested timeline %u does not contain minimum recovery point %X/%X on timeline %u",
|
|
recoveryTargetTLI,
|
|
(uint32) (ControlFile->minRecoveryPoint >> 32),
|
|
(uint32) ControlFile->minRecoveryPoint,
|
|
ControlFile->minRecoveryPointTLI)));
|
|
|
|
/*
|
|
* Save the selected recovery target timeline ID and
|
|
* archive_cleanup_command in shared memory so that other processes can
|
|
* see them
|
|
*/
|
|
XLogCtl->RecoveryTargetTLI = recoveryTargetTLI;
|
|
strncpy(XLogCtl->archiveCleanupCommand,
|
|
archiveCleanupCommand ? archiveCleanupCommand : "",
|
|
sizeof(XLogCtl->archiveCleanupCommand));
|
|
|
|
if (InArchiveRecovery)
|
|
{
|
|
if (StandbyMode)
|
|
ereport(LOG,
|
|
(errmsg("entering standby mode")));
|
|
else if (recoveryTarget == RECOVERY_TARGET_XID)
|
|
ereport(LOG,
|
|
(errmsg("starting point-in-time recovery to XID %u",
|
|
recoveryTargetXid)));
|
|
else if (recoveryTarget == RECOVERY_TARGET_TIME)
|
|
ereport(LOG,
|
|
(errmsg("starting point-in-time recovery to %s",
|
|
timestamptz_to_str(recoveryTargetTime))));
|
|
else if (recoveryTarget == RECOVERY_TARGET_NAME)
|
|
ereport(LOG,
|
|
(errmsg("starting point-in-time recovery to \"%s\"",
|
|
recoveryTargetName)));
|
|
else
|
|
ereport(LOG,
|
|
(errmsg("starting archive recovery")));
|
|
}
|
|
|
|
/*
|
|
* Take ownership of the wakeup latch if we're going to sleep during
|
|
* recovery.
|
|
*/
|
|
if (StandbyMode)
|
|
OwnLatch(&XLogCtl->recoveryWakeupLatch);
|
|
|
|
if (read_backup_label(&checkPointLoc, &backupEndRequired,
|
|
&backupFromStandby))
|
|
{
|
|
/*
|
|
* When a backup_label file is present, we want to roll forward from
|
|
* the checkpoint it identifies, rather than using pg_control.
|
|
*/
|
|
record = ReadCheckpointRecord(checkPointLoc, 0);
|
|
if (record != NULL)
|
|
{
|
|
memcpy(&checkPoint, XLogRecGetData(record), sizeof(CheckPoint));
|
|
wasShutdown = (record->xl_info == XLOG_CHECKPOINT_SHUTDOWN);
|
|
ereport(DEBUG1,
|
|
(errmsg("checkpoint record is at %X/%X",
|
|
(uint32) (checkPointLoc >> 32), (uint32) checkPointLoc)));
|
|
InRecovery = true; /* force recovery even if SHUTDOWNED */
|
|
|
|
/*
|
|
* Make sure that REDO location exists. This may not be the case
|
|
* if there was a crash during an online backup, which left a
|
|
* backup_label around that references a WAL segment that's
|
|
* already been archived.
|
|
*/
|
|
if (XLByteLT(checkPoint.redo, checkPointLoc))
|
|
{
|
|
if (!ReadRecord(&(checkPoint.redo), LOG, false))
|
|
ereport(FATAL,
|
|
(errmsg("could not find redo location referenced by checkpoint record"),
|
|
errhint("If you are not restoring from a backup, try removing the file \"%s/backup_label\".", DataDir)));
|
|
}
|
|
}
|
|
else
|
|
{
|
|
ereport(FATAL,
|
|
(errmsg("could not locate required checkpoint record"),
|
|
errhint("If you are not restoring from a backup, try removing the file \"%s/backup_label\".", DataDir)));
|
|
wasShutdown = false; /* keep compiler quiet */
|
|
}
|
|
/* set flag to delete it later */
|
|
haveBackupLabel = true;
|
|
}
|
|
else
|
|
{
|
|
/*
|
|
* Get the last valid checkpoint record. If the latest one according
|
|
* to pg_control is broken, try the next-to-last one.
|
|
*/
|
|
checkPointLoc = ControlFile->checkPoint;
|
|
RedoStartLSN = ControlFile->checkPointCopy.redo;
|
|
record = ReadCheckpointRecord(checkPointLoc, 1);
|
|
if (record != NULL)
|
|
{
|
|
ereport(DEBUG1,
|
|
(errmsg("checkpoint record is at %X/%X",
|
|
(uint32) (checkPointLoc >> 32), (uint32) checkPointLoc)));
|
|
}
|
|
else if (StandbyMode)
|
|
{
|
|
/*
|
|
* The last valid checkpoint record required for a streaming
|
|
* recovery exists in neither standby nor the primary.
|
|
*/
|
|
ereport(PANIC,
|
|
(errmsg("could not locate a valid checkpoint record")));
|
|
}
|
|
else
|
|
{
|
|
checkPointLoc = ControlFile->prevCheckPoint;
|
|
record = ReadCheckpointRecord(checkPointLoc, 2);
|
|
if (record != NULL)
|
|
{
|
|
ereport(LOG,
|
|
(errmsg("using previous checkpoint record at %X/%X",
|
|
(uint32) (checkPointLoc >> 32), (uint32) checkPointLoc)));
|
|
InRecovery = true; /* force recovery even if SHUTDOWNED */
|
|
}
|
|
else
|
|
ereport(PANIC,
|
|
(errmsg("could not locate a valid checkpoint record")));
|
|
}
|
|
memcpy(&checkPoint, XLogRecGetData(record), sizeof(CheckPoint));
|
|
wasShutdown = (record->xl_info == XLOG_CHECKPOINT_SHUTDOWN);
|
|
}
|
|
|
|
LastRec = RecPtr = checkPointLoc;
|
|
|
|
ereport(DEBUG1,
|
|
(errmsg("redo record is at %X/%X; shutdown %s",
|
|
(uint32) (checkPoint.redo >> 32), (uint32) checkPoint.redo,
|
|
wasShutdown ? "TRUE" : "FALSE")));
|
|
ereport(DEBUG1,
|
|
(errmsg("next transaction ID: %u/%u; next OID: %u",
|
|
checkPoint.nextXidEpoch, checkPoint.nextXid,
|
|
checkPoint.nextOid)));
|
|
ereport(DEBUG1,
|
|
(errmsg("next MultiXactId: %u; next MultiXactOffset: %u",
|
|
checkPoint.nextMulti, checkPoint.nextMultiOffset)));
|
|
ereport(DEBUG1,
|
|
(errmsg("oldest unfrozen transaction ID: %u, in database %u",
|
|
checkPoint.oldestXid, checkPoint.oldestXidDB)));
|
|
if (!TransactionIdIsNormal(checkPoint.nextXid))
|
|
ereport(PANIC,
|
|
(errmsg("invalid next transaction ID")));
|
|
|
|
/* initialize shared memory variables from the checkpoint record */
|
|
ShmemVariableCache->nextXid = checkPoint.nextXid;
|
|
ShmemVariableCache->nextOid = checkPoint.nextOid;
|
|
ShmemVariableCache->oidCount = 0;
|
|
MultiXactSetNextMXact(checkPoint.nextMulti, checkPoint.nextMultiOffset);
|
|
SetTransactionIdLimit(checkPoint.oldestXid, checkPoint.oldestXidDB);
|
|
XLogCtl->ckptXidEpoch = checkPoint.nextXidEpoch;
|
|
XLogCtl->ckptXid = checkPoint.nextXid;
|
|
|
|
/*
|
|
* We must replay WAL entries using the same TimeLineID they were created
|
|
* under, so temporarily adopt the TLI indicated by the checkpoint (see
|
|
* also xlog_redo()).
|
|
*/
|
|
ThisTimeLineID = checkPoint.ThisTimeLineID;
|
|
|
|
lastFullPageWrites = checkPoint.fullPageWrites;
|
|
|
|
RedoRecPtr = XLogCtl->Insert.RedoRecPtr = checkPoint.redo;
|
|
|
|
if (XLByteLT(RecPtr, checkPoint.redo))
|
|
ereport(PANIC,
|
|
(errmsg("invalid redo in checkpoint record")));
|
|
|
|
/*
|
|
* Check whether we need to force recovery from WAL. If it appears to
|
|
* have been a clean shutdown and we did not have a recovery.conf file,
|
|
* then assume no recovery needed.
|
|
*/
|
|
if (XLByteLT(checkPoint.redo, RecPtr))
|
|
{
|
|
if (wasShutdown)
|
|
ereport(PANIC,
|
|
(errmsg("invalid redo record in shutdown checkpoint")));
|
|
InRecovery = true;
|
|
}
|
|
else if (ControlFile->state != DB_SHUTDOWNED)
|
|
InRecovery = true;
|
|
else if (InArchiveRecovery)
|
|
{
|
|
/* force recovery due to presence of recovery.conf */
|
|
InRecovery = true;
|
|
}
|
|
|
|
/* REDO */
|
|
if (InRecovery)
|
|
{
|
|
int rmid;
|
|
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
/*
|
|
* Update pg_control to show that we are recovering and to show the
|
|
* selected checkpoint as the place we are starting from. We also mark
|
|
* pg_control with any minimum recovery stop point obtained from a
|
|
* backup history file.
|
|
*/
|
|
dbstate_at_startup = ControlFile->state;
|
|
if (InArchiveRecovery)
|
|
ControlFile->state = DB_IN_ARCHIVE_RECOVERY;
|
|
else
|
|
{
|
|
ereport(LOG,
|
|
(errmsg("database system was not properly shut down; "
|
|
"automatic recovery in progress")));
|
|
ControlFile->state = DB_IN_CRASH_RECOVERY;
|
|
}
|
|
ControlFile->prevCheckPoint = ControlFile->checkPoint;
|
|
ControlFile->checkPoint = checkPointLoc;
|
|
ControlFile->checkPointCopy = checkPoint;
|
|
if (InArchiveRecovery)
|
|
{
|
|
/* initialize minRecoveryPoint if not set yet */
|
|
if (XLByteLT(ControlFile->minRecoveryPoint, checkPoint.redo))
|
|
{
|
|
ControlFile->minRecoveryPoint = checkPoint.redo;
|
|
ControlFile->minRecoveryPointTLI = checkPoint.ThisTimeLineID;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Set backupStartPoint if we're starting recovery from a base backup.
|
|
*
|
|
* Set backupEndPoint and use minRecoveryPoint as the backup end
|
|
* location if we're starting recovery from a base backup which was
|
|
* taken from the standby. In this case, the database system status in
|
|
* pg_control must indicate DB_IN_ARCHIVE_RECOVERY. If not, which
|
|
* means that backup is corrupted, so we cancel recovery.
|
|
*/
|
|
if (haveBackupLabel)
|
|
{
|
|
ControlFile->backupStartPoint = checkPoint.redo;
|
|
ControlFile->backupEndRequired = backupEndRequired;
|
|
|
|
if (backupFromStandby)
|
|
{
|
|
if (dbstate_at_startup != DB_IN_ARCHIVE_RECOVERY)
|
|
ereport(FATAL,
|
|
(errmsg("backup_label contains data inconsistent with control file"),
|
|
errhint("This means that the backup is corrupted and you will "
|
|
"have to use another backup for recovery.")));
|
|
ControlFile->backupEndPoint = ControlFile->minRecoveryPoint;
|
|
}
|
|
}
|
|
ControlFile->time = (pg_time_t) time(NULL);
|
|
/* No need to hold ControlFileLock yet, we aren't up far enough */
|
|
UpdateControlFile();
|
|
|
|
/* initialize our local copy of minRecoveryPoint */
|
|
minRecoveryPoint = ControlFile->minRecoveryPoint;
|
|
minRecoveryPointTLI = ControlFile->minRecoveryPointTLI;
|
|
|
|
/*
|
|
* Reset pgstat data, because it may be invalid after recovery.
|
|
*/
|
|
pgstat_reset_all();
|
|
|
|
/*
|
|
* If there was a backup label file, it's done its job and the info
|
|
* has now been propagated into pg_control. We must get rid of the
|
|
* label file so that if we crash during recovery, we'll pick up at
|
|
* the latest recovery restartpoint instead of going all the way back
|
|
* to the backup start point. It seems prudent though to just rename
|
|
* the file out of the way rather than delete it completely.
|
|
*/
|
|
if (haveBackupLabel)
|
|
{
|
|
unlink(BACKUP_LABEL_OLD);
|
|
if (rename(BACKUP_LABEL_FILE, BACKUP_LABEL_OLD) != 0)
|
|
ereport(FATAL,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not rename file \"%s\" to \"%s\": %m",
|
|
BACKUP_LABEL_FILE, BACKUP_LABEL_OLD)));
|
|
}
|
|
|
|
/* Check that the GUCs used to generate the WAL allow recovery */
|
|
CheckRequiredParameterValues();
|
|
|
|
/*
|
|
* We're in recovery, so unlogged relations may be trashed and must be
|
|
* reset. This should be done BEFORE allowing Hot Standby
|
|
* connections, so that read-only backends don't try to read whatever
|
|
* garbage is left over from before.
|
|
*/
|
|
ResetUnloggedRelations(UNLOGGED_RELATION_CLEANUP);
|
|
|
|
/*
|
|
* Likewise, delete any saved transaction snapshot files that got left
|
|
* behind by crashed backends.
|
|
*/
|
|
DeleteAllExportedSnapshotFiles();
|
|
|
|
/*
|
|
* Initialize for Hot Standby, if enabled. We won't let backends in
|
|
* yet, not until we've reached the min recovery point specified in
|
|
* control file and we've established a recovery snapshot from a
|
|
* running-xacts WAL record.
|
|
*/
|
|
if (InArchiveRecovery && EnableHotStandby)
|
|
{
|
|
TransactionId *xids;
|
|
int nxids;
|
|
|
|
ereport(DEBUG1,
|
|
(errmsg("initializing for hot standby")));
|
|
|
|
InitRecoveryTransactionEnvironment();
|
|
|
|
if (wasShutdown)
|
|
oldestActiveXID = PrescanPreparedTransactions(&xids, &nxids);
|
|
else
|
|
oldestActiveXID = checkPoint.oldestActiveXid;
|
|
Assert(TransactionIdIsValid(oldestActiveXID));
|
|
|
|
/*
|
|
* Startup commit log and subtrans only. Other SLRUs are not
|
|
* maintained during recovery and need not be started yet.
|
|
*/
|
|
StartupCLOG();
|
|
StartupSUBTRANS(oldestActiveXID);
|
|
|
|
/*
|
|
* If we're beginning at a shutdown checkpoint, we know that
|
|
* nothing was running on the master at this point. So fake-up an
|
|
* empty running-xacts record and use that here and now. Recover
|
|
* additional standby state for prepared transactions.
|
|
*/
|
|
if (wasShutdown)
|
|
{
|
|
RunningTransactionsData running;
|
|
TransactionId latestCompletedXid;
|
|
|
|
/*
|
|
* Construct a RunningTransactions snapshot representing a
|
|
* shut down server, with only prepared transactions still
|
|
* alive. We're never overflowed at this point because all
|
|
* subxids are listed with their parent prepared transactions.
|
|
*/
|
|
running.xcnt = nxids;
|
|
running.subxcnt = 0;
|
|
running.subxid_overflow = false;
|
|
running.nextXid = checkPoint.nextXid;
|
|
running.oldestRunningXid = oldestActiveXID;
|
|
latestCompletedXid = checkPoint.nextXid;
|
|
TransactionIdRetreat(latestCompletedXid);
|
|
Assert(TransactionIdIsNormal(latestCompletedXid));
|
|
running.latestCompletedXid = latestCompletedXid;
|
|
running.xids = xids;
|
|
|
|
ProcArrayApplyRecoveryInfo(&running);
|
|
|
|
StandbyRecoverPreparedTransactions(false);
|
|
}
|
|
}
|
|
|
|
/* Initialize resource managers */
|
|
for (rmid = 0; rmid <= RM_MAX_ID; rmid++)
|
|
{
|
|
if (RmgrTable[rmid].rm_startup != NULL)
|
|
RmgrTable[rmid].rm_startup();
|
|
}
|
|
|
|
/*
|
|
* Initialize shared replayEndRecPtr, lastReplayedEndRecPtr, and
|
|
* recoveryLastXTime.
|
|
*
|
|
* This is slightly confusing if we're starting from an online
|
|
* checkpoint; we've just read and replayed the chekpoint record, but
|
|
* we're going to start replay from its redo pointer, which precedes
|
|
* the location of the checkpoint record itself. So even though the
|
|
* last record we've replayed is indeed ReadRecPtr, we haven't
|
|
* replayed all the preceding records yet. That's OK for the current
|
|
* use of these variables.
|
|
*/
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->replayEndRecPtr = ReadRecPtr;
|
|
xlogctl->replayEndTLI = ThisTimeLineID;
|
|
xlogctl->lastReplayedEndRecPtr = EndRecPtr;
|
|
xlogctl->recoveryLastXTime = 0;
|
|
xlogctl->currentChunkStartTime = 0;
|
|
xlogctl->recoveryPause = false;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
/* Also ensure XLogReceiptTime has a sane value */
|
|
XLogReceiptTime = GetCurrentTimestamp();
|
|
|
|
/*
|
|
* Let postmaster know we've started redo now, so that it can launch
|
|
* checkpointer to perform restartpoints. We don't bother during
|
|
* crash recovery as restartpoints can only be performed during
|
|
* archive recovery. And we'd like to keep crash recovery simple, to
|
|
* avoid introducing bugs that could affect you when recovering after
|
|
* crash.
|
|
*
|
|
* After this point, we can no longer assume that we're the only
|
|
* process in addition to postmaster! Also, fsync requests are
|
|
* subsequently to be handled by the checkpointer, not locally.
|
|
*/
|
|
if (InArchiveRecovery && IsUnderPostmaster)
|
|
{
|
|
PublishStartupProcessInformation();
|
|
SetForwardFsyncRequests();
|
|
SendPostmasterSignal(PMSIGNAL_RECOVERY_STARTED);
|
|
bgwriterLaunched = true;
|
|
}
|
|
|
|
/*
|
|
* Allow read-only connections immediately if we're consistent
|
|
* already.
|
|
*/
|
|
CheckRecoveryConsistency();
|
|
|
|
/*
|
|
* Find the first record that logically follows the checkpoint --- it
|
|
* might physically precede it, though.
|
|
*/
|
|
if (XLByteLT(checkPoint.redo, RecPtr))
|
|
{
|
|
/* back up to find the record */
|
|
record = ReadRecord(&(checkPoint.redo), PANIC, false);
|
|
}
|
|
else
|
|
{
|
|
/* just have to read next record after CheckPoint */
|
|
record = ReadRecord(NULL, LOG, false);
|
|
}
|
|
|
|
if (record != NULL)
|
|
{
|
|
bool recoveryContinue = true;
|
|
bool recoveryApply = true;
|
|
ErrorContextCallback errcallback;
|
|
TimestampTz xtime;
|
|
|
|
InRedo = true;
|
|
|
|
ereport(LOG,
|
|
(errmsg("redo starts at %X/%X",
|
|
(uint32) (ReadRecPtr >> 32), (uint32) ReadRecPtr)));
|
|
|
|
/*
|
|
* main redo apply loop
|
|
*/
|
|
do
|
|
{
|
|
#ifdef WAL_DEBUG
|
|
if (XLOG_DEBUG ||
|
|
(rmid == RM_XACT_ID && trace_recovery_messages <= DEBUG2) ||
|
|
(rmid != RM_XACT_ID && trace_recovery_messages <= DEBUG3))
|
|
{
|
|
StringInfoData buf;
|
|
|
|
initStringInfo(&buf);
|
|
appendStringInfo(&buf, "REDO @ %X/%X; LSN %X/%X: ",
|
|
(uint32) (ReadRecPtr >> 32), (uint32) ReadRecPtr,
|
|
(uint32) (EndRecPtr >> 32), (uint32) EndRecPtr);
|
|
xlog_outrec(&buf, record);
|
|
appendStringInfo(&buf, " - ");
|
|
RmgrTable[record->xl_rmid].rm_desc(&buf,
|
|
record->xl_info,
|
|
XLogRecGetData(record));
|
|
elog(LOG, "%s", buf.data);
|
|
pfree(buf.data);
|
|
}
|
|
#endif
|
|
|
|
/* Handle interrupt signals of startup process */
|
|
HandleStartupProcInterrupts();
|
|
|
|
/*
|
|
* Pause WAL replay, if requested by a hot-standby session via
|
|
* SetRecoveryPause().
|
|
*
|
|
* Note that we intentionally don't take the info_lck spinlock
|
|
* here. We might therefore read a slightly stale value of
|
|
* the recoveryPause flag, but it can't be very stale (no
|
|
* worse than the last spinlock we did acquire). Since a
|
|
* pause request is a pretty asynchronous thing anyway,
|
|
* possibly responding to it one WAL record later than we
|
|
* otherwise would is a minor issue, so it doesn't seem worth
|
|
* adding another spinlock cycle to prevent that.
|
|
*/
|
|
if (xlogctl->recoveryPause)
|
|
recoveryPausesHere();
|
|
|
|
/*
|
|
* Have we reached our recovery target?
|
|
*/
|
|
if (recoveryStopsHere(record, &recoveryApply))
|
|
{
|
|
if (recoveryPauseAtTarget)
|
|
{
|
|
SetRecoveryPause(true);
|
|
recoveryPausesHere();
|
|
}
|
|
reachedStopPoint = true; /* see below */
|
|
recoveryContinue = false;
|
|
|
|
/* Exit loop if we reached non-inclusive recovery target */
|
|
if (!recoveryApply)
|
|
break;
|
|
}
|
|
|
|
/* Setup error traceback support for ereport() */
|
|
errcallback.callback = rm_redo_error_callback;
|
|
errcallback.arg = (void *) record;
|
|
errcallback.previous = error_context_stack;
|
|
error_context_stack = &errcallback;
|
|
|
|
/*
|
|
* ShmemVariableCache->nextXid must be beyond record's xid.
|
|
*
|
|
* We don't expect anyone else to modify nextXid, hence we
|
|
* don't need to hold a lock while examining it. We still
|
|
* acquire the lock to modify it, though.
|
|
*/
|
|
if (TransactionIdFollowsOrEquals(record->xl_xid,
|
|
ShmemVariableCache->nextXid))
|
|
{
|
|
LWLockAcquire(XidGenLock, LW_EXCLUSIVE);
|
|
ShmemVariableCache->nextXid = record->xl_xid;
|
|
TransactionIdAdvance(ShmemVariableCache->nextXid);
|
|
LWLockRelease(XidGenLock);
|
|
}
|
|
|
|
/*
|
|
* Before replaying this record, check if it is a shutdown
|
|
* checkpoint record that causes the current timeline to
|
|
* change. The checkpoint record is already considered to be
|
|
* part of the new timeline, so we update ThisTimeLineID
|
|
* before replaying it. That's important so that replayEndTLI,
|
|
* which is recorded as the minimum recovery point's TLI if
|
|
* recovery stops after this record, is set correctly.
|
|
*/
|
|
if (record->xl_rmid == RM_XLOG_ID &&
|
|
(record->xl_info & ~XLR_INFO_MASK) == XLOG_CHECKPOINT_SHUTDOWN)
|
|
{
|
|
CheckPoint checkPoint;
|
|
TimeLineID newTLI;
|
|
|
|
memcpy(&checkPoint, XLogRecGetData(record), sizeof(CheckPoint));
|
|
newTLI = checkPoint.ThisTimeLineID;
|
|
|
|
if (newTLI != ThisTimeLineID)
|
|
{
|
|
/* Check that it's OK to switch to this TLI */
|
|
checkTimeLineSwitch(EndRecPtr, newTLI);
|
|
|
|
/* Following WAL records should be run with new TLI */
|
|
ThisTimeLineID = newTLI;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Update shared replayEndRecPtr before replaying this record,
|
|
* so that XLogFlush will update minRecoveryPoint correctly.
|
|
*/
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->replayEndRecPtr = EndRecPtr;
|
|
xlogctl->replayEndTLI = ThisTimeLineID;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
/*
|
|
* If we are attempting to enter Hot Standby mode, process
|
|
* XIDs we see
|
|
*/
|
|
if (standbyState >= STANDBY_INITIALIZED &&
|
|
TransactionIdIsValid(record->xl_xid))
|
|
RecordKnownAssignedTransactionIds(record->xl_xid);
|
|
|
|
/* Now apply the WAL record itself */
|
|
RmgrTable[record->xl_rmid].rm_redo(EndRecPtr, record);
|
|
|
|
/* Pop the error context stack */
|
|
error_context_stack = errcallback.previous;
|
|
|
|
/*
|
|
* Update lastReplayedEndRecPtr after this record has been
|
|
* successfully replayed.
|
|
*/
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->lastReplayedEndRecPtr = EndRecPtr;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
/* Remember this record as the last-applied one */
|
|
LastRec = ReadRecPtr;
|
|
|
|
/* Allow read-only connections if we're consistent now */
|
|
CheckRecoveryConsistency();
|
|
|
|
/* Exit loop if we reached inclusive recovery target */
|
|
if (!recoveryContinue)
|
|
break;
|
|
|
|
/* Else, try to fetch the next WAL record */
|
|
record = ReadRecord(NULL, LOG, false);
|
|
} while (record != NULL);
|
|
|
|
/*
|
|
* end of main redo apply loop
|
|
*/
|
|
|
|
ereport(LOG,
|
|
(errmsg("redo done at %X/%X",
|
|
(uint32) (ReadRecPtr >> 32), (uint32) ReadRecPtr)));
|
|
xtime = GetLatestXTime();
|
|
if (xtime)
|
|
ereport(LOG,
|
|
(errmsg("last completed transaction was at log time %s",
|
|
timestamptz_to_str(xtime))));
|
|
InRedo = false;
|
|
}
|
|
else
|
|
{
|
|
/* there are no WAL records following the checkpoint */
|
|
ereport(LOG,
|
|
(errmsg("redo is not required")));
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Kill WAL receiver, if it's still running, before we continue to write
|
|
* the startup checkpoint record. It will trump over the checkpoint and
|
|
* subsequent records if it's still alive when we start writing WAL.
|
|
*/
|
|
ShutdownWalRcv();
|
|
|
|
/*
|
|
* We don't need the latch anymore. It's not strictly necessary to disown
|
|
* it, but let's do it for the sake of tidiness.
|
|
*/
|
|
if (StandbyMode)
|
|
DisownLatch(&XLogCtl->recoveryWakeupLatch);
|
|
|
|
/*
|
|
* We are now done reading the xlog from stream. Turn off streaming
|
|
* recovery to force fetching the files (which would be required at end of
|
|
* recovery, e.g., timeline history file) from archive or pg_xlog.
|
|
*/
|
|
StandbyMode = false;
|
|
|
|
/*
|
|
* Re-fetch the last valid or last applied record, so we can identify the
|
|
* exact endpoint of what we consider the valid portion of WAL.
|
|
*/
|
|
record = ReadRecord(&LastRec, PANIC, false);
|
|
EndOfLog = EndRecPtr;
|
|
XLByteToPrevSeg(EndOfLog, endLogSegNo);
|
|
|
|
/*
|
|
* Complain if we did not roll forward far enough to render the backup
|
|
* dump consistent. Note: it is indeed okay to look at the local variable
|
|
* minRecoveryPoint here, even though ControlFile->minRecoveryPoint might
|
|
* be further ahead --- ControlFile->minRecoveryPoint cannot have been
|
|
* advanced beyond the WAL we processed.
|
|
*/
|
|
if (InRecovery &&
|
|
(XLByteLT(EndOfLog, minRecoveryPoint) ||
|
|
!XLogRecPtrIsInvalid(ControlFile->backupStartPoint)))
|
|
{
|
|
if (reachedStopPoint)
|
|
{
|
|
/* stopped because of stop request */
|
|
ereport(FATAL,
|
|
(errmsg("requested recovery stop point is before consistent recovery point")));
|
|
}
|
|
|
|
/*
|
|
* Ran off end of WAL before reaching end-of-backup WAL record, or
|
|
* minRecoveryPoint. That's usually a bad sign, indicating that you
|
|
* tried to recover from an online backup but never called
|
|
* pg_stop_backup(), or you didn't archive all the WAL up to that
|
|
* point. However, this also happens in crash recovery, if the system
|
|
* crashes while an online backup is in progress. We must not treat
|
|
* that as an error, or the database will refuse to start up.
|
|
*/
|
|
if (InArchiveRecovery || ControlFile->backupEndRequired)
|
|
{
|
|
if (ControlFile->backupEndRequired)
|
|
ereport(FATAL,
|
|
(errmsg("WAL ends before end of online backup"),
|
|
errhint("All WAL generated while online backup was taken must be available at recovery.")));
|
|
else if (!XLogRecPtrIsInvalid(ControlFile->backupStartPoint))
|
|
ereport(FATAL,
|
|
(errmsg("WAL ends before end of online backup"),
|
|
errhint("Online backup started with pg_start_backup() must be ended with pg_stop_backup(), and all WAL up to that point must be available at recovery.")));
|
|
else
|
|
ereport(FATAL,
|
|
(errmsg("WAL ends before consistent recovery point")));
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Consider whether we need to assign a new timeline ID.
|
|
*
|
|
* If we are doing an archive recovery, we always assign a new ID. This
|
|
* handles a couple of issues. If we stopped short of the end of WAL
|
|
* during recovery, then we are clearly generating a new timeline and must
|
|
* assign it a unique new ID. Even if we ran to the end, modifying the
|
|
* current last segment is problematic because it may result in trying to
|
|
* overwrite an already-archived copy of that segment, and we encourage
|
|
* DBAs to make their archive_commands reject that. We can dodge the
|
|
* problem by making the new active segment have a new timeline ID.
|
|
*
|
|
* In a normal crash recovery, we can just extend the timeline we were in.
|
|
*/
|
|
if (InArchiveRecovery)
|
|
{
|
|
char reason[200];
|
|
|
|
ThisTimeLineID = findNewestTimeLine(recoveryTargetTLI) + 1;
|
|
ereport(LOG,
|
|
(errmsg("selected new timeline ID: %u", ThisTimeLineID)));
|
|
|
|
/*
|
|
* Create a comment for the history file to explain why and where
|
|
* timeline changed.
|
|
*/
|
|
if (recoveryTarget == RECOVERY_TARGET_XID)
|
|
snprintf(reason, sizeof(reason),
|
|
"%s transaction %u",
|
|
recoveryStopAfter ? "after" : "before",
|
|
recoveryStopXid);
|
|
else if (recoveryTarget == RECOVERY_TARGET_TIME)
|
|
snprintf(reason, sizeof(reason),
|
|
"%s %s\n",
|
|
recoveryStopAfter ? "after" : "before",
|
|
timestamptz_to_str(recoveryStopTime));
|
|
else if (recoveryTarget == RECOVERY_TARGET_NAME)
|
|
snprintf(reason, sizeof(reason),
|
|
"at restore point \"%s\"",
|
|
recoveryStopName);
|
|
else
|
|
snprintf(reason, sizeof(reason), "no recovery target specified");
|
|
|
|
writeTimeLineHistory(ThisTimeLineID, recoveryTargetTLI,
|
|
EndRecPtr, reason);
|
|
}
|
|
|
|
/* Save the selected TimeLineID in shared memory, too */
|
|
XLogCtl->ThisTimeLineID = ThisTimeLineID;
|
|
|
|
/*
|
|
* We are now done reading the old WAL. Turn off archive fetching if it
|
|
* was active, and make a writable copy of the last WAL segment. (Note
|
|
* that we also have a copy of the last block of the old WAL in readBuf;
|
|
* we will use that below.)
|
|
*/
|
|
if (InArchiveRecovery)
|
|
exitArchiveRecovery(curFileTLI, endLogSegNo);
|
|
|
|
/*
|
|
* Prepare to write WAL starting at EndOfLog position, and init xlog
|
|
* buffer cache using the block containing the last record from the
|
|
* previous incarnation.
|
|
*/
|
|
openLogSegNo = endLogSegNo;
|
|
openLogFile = XLogFileOpen(openLogSegNo);
|
|
openLogOff = 0;
|
|
Insert = &XLogCtl->Insert;
|
|
Insert->PrevRecord = LastRec;
|
|
XLogCtl->xlblocks[0] = ((EndOfLog - 1) / XLOG_BLCKSZ + 1) * XLOG_BLCKSZ;
|
|
|
|
/*
|
|
* Tricky point here: readBuf contains the *last* block that the LastRec
|
|
* record spans, not the one it starts in. The last block is indeed the
|
|
* one we want to use.
|
|
*/
|
|
Assert(readOff == (XLogCtl->xlblocks[0] - XLOG_BLCKSZ) % XLogSegSize);
|
|
memcpy((char *) Insert->currpage, readBuf, XLOG_BLCKSZ);
|
|
Insert->currpos = (char *) Insert->currpage +
|
|
(EndOfLog + XLOG_BLCKSZ - XLogCtl->xlblocks[0]);
|
|
|
|
LogwrtResult.Write = LogwrtResult.Flush = EndOfLog;
|
|
|
|
XLogCtl->LogwrtResult = LogwrtResult;
|
|
|
|
XLogCtl->LogwrtRqst.Write = EndOfLog;
|
|
XLogCtl->LogwrtRqst.Flush = EndOfLog;
|
|
|
|
freespace = INSERT_FREESPACE(Insert);
|
|
if (freespace > 0)
|
|
{
|
|
/* Make sure rest of page is zero */
|
|
MemSet(Insert->currpos, 0, freespace);
|
|
XLogCtl->Write.curridx = 0;
|
|
}
|
|
else
|
|
{
|
|
/*
|
|
* Whenever LogwrtResult points to exactly the end of a page,
|
|
* Write.curridx must point to the *next* page (see XLogWrite()).
|
|
*
|
|
* Note: it might seem we should do AdvanceXLInsertBuffer() here, but
|
|
* this is sufficient. The first actual attempt to insert a log
|
|
* record will advance the insert state.
|
|
*/
|
|
XLogCtl->Write.curridx = NextBufIdx(0);
|
|
}
|
|
|
|
/* Pre-scan prepared transactions to find out the range of XIDs present */
|
|
oldestActiveXID = PrescanPreparedTransactions(NULL, NULL);
|
|
|
|
/*
|
|
* Update full_page_writes in shared memory and write an XLOG_FPW_CHANGE
|
|
* record before resource manager writes cleanup WAL records or checkpoint
|
|
* record is written.
|
|
*/
|
|
Insert->fullPageWrites = lastFullPageWrites;
|
|
LocalSetXLogInsertAllowed();
|
|
UpdateFullPageWrites();
|
|
LocalXLogInsertAllowed = -1;
|
|
|
|
if (InRecovery)
|
|
{
|
|
int rmid;
|
|
|
|
/*
|
|
* Resource managers might need to write WAL records, eg, to record
|
|
* index cleanup actions. So temporarily enable XLogInsertAllowed in
|
|
* this process only.
|
|
*/
|
|
LocalSetXLogInsertAllowed();
|
|
|
|
/*
|
|
* Allow resource managers to do any required cleanup.
|
|
*/
|
|
for (rmid = 0; rmid <= RM_MAX_ID; rmid++)
|
|
{
|
|
if (RmgrTable[rmid].rm_cleanup != NULL)
|
|
RmgrTable[rmid].rm_cleanup();
|
|
}
|
|
|
|
/* Disallow XLogInsert again */
|
|
LocalXLogInsertAllowed = -1;
|
|
|
|
/*
|
|
* Perform a checkpoint to update all our recovery activity to disk.
|
|
*
|
|
* Note that we write a shutdown checkpoint rather than an on-line
|
|
* one. This is not particularly critical, but since we may be
|
|
* assigning a new TLI, using a shutdown checkpoint allows us to have
|
|
* the rule that TLI only changes in shutdown checkpoints, which
|
|
* allows some extra error checking in xlog_redo.
|
|
*/
|
|
if (bgwriterLaunched)
|
|
RequestCheckpoint(CHECKPOINT_END_OF_RECOVERY |
|
|
CHECKPOINT_IMMEDIATE |
|
|
CHECKPOINT_WAIT);
|
|
else
|
|
CreateCheckPoint(CHECKPOINT_END_OF_RECOVERY | CHECKPOINT_IMMEDIATE);
|
|
|
|
/*
|
|
* And finally, execute the recovery_end_command, if any.
|
|
*/
|
|
if (recoveryEndCommand)
|
|
ExecuteRecoveryCommand(recoveryEndCommand,
|
|
"recovery_end_command",
|
|
true);
|
|
}
|
|
|
|
/*
|
|
* Preallocate additional log files, if wanted.
|
|
*/
|
|
PreallocXlogFiles(EndOfLog);
|
|
|
|
/*
|
|
* Reset initial contents of unlogged relations. This has to be done
|
|
* AFTER recovery is complete so that any unlogged relations created
|
|
* during recovery also get picked up.
|
|
*/
|
|
if (InRecovery)
|
|
ResetUnloggedRelations(UNLOGGED_RELATION_INIT);
|
|
|
|
/*
|
|
* Okay, we're officially UP.
|
|
*/
|
|
InRecovery = false;
|
|
|
|
LWLockAcquire(ControlFileLock, LW_EXCLUSIVE);
|
|
ControlFile->state = DB_IN_PRODUCTION;
|
|
ControlFile->time = (pg_time_t) time(NULL);
|
|
UpdateControlFile();
|
|
LWLockRelease(ControlFileLock);
|
|
|
|
/* start the archive_timeout timer running */
|
|
XLogCtl->Write.lastSegSwitchTime = (pg_time_t) time(NULL);
|
|
|
|
/* also initialize latestCompletedXid, to nextXid - 1 */
|
|
LWLockAcquire(ProcArrayLock, LW_EXCLUSIVE);
|
|
ShmemVariableCache->latestCompletedXid = ShmemVariableCache->nextXid;
|
|
TransactionIdRetreat(ShmemVariableCache->latestCompletedXid);
|
|
LWLockRelease(ProcArrayLock);
|
|
|
|
/*
|
|
* Start up the commit log and subtrans, if not already done for hot
|
|
* standby.
|
|
*/
|
|
if (standbyState == STANDBY_DISABLED)
|
|
{
|
|
StartupCLOG();
|
|
StartupSUBTRANS(oldestActiveXID);
|
|
}
|
|
|
|
/*
|
|
* Perform end of recovery actions for any SLRUs that need it.
|
|
*/
|
|
StartupMultiXact();
|
|
TrimCLOG();
|
|
|
|
/* Reload shared-memory state for prepared transactions */
|
|
RecoverPreparedTransactions();
|
|
|
|
/*
|
|
* Shutdown the recovery environment. This must occur after
|
|
* RecoverPreparedTransactions(), see notes for lock_twophase_recover()
|
|
*/
|
|
if (standbyState != STANDBY_DISABLED)
|
|
ShutdownRecoveryTransactionEnvironment();
|
|
|
|
/* Shut down readFile facility, free space */
|
|
if (readFile >= 0)
|
|
{
|
|
close(readFile);
|
|
readFile = -1;
|
|
}
|
|
if (readBuf)
|
|
{
|
|
free(readBuf);
|
|
readBuf = NULL;
|
|
}
|
|
if (readRecordBuf)
|
|
{
|
|
free(readRecordBuf);
|
|
readRecordBuf = NULL;
|
|
readRecordBufSize = 0;
|
|
}
|
|
|
|
/*
|
|
* If any of the critical GUCs have changed, log them before we allow
|
|
* backends to write WAL.
|
|
*/
|
|
LocalSetXLogInsertAllowed();
|
|
XLogReportParameters();
|
|
|
|
/*
|
|
* All done. Allow backends to write WAL. (Although the bool flag is
|
|
* probably atomic in itself, we use the info_lck here to ensure that
|
|
* there are no race conditions concerning visibility of other recent
|
|
* updates to shared memory.)
|
|
*/
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->SharedRecoveryInProgress = false;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/*
|
|
* If there were cascading standby servers connected to us, nudge any
|
|
* wal sender processes to notice that we've been promoted.
|
|
*/
|
|
WalSndWakeup();
|
|
}
|
|
|
|
/*
|
|
* Checks if recovery has reached a consistent state. When consistency is
|
|
* reached and we have a valid starting standby snapshot, tell postmaster
|
|
* that it can start accepting read-only connections.
|
|
*/
|
|
static void
|
|
CheckRecoveryConsistency(void)
|
|
{
|
|
/*
|
|
* During crash recovery, we don't reach a consistent state until we've
|
|
* replayed all the WAL.
|
|
*/
|
|
if (XLogRecPtrIsInvalid(minRecoveryPoint))
|
|
return;
|
|
|
|
/*
|
|
* Have we reached the point where our base backup was completed?
|
|
*/
|
|
if (!XLogRecPtrIsInvalid(ControlFile->backupEndPoint) &&
|
|
XLByteLE(ControlFile->backupEndPoint, EndRecPtr))
|
|
{
|
|
/*
|
|
* We have reached the end of base backup, as indicated by pg_control.
|
|
* The data on disk is now consistent. Reset backupStartPoint and
|
|
* backupEndPoint, and update minRecoveryPoint to make sure we don't
|
|
* allow starting up at an earlier point even if recovery is stopped
|
|
* and restarted soon after this.
|
|
*/
|
|
elog(DEBUG1, "end of backup reached");
|
|
|
|
LWLockAcquire(ControlFileLock, LW_EXCLUSIVE);
|
|
|
|
if (XLByteLT(ControlFile->minRecoveryPoint, EndRecPtr))
|
|
ControlFile->minRecoveryPoint = EndRecPtr;
|
|
|
|
MemSet(&ControlFile->backupStartPoint, 0, sizeof(XLogRecPtr));
|
|
MemSet(&ControlFile->backupEndPoint, 0, sizeof(XLogRecPtr));
|
|
ControlFile->backupEndRequired = false;
|
|
UpdateControlFile();
|
|
|
|
LWLockRelease(ControlFileLock);
|
|
}
|
|
|
|
/*
|
|
* Have we passed our safe starting point? Note that minRecoveryPoint
|
|
* is known to be incorrectly set if ControlFile->backupEndRequired,
|
|
* until the XLOG_BACKUP_RECORD arrives to advise us of the correct
|
|
* minRecoveryPoint. All we know prior to that is that we're not
|
|
* consistent yet.
|
|
*/
|
|
if (!reachedConsistency && !ControlFile->backupEndRequired &&
|
|
XLByteLE(minRecoveryPoint, XLogCtl->lastReplayedEndRecPtr) &&
|
|
XLogRecPtrIsInvalid(ControlFile->backupStartPoint))
|
|
{
|
|
/*
|
|
* Check to see if the XLOG sequence contained any unresolved
|
|
* references to uninitialized pages.
|
|
*/
|
|
XLogCheckInvalidPages();
|
|
|
|
reachedConsistency = true;
|
|
ereport(LOG,
|
|
(errmsg("consistent recovery state reached at %X/%X",
|
|
(uint32) (XLogCtl->lastReplayedEndRecPtr >> 32),
|
|
(uint32) XLogCtl->lastReplayedEndRecPtr)));
|
|
}
|
|
|
|
/*
|
|
* Have we got a valid starting snapshot that will allow queries to be
|
|
* run? If so, we can tell postmaster that the database is consistent now,
|
|
* enabling connections.
|
|
*/
|
|
if (standbyState == STANDBY_SNAPSHOT_READY &&
|
|
!LocalHotStandbyActive &&
|
|
reachedConsistency &&
|
|
IsUnderPostmaster)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->SharedHotStandbyActive = true;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
LocalHotStandbyActive = true;
|
|
|
|
SendPostmasterSignal(PMSIGNAL_BEGIN_HOT_STANDBY);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Is the system still in recovery?
|
|
*
|
|
* Unlike testing InRecovery, this works in any process that's connected to
|
|
* shared memory.
|
|
*
|
|
* As a side-effect, we initialize the local TimeLineID and RedoRecPtr
|
|
* variables the first time we see that recovery is finished.
|
|
*/
|
|
bool
|
|
RecoveryInProgress(void)
|
|
{
|
|
/*
|
|
* We check shared state each time only until we leave recovery mode. We
|
|
* can't re-enter recovery, so there's no need to keep checking after the
|
|
* shared variable has once been seen false.
|
|
*/
|
|
if (!LocalRecoveryInProgress)
|
|
return false;
|
|
else
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
/* spinlock is essential on machines with weak memory ordering! */
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
LocalRecoveryInProgress = xlogctl->SharedRecoveryInProgress;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
/*
|
|
* Initialize TimeLineID and RedoRecPtr when we discover that recovery
|
|
* is finished. InitPostgres() relies upon this behaviour to ensure
|
|
* that InitXLOGAccess() is called at backend startup. (If you change
|
|
* this, see also LocalSetXLogInsertAllowed.)
|
|
*/
|
|
if (!LocalRecoveryInProgress)
|
|
InitXLOGAccess();
|
|
|
|
return LocalRecoveryInProgress;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Is HotStandby active yet? This is only important in special backends
|
|
* since normal backends won't ever be able to connect until this returns
|
|
* true. Postmaster knows this by way of signal, not via shared memory.
|
|
*
|
|
* Unlike testing standbyState, this works in any process that's connected to
|
|
* shared memory.
|
|
*/
|
|
bool
|
|
HotStandbyActive(void)
|
|
{
|
|
/*
|
|
* We check shared state each time only until Hot Standby is active. We
|
|
* can't de-activate Hot Standby, so there's no need to keep checking
|
|
* after the shared variable has once been seen true.
|
|
*/
|
|
if (LocalHotStandbyActive)
|
|
return true;
|
|
else
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
/* spinlock is essential on machines with weak memory ordering! */
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
LocalHotStandbyActive = xlogctl->SharedHotStandbyActive;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
return LocalHotStandbyActive;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Is this process allowed to insert new WAL records?
|
|
*
|
|
* Ordinarily this is essentially equivalent to !RecoveryInProgress().
|
|
* But we also have provisions for forcing the result "true" or "false"
|
|
* within specific processes regardless of the global state.
|
|
*/
|
|
bool
|
|
XLogInsertAllowed(void)
|
|
{
|
|
/*
|
|
* If value is "unconditionally true" or "unconditionally false", just
|
|
* return it. This provides the normal fast path once recovery is known
|
|
* done.
|
|
*/
|
|
if (LocalXLogInsertAllowed >= 0)
|
|
return (bool) LocalXLogInsertAllowed;
|
|
|
|
/*
|
|
* Else, must check to see if we're still in recovery.
|
|
*/
|
|
if (RecoveryInProgress())
|
|
return false;
|
|
|
|
/*
|
|
* On exit from recovery, reset to "unconditionally true", since there is
|
|
* no need to keep checking.
|
|
*/
|
|
LocalXLogInsertAllowed = 1;
|
|
return true;
|
|
}
|
|
|
|
/*
|
|
* Make XLogInsertAllowed() return true in the current process only.
|
|
*
|
|
* Note: it is allowed to switch LocalXLogInsertAllowed back to -1 later,
|
|
* and even call LocalSetXLogInsertAllowed() again after that.
|
|
*/
|
|
static void
|
|
LocalSetXLogInsertAllowed(void)
|
|
{
|
|
Assert(LocalXLogInsertAllowed == -1);
|
|
LocalXLogInsertAllowed = 1;
|
|
|
|
/* Initialize as RecoveryInProgress() would do when switching state */
|
|
InitXLOGAccess();
|
|
}
|
|
|
|
/*
|
|
* Subroutine to try to fetch and validate a prior checkpoint record.
|
|
*
|
|
* whichChkpt identifies the checkpoint (merely for reporting purposes).
|
|
* 1 for "primary", 2 for "secondary", 0 for "other" (backup_label)
|
|
*/
|
|
static XLogRecord *
|
|
ReadCheckpointRecord(XLogRecPtr RecPtr, int whichChkpt)
|
|
{
|
|
XLogRecord *record;
|
|
|
|
if (!XRecOffIsValid(RecPtr))
|
|
{
|
|
switch (whichChkpt)
|
|
{
|
|
case 1:
|
|
ereport(LOG,
|
|
(errmsg("invalid primary checkpoint link in control file")));
|
|
break;
|
|
case 2:
|
|
ereport(LOG,
|
|
(errmsg("invalid secondary checkpoint link in control file")));
|
|
break;
|
|
default:
|
|
ereport(LOG,
|
|
(errmsg("invalid checkpoint link in backup_label file")));
|
|
break;
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
record = ReadRecord(&RecPtr, LOG, true);
|
|
|
|
if (record == NULL)
|
|
{
|
|
switch (whichChkpt)
|
|
{
|
|
case 1:
|
|
ereport(LOG,
|
|
(errmsg("invalid primary checkpoint record")));
|
|
break;
|
|
case 2:
|
|
ereport(LOG,
|
|
(errmsg("invalid secondary checkpoint record")));
|
|
break;
|
|
default:
|
|
ereport(LOG,
|
|
(errmsg("invalid checkpoint record")));
|
|
break;
|
|
}
|
|
return NULL;
|
|
}
|
|
if (record->xl_rmid != RM_XLOG_ID)
|
|
{
|
|
switch (whichChkpt)
|
|
{
|
|
case 1:
|
|
ereport(LOG,
|
|
(errmsg("invalid resource manager ID in primary checkpoint record")));
|
|
break;
|
|
case 2:
|
|
ereport(LOG,
|
|
(errmsg("invalid resource manager ID in secondary checkpoint record")));
|
|
break;
|
|
default:
|
|
ereport(LOG,
|
|
(errmsg("invalid resource manager ID in checkpoint record")));
|
|
break;
|
|
}
|
|
return NULL;
|
|
}
|
|
if (record->xl_info != XLOG_CHECKPOINT_SHUTDOWN &&
|
|
record->xl_info != XLOG_CHECKPOINT_ONLINE)
|
|
{
|
|
switch (whichChkpt)
|
|
{
|
|
case 1:
|
|
ereport(LOG,
|
|
(errmsg("invalid xl_info in primary checkpoint record")));
|
|
break;
|
|
case 2:
|
|
ereport(LOG,
|
|
(errmsg("invalid xl_info in secondary checkpoint record")));
|
|
break;
|
|
default:
|
|
ereport(LOG,
|
|
(errmsg("invalid xl_info in checkpoint record")));
|
|
break;
|
|
}
|
|
return NULL;
|
|
}
|
|
if (record->xl_len != sizeof(CheckPoint) ||
|
|
record->xl_tot_len != SizeOfXLogRecord + sizeof(CheckPoint))
|
|
{
|
|
switch (whichChkpt)
|
|
{
|
|
case 1:
|
|
ereport(LOG,
|
|
(errmsg("invalid length of primary checkpoint record")));
|
|
break;
|
|
case 2:
|
|
ereport(LOG,
|
|
(errmsg("invalid length of secondary checkpoint record")));
|
|
break;
|
|
default:
|
|
ereport(LOG,
|
|
(errmsg("invalid length of checkpoint record")));
|
|
break;
|
|
}
|
|
return NULL;
|
|
}
|
|
return record;
|
|
}
|
|
|
|
/*
|
|
* This must be called during startup of a backend process, except that
|
|
* it need not be called in a standalone backend (which does StartupXLOG
|
|
* instead). We need to initialize the local copies of ThisTimeLineID and
|
|
* RedoRecPtr.
|
|
*
|
|
* Note: before Postgres 8.0, we went to some effort to keep the postmaster
|
|
* process's copies of ThisTimeLineID and RedoRecPtr valid too. This was
|
|
* unnecessary however, since the postmaster itself never touches XLOG anyway.
|
|
*/
|
|
void
|
|
InitXLOGAccess(void)
|
|
{
|
|
/* ThisTimeLineID doesn't change so we need no lock to copy it */
|
|
ThisTimeLineID = XLogCtl->ThisTimeLineID;
|
|
Assert(ThisTimeLineID != 0 || IsBootstrapProcessingMode());
|
|
|
|
/* Use GetRedoRecPtr to copy the RedoRecPtr safely */
|
|
(void) GetRedoRecPtr();
|
|
}
|
|
|
|
/*
|
|
* Once spawned, a backend may update its local RedoRecPtr from
|
|
* XLogCtl->Insert.RedoRecPtr; it must hold the insert lock or info_lck
|
|
* to do so. This is done in XLogInsert() or GetRedoRecPtr().
|
|
*/
|
|
XLogRecPtr
|
|
GetRedoRecPtr(void)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
Assert(XLByteLE(RedoRecPtr, xlogctl->Insert.RedoRecPtr));
|
|
RedoRecPtr = xlogctl->Insert.RedoRecPtr;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
return RedoRecPtr;
|
|
}
|
|
|
|
/*
|
|
* GetInsertRecPtr -- Returns the current insert position.
|
|
*
|
|
* NOTE: The value *actually* returned is the position of the last full
|
|
* xlog page. It lags behind the real insert position by at most 1 page.
|
|
* For that, we don't need to acquire WALInsertLock which can be quite
|
|
* heavily contended, and an approximation is enough for the current
|
|
* usage of this function.
|
|
*/
|
|
XLogRecPtr
|
|
GetInsertRecPtr(void)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
XLogRecPtr recptr;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
recptr = xlogctl->LogwrtRqst.Write;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
return recptr;
|
|
}
|
|
|
|
/*
|
|
* GetFlushRecPtr -- Returns the current flush position, ie, the last WAL
|
|
* position known to be fsync'd to disk.
|
|
*/
|
|
XLogRecPtr
|
|
GetFlushRecPtr(void)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
XLogRecPtr recptr;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
recptr = xlogctl->LogwrtResult.Flush;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
return recptr;
|
|
}
|
|
|
|
/*
|
|
* Get the time of the last xlog segment switch
|
|
*/
|
|
pg_time_t
|
|
GetLastSegSwitchTime(void)
|
|
{
|
|
pg_time_t result;
|
|
|
|
/* Need WALWriteLock, but shared lock is sufficient */
|
|
LWLockAcquire(WALWriteLock, LW_SHARED);
|
|
result = XLogCtl->Write.lastSegSwitchTime;
|
|
LWLockRelease(WALWriteLock);
|
|
|
|
return result;
|
|
}
|
|
|
|
/*
|
|
* GetNextXidAndEpoch - get the current nextXid value and associated epoch
|
|
*
|
|
* This is exported for use by code that would like to have 64-bit XIDs.
|
|
* We don't really support such things, but all XIDs within the system
|
|
* can be presumed "close to" the result, and thus the epoch associated
|
|
* with them can be determined.
|
|
*/
|
|
void
|
|
GetNextXidAndEpoch(TransactionId *xid, uint32 *epoch)
|
|
{
|
|
uint32 ckptXidEpoch;
|
|
TransactionId ckptXid;
|
|
TransactionId nextXid;
|
|
|
|
/* Must read checkpoint info first, else have race condition */
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
ckptXidEpoch = xlogctl->ckptXidEpoch;
|
|
ckptXid = xlogctl->ckptXid;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/* Now fetch current nextXid */
|
|
nextXid = ReadNewTransactionId();
|
|
|
|
/*
|
|
* nextXid is certainly logically later than ckptXid. So if it's
|
|
* numerically less, it must have wrapped into the next epoch.
|
|
*/
|
|
if (nextXid < ckptXid)
|
|
ckptXidEpoch++;
|
|
|
|
*xid = nextXid;
|
|
*epoch = ckptXidEpoch;
|
|
}
|
|
|
|
/*
|
|
* GetRecoveryTargetTLI - get the current recovery target timeline ID
|
|
*/
|
|
TimeLineID
|
|
GetRecoveryTargetTLI(void)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
TimeLineID result;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
result = xlogctl->RecoveryTargetTLI;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
return result;
|
|
}
|
|
|
|
/*
|
|
* This must be called ONCE during postmaster or standalone-backend shutdown
|
|
*/
|
|
void
|
|
ShutdownXLOG(int code, Datum arg)
|
|
{
|
|
ereport(LOG,
|
|
(errmsg("shutting down")));
|
|
|
|
if (RecoveryInProgress())
|
|
CreateRestartPoint(CHECKPOINT_IS_SHUTDOWN | CHECKPOINT_IMMEDIATE);
|
|
else
|
|
{
|
|
/*
|
|
* If archiving is enabled, rotate the last XLOG file so that all the
|
|
* remaining records are archived (postmaster wakes up the archiver
|
|
* process one more time at the end of shutdown). The checkpoint
|
|
* record will go to the next XLOG file and won't be archived (yet).
|
|
*/
|
|
if (XLogArchivingActive() && XLogArchiveCommandSet())
|
|
RequestXLogSwitch();
|
|
|
|
CreateCheckPoint(CHECKPOINT_IS_SHUTDOWN | CHECKPOINT_IMMEDIATE);
|
|
}
|
|
ShutdownCLOG();
|
|
ShutdownSUBTRANS();
|
|
ShutdownMultiXact();
|
|
|
|
ereport(LOG,
|
|
(errmsg("database system is shut down")));
|
|
}
|
|
|
|
/*
|
|
* Log start of a checkpoint.
|
|
*/
|
|
static void
|
|
LogCheckpointStart(int flags, bool restartpoint)
|
|
{
|
|
const char *msg;
|
|
|
|
/*
|
|
* XXX: This is hopelessly untranslatable. We could call gettext_noop for
|
|
* the main message, but what about all the flags?
|
|
*/
|
|
if (restartpoint)
|
|
msg = "restartpoint starting:%s%s%s%s%s%s%s";
|
|
else
|
|
msg = "checkpoint starting:%s%s%s%s%s%s%s";
|
|
|
|
elog(LOG, msg,
|
|
(flags & CHECKPOINT_IS_SHUTDOWN) ? " shutdown" : "",
|
|
(flags & CHECKPOINT_END_OF_RECOVERY) ? " end-of-recovery" : "",
|
|
(flags & CHECKPOINT_IMMEDIATE) ? " immediate" : "",
|
|
(flags & CHECKPOINT_FORCE) ? " force" : "",
|
|
(flags & CHECKPOINT_WAIT) ? " wait" : "",
|
|
(flags & CHECKPOINT_CAUSE_XLOG) ? " xlog" : "",
|
|
(flags & CHECKPOINT_CAUSE_TIME) ? " time" : "");
|
|
}
|
|
|
|
/*
|
|
* Log end of a checkpoint.
|
|
*/
|
|
static void
|
|
LogCheckpointEnd(bool restartpoint)
|
|
{
|
|
long write_secs,
|
|
sync_secs,
|
|
total_secs,
|
|
longest_secs,
|
|
average_secs;
|
|
int write_usecs,
|
|
sync_usecs,
|
|
total_usecs,
|
|
longest_usecs,
|
|
average_usecs;
|
|
uint64 average_sync_time;
|
|
|
|
CheckpointStats.ckpt_end_t = GetCurrentTimestamp();
|
|
|
|
TimestampDifference(CheckpointStats.ckpt_write_t,
|
|
CheckpointStats.ckpt_sync_t,
|
|
&write_secs, &write_usecs);
|
|
|
|
TimestampDifference(CheckpointStats.ckpt_sync_t,
|
|
CheckpointStats.ckpt_sync_end_t,
|
|
&sync_secs, &sync_usecs);
|
|
|
|
/* Accumulate checkpoint timing summary data, in milliseconds. */
|
|
BgWriterStats.m_checkpoint_write_time +=
|
|
write_secs * 1000 + write_usecs / 1000;
|
|
BgWriterStats.m_checkpoint_sync_time +=
|
|
sync_secs * 1000 + sync_usecs / 1000;
|
|
|
|
/*
|
|
* All of the published timing statistics are accounted for. Only
|
|
* continue if a log message is to be written.
|
|
*/
|
|
if (!log_checkpoints)
|
|
return;
|
|
|
|
TimestampDifference(CheckpointStats.ckpt_start_t,
|
|
CheckpointStats.ckpt_end_t,
|
|
&total_secs, &total_usecs);
|
|
|
|
/*
|
|
* Timing values returned from CheckpointStats are in microseconds.
|
|
* Convert to the second plus microsecond form that TimestampDifference
|
|
* returns for homogeneous printing.
|
|
*/
|
|
longest_secs = (long) (CheckpointStats.ckpt_longest_sync / 1000000);
|
|
longest_usecs = CheckpointStats.ckpt_longest_sync -
|
|
(uint64) longest_secs *1000000;
|
|
|
|
average_sync_time = 0;
|
|
if (CheckpointStats.ckpt_sync_rels > 0)
|
|
average_sync_time = CheckpointStats.ckpt_agg_sync_time /
|
|
CheckpointStats.ckpt_sync_rels;
|
|
average_secs = (long) (average_sync_time / 1000000);
|
|
average_usecs = average_sync_time - (uint64) average_secs *1000000;
|
|
|
|
if (restartpoint)
|
|
elog(LOG, "restartpoint complete: wrote %d buffers (%.1f%%); "
|
|
"%d transaction log file(s) added, %d removed, %d recycled; "
|
|
"write=%ld.%03d s, sync=%ld.%03d s, total=%ld.%03d s; "
|
|
"sync files=%d, longest=%ld.%03d s, average=%ld.%03d s",
|
|
CheckpointStats.ckpt_bufs_written,
|
|
(double) CheckpointStats.ckpt_bufs_written * 100 / NBuffers,
|
|
CheckpointStats.ckpt_segs_added,
|
|
CheckpointStats.ckpt_segs_removed,
|
|
CheckpointStats.ckpt_segs_recycled,
|
|
write_secs, write_usecs / 1000,
|
|
sync_secs, sync_usecs / 1000,
|
|
total_secs, total_usecs / 1000,
|
|
CheckpointStats.ckpt_sync_rels,
|
|
longest_secs, longest_usecs / 1000,
|
|
average_secs, average_usecs / 1000);
|
|
else
|
|
elog(LOG, "checkpoint complete: wrote %d buffers (%.1f%%); "
|
|
"%d transaction log file(s) added, %d removed, %d recycled; "
|
|
"write=%ld.%03d s, sync=%ld.%03d s, total=%ld.%03d s; "
|
|
"sync files=%d, longest=%ld.%03d s, average=%ld.%03d s",
|
|
CheckpointStats.ckpt_bufs_written,
|
|
(double) CheckpointStats.ckpt_bufs_written * 100 / NBuffers,
|
|
CheckpointStats.ckpt_segs_added,
|
|
CheckpointStats.ckpt_segs_removed,
|
|
CheckpointStats.ckpt_segs_recycled,
|
|
write_secs, write_usecs / 1000,
|
|
sync_secs, sync_usecs / 1000,
|
|
total_secs, total_usecs / 1000,
|
|
CheckpointStats.ckpt_sync_rels,
|
|
longest_secs, longest_usecs / 1000,
|
|
average_secs, average_usecs / 1000);
|
|
}
|
|
|
|
/*
|
|
* Perform a checkpoint --- either during shutdown, or on-the-fly
|
|
*
|
|
* flags is a bitwise OR of the following:
|
|
* CHECKPOINT_IS_SHUTDOWN: checkpoint is for database shutdown.
|
|
* CHECKPOINT_END_OF_RECOVERY: checkpoint is for end of WAL recovery.
|
|
* CHECKPOINT_IMMEDIATE: finish the checkpoint ASAP,
|
|
* ignoring checkpoint_completion_target parameter.
|
|
* CHECKPOINT_FORCE: force a checkpoint even if no XLOG activity has occurred
|
|
* since the last one (implied by CHECKPOINT_IS_SHUTDOWN or
|
|
* CHECKPOINT_END_OF_RECOVERY).
|
|
*
|
|
* Note: flags contains other bits, of interest here only for logging purposes.
|
|
* In particular note that this routine is synchronous and does not pay
|
|
* attention to CHECKPOINT_WAIT.
|
|
*
|
|
* If !shutdown then we are writing an online checkpoint. This is a very special
|
|
* kind of operation and WAL record because the checkpoint action occurs over
|
|
* a period of time yet logically occurs at just a single LSN. The logical
|
|
* position of the WAL record (redo ptr) is the same or earlier than the
|
|
* physical position. When we replay WAL we locate the checkpoint via its
|
|
* physical position then read the redo ptr and actually start replay at the
|
|
* earlier logical position. Note that we don't write *anything* to WAL at
|
|
* the logical position, so that location could be any other kind of WAL record.
|
|
* All of this mechanism allows us to continue working while we checkpoint.
|
|
* As a result, timing of actions is critical here and be careful to note that
|
|
* this function will likely take minutes to execute on a busy system.
|
|
*/
|
|
void
|
|
CreateCheckPoint(int flags)
|
|
{
|
|
bool shutdown;
|
|
CheckPoint checkPoint;
|
|
XLogRecPtr recptr;
|
|
XLogCtlInsert *Insert = &XLogCtl->Insert;
|
|
XLogRecData rdata;
|
|
uint32 freespace;
|
|
XLogSegNo _logSegNo;
|
|
VirtualTransactionId *vxids;
|
|
int nvxids;
|
|
|
|
/*
|
|
* An end-of-recovery checkpoint is really a shutdown checkpoint, just
|
|
* issued at a different time.
|
|
*/
|
|
if (flags & (CHECKPOINT_IS_SHUTDOWN | CHECKPOINT_END_OF_RECOVERY))
|
|
shutdown = true;
|
|
else
|
|
shutdown = false;
|
|
|
|
/* sanity check */
|
|
if (RecoveryInProgress() && (flags & CHECKPOINT_END_OF_RECOVERY) == 0)
|
|
elog(ERROR, "can't create a checkpoint during recovery");
|
|
|
|
/*
|
|
* Acquire CheckpointLock to ensure only one checkpoint happens at a time.
|
|
* (This is just pro forma, since in the present system structure there is
|
|
* only one process that is allowed to issue checkpoints at any given
|
|
* time.)
|
|
*/
|
|
LWLockAcquire(CheckpointLock, LW_EXCLUSIVE);
|
|
|
|
/*
|
|
* Prepare to accumulate statistics.
|
|
*
|
|
* Note: because it is possible for log_checkpoints to change while a
|
|
* checkpoint proceeds, we always accumulate stats, even if
|
|
* log_checkpoints is currently off.
|
|
*/
|
|
MemSet(&CheckpointStats, 0, sizeof(CheckpointStats));
|
|
CheckpointStats.ckpt_start_t = GetCurrentTimestamp();
|
|
|
|
/*
|
|
* Use a critical section to force system panic if we have trouble.
|
|
*/
|
|
START_CRIT_SECTION();
|
|
|
|
if (shutdown)
|
|
{
|
|
LWLockAcquire(ControlFileLock, LW_EXCLUSIVE);
|
|
ControlFile->state = DB_SHUTDOWNING;
|
|
ControlFile->time = (pg_time_t) time(NULL);
|
|
UpdateControlFile();
|
|
LWLockRelease(ControlFileLock);
|
|
}
|
|
|
|
/*
|
|
* Let smgr prepare for checkpoint; this has to happen before we determine
|
|
* the REDO pointer. Note that smgr must not do anything that'd have to
|
|
* be undone if we decide no checkpoint is needed.
|
|
*/
|
|
smgrpreckpt();
|
|
|
|
/* Begin filling in the checkpoint WAL record */
|
|
MemSet(&checkPoint, 0, sizeof(checkPoint));
|
|
checkPoint.time = (pg_time_t) time(NULL);
|
|
|
|
/*
|
|
* For Hot Standby, derive the oldestActiveXid before we fix the redo
|
|
* pointer. This allows us to begin accumulating changes to assemble our
|
|
* starting snapshot of locks and transactions.
|
|
*/
|
|
if (!shutdown && XLogStandbyInfoActive())
|
|
checkPoint.oldestActiveXid = GetOldestActiveTransactionId();
|
|
else
|
|
checkPoint.oldestActiveXid = InvalidTransactionId;
|
|
|
|
/*
|
|
* We must hold WALInsertLock while examining insert state to determine
|
|
* the checkpoint REDO pointer.
|
|
*/
|
|
LWLockAcquire(WALInsertLock, LW_EXCLUSIVE);
|
|
|
|
/*
|
|
* If this isn't a shutdown or forced checkpoint, and we have not inserted
|
|
* any XLOG records since the start of the last checkpoint, skip the
|
|
* checkpoint. The idea here is to avoid inserting duplicate checkpoints
|
|
* when the system is idle. That wastes log space, and more importantly it
|
|
* exposes us to possible loss of both current and previous checkpoint
|
|
* records if the machine crashes just as we're writing the update.
|
|
* (Perhaps it'd make even more sense to checkpoint only when the previous
|
|
* checkpoint record is in a different xlog page?)
|
|
*
|
|
* We have to make two tests to determine that nothing has happened since
|
|
* the start of the last checkpoint: current insertion point must match
|
|
* the end of the last checkpoint record, and its redo pointer must point
|
|
* to itself.
|
|
*/
|
|
if ((flags & (CHECKPOINT_IS_SHUTDOWN | CHECKPOINT_END_OF_RECOVERY |
|
|
CHECKPOINT_FORCE)) == 0)
|
|
{
|
|
XLogRecPtr curInsert;
|
|
|
|
INSERT_RECPTR(curInsert, Insert, Insert->curridx);
|
|
if (curInsert == ControlFile->checkPoint +
|
|
MAXALIGN(SizeOfXLogRecord + sizeof(CheckPoint)) &&
|
|
ControlFile->checkPoint == ControlFile->checkPointCopy.redo)
|
|
{
|
|
LWLockRelease(WALInsertLock);
|
|
LWLockRelease(CheckpointLock);
|
|
END_CRIT_SECTION();
|
|
return;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* An end-of-recovery checkpoint is created before anyone is allowed to
|
|
* write WAL. To allow us to write the checkpoint record, temporarily
|
|
* enable XLogInsertAllowed. (This also ensures ThisTimeLineID is
|
|
* initialized, which we need here and in AdvanceXLInsertBuffer.)
|
|
*/
|
|
if (flags & CHECKPOINT_END_OF_RECOVERY)
|
|
LocalSetXLogInsertAllowed();
|
|
|
|
checkPoint.ThisTimeLineID = ThisTimeLineID;
|
|
checkPoint.fullPageWrites = Insert->fullPageWrites;
|
|
|
|
/*
|
|
* Compute new REDO record ptr = location of next XLOG record.
|
|
*
|
|
* NB: this is NOT necessarily where the checkpoint record itself will be,
|
|
* since other backends may insert more XLOG records while we're off doing
|
|
* the buffer flush work. Those XLOG records are logically after the
|
|
* checkpoint, even though physically before it. Got that?
|
|
*/
|
|
freespace = INSERT_FREESPACE(Insert);
|
|
if (freespace == 0)
|
|
{
|
|
(void) AdvanceXLInsertBuffer(false);
|
|
/* OK to ignore update return flag, since we will do flush anyway */
|
|
freespace = INSERT_FREESPACE(Insert);
|
|
}
|
|
INSERT_RECPTR(checkPoint.redo, Insert, Insert->curridx);
|
|
|
|
/*
|
|
* Here we update the shared RedoRecPtr for future XLogInsert calls; this
|
|
* must be done while holding the insert lock AND the info_lck.
|
|
*
|
|
* Note: if we fail to complete the checkpoint, RedoRecPtr will be left
|
|
* pointing past where it really needs to point. This is okay; the only
|
|
* consequence is that XLogInsert might back up whole buffers that it
|
|
* didn't really need to. We can't postpone advancing RedoRecPtr because
|
|
* XLogInserts that happen while we are dumping buffers must assume that
|
|
* their buffer changes are not included in the checkpoint.
|
|
*/
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
RedoRecPtr = xlogctl->Insert.RedoRecPtr = checkPoint.redo;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/*
|
|
* Now we can release WAL insert lock, allowing other xacts to proceed
|
|
* while we are flushing disk buffers.
|
|
*/
|
|
LWLockRelease(WALInsertLock);
|
|
|
|
/*
|
|
* If enabled, log checkpoint start. We postpone this until now so as not
|
|
* to log anything if we decided to skip the checkpoint.
|
|
*/
|
|
if (log_checkpoints)
|
|
LogCheckpointStart(flags, false);
|
|
|
|
TRACE_POSTGRESQL_CHECKPOINT_START(flags);
|
|
|
|
/*
|
|
* In some cases there are groups of actions that must all occur on
|
|
* one side or the other of a checkpoint record. Before flushing the
|
|
* checkpoint record we must explicitly wait for any backend currently
|
|
* performing those groups of actions.
|
|
*
|
|
* One example is end of transaction, so we must wait for any transactions
|
|
* that are currently in commit critical sections. If an xact inserted
|
|
* its commit record into XLOG just before the REDO point, then a crash
|
|
* restart from the REDO point would not replay that record, which means
|
|
* that our flushing had better include the xact's update of pg_clog. So
|
|
* we wait till he's out of his commit critical section before proceeding.
|
|
* See notes in RecordTransactionCommit().
|
|
*
|
|
* Because we've already released WALInsertLock, this test is a bit fuzzy:
|
|
* it is possible that we will wait for xacts we didn't really need to
|
|
* wait for. But the delay should be short and it seems better to make
|
|
* checkpoint take a bit longer than to hold locks longer than necessary.
|
|
* (In fact, the whole reason we have this issue is that xact.c does
|
|
* commit record XLOG insertion and clog update as two separate steps
|
|
* protected by different locks, but again that seems best on grounds of
|
|
* minimizing lock contention.)
|
|
*
|
|
* A transaction that has not yet set delayChkpt when we look cannot be at
|
|
* risk, since he's not inserted his commit record yet; and one that's
|
|
* already cleared it is not at risk either, since he's done fixing clog
|
|
* and we will correctly flush the update below. So we cannot miss any
|
|
* xacts we need to wait for.
|
|
*/
|
|
vxids = GetVirtualXIDsDelayingChkpt(&nvxids);
|
|
if (nvxids > 0)
|
|
{
|
|
uint32 nwaits = 0;
|
|
|
|
do
|
|
{
|
|
pg_usleep(10000L); /* wait for 10 msec */
|
|
nwaits++;
|
|
} while (HaveVirtualXIDsDelayingChkpt(vxids, nvxids));
|
|
}
|
|
pfree(vxids);
|
|
|
|
/*
|
|
* Get the other info we need for the checkpoint record.
|
|
*/
|
|
LWLockAcquire(XidGenLock, LW_SHARED);
|
|
checkPoint.nextXid = ShmemVariableCache->nextXid;
|
|
checkPoint.oldestXid = ShmemVariableCache->oldestXid;
|
|
checkPoint.oldestXidDB = ShmemVariableCache->oldestXidDB;
|
|
LWLockRelease(XidGenLock);
|
|
|
|
/* Increase XID epoch if we've wrapped around since last checkpoint */
|
|
checkPoint.nextXidEpoch = ControlFile->checkPointCopy.nextXidEpoch;
|
|
if (checkPoint.nextXid < ControlFile->checkPointCopy.nextXid)
|
|
checkPoint.nextXidEpoch++;
|
|
|
|
LWLockAcquire(OidGenLock, LW_SHARED);
|
|
checkPoint.nextOid = ShmemVariableCache->nextOid;
|
|
if (!shutdown)
|
|
checkPoint.nextOid += ShmemVariableCache->oidCount;
|
|
LWLockRelease(OidGenLock);
|
|
|
|
MultiXactGetCheckptMulti(shutdown,
|
|
&checkPoint.nextMulti,
|
|
&checkPoint.nextMultiOffset);
|
|
|
|
/*
|
|
* Having constructed the checkpoint record, ensure all shmem disk buffers
|
|
* and commit-log buffers are flushed to disk.
|
|
*
|
|
* This I/O could fail for various reasons. If so, we will fail to
|
|
* complete the checkpoint, but there is no reason to force a system
|
|
* panic. Accordingly, exit critical section while doing it.
|
|
*/
|
|
END_CRIT_SECTION();
|
|
|
|
CheckPointGuts(checkPoint.redo, flags);
|
|
|
|
/*
|
|
* Take a snapshot of running transactions and write this to WAL. This
|
|
* allows us to reconstruct the state of running transactions during
|
|
* archive recovery, if required. Skip, if this info disabled.
|
|
*
|
|
* If we are shutting down, or Startup process is completing crash
|
|
* recovery we don't need to write running xact data.
|
|
*/
|
|
if (!shutdown && XLogStandbyInfoActive())
|
|
LogStandbySnapshot();
|
|
|
|
START_CRIT_SECTION();
|
|
|
|
/*
|
|
* Now insert the checkpoint record into XLOG.
|
|
*/
|
|
rdata.data = (char *) (&checkPoint);
|
|
rdata.len = sizeof(checkPoint);
|
|
rdata.buffer = InvalidBuffer;
|
|
rdata.next = NULL;
|
|
|
|
recptr = XLogInsert(RM_XLOG_ID,
|
|
shutdown ? XLOG_CHECKPOINT_SHUTDOWN :
|
|
XLOG_CHECKPOINT_ONLINE,
|
|
&rdata);
|
|
|
|
XLogFlush(recptr);
|
|
|
|
/*
|
|
* We mustn't write any new WAL after a shutdown checkpoint, or it will be
|
|
* overwritten at next startup. No-one should even try, this just allows
|
|
* sanity-checking. In the case of an end-of-recovery checkpoint, we want
|
|
* to just temporarily disable writing until the system has exited
|
|
* recovery.
|
|
*/
|
|
if (shutdown)
|
|
{
|
|
if (flags & CHECKPOINT_END_OF_RECOVERY)
|
|
LocalXLogInsertAllowed = -1; /* return to "check" state */
|
|
else
|
|
LocalXLogInsertAllowed = 0; /* never again write WAL */
|
|
}
|
|
|
|
/*
|
|
* We now have ProcLastRecPtr = start of actual checkpoint record, recptr
|
|
* = end of actual checkpoint record.
|
|
*/
|
|
if (shutdown && !XLByteEQ(checkPoint.redo, ProcLastRecPtr))
|
|
ereport(PANIC,
|
|
(errmsg("concurrent transaction log activity while database system is shutting down")));
|
|
|
|
/*
|
|
* Select point at which we can truncate the log, which we base on the
|
|
* prior checkpoint's earliest info.
|
|
*/
|
|
XLByteToSeg(ControlFile->checkPointCopy.redo, _logSegNo);
|
|
|
|
/*
|
|
* Update the control file.
|
|
*/
|
|
LWLockAcquire(ControlFileLock, LW_EXCLUSIVE);
|
|
if (shutdown)
|
|
ControlFile->state = DB_SHUTDOWNED;
|
|
ControlFile->prevCheckPoint = ControlFile->checkPoint;
|
|
ControlFile->checkPoint = ProcLastRecPtr;
|
|
ControlFile->checkPointCopy = checkPoint;
|
|
ControlFile->time = (pg_time_t) time(NULL);
|
|
/* crash recovery should always recover to the end of WAL */
|
|
MemSet(&ControlFile->minRecoveryPoint, 0, sizeof(XLogRecPtr));
|
|
ControlFile->minRecoveryPointTLI = 0;
|
|
UpdateControlFile();
|
|
LWLockRelease(ControlFileLock);
|
|
|
|
/* Update shared-memory copy of checkpoint XID/epoch */
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->ckptXidEpoch = checkPoint.nextXidEpoch;
|
|
xlogctl->ckptXid = checkPoint.nextXid;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/*
|
|
* We are now done with critical updates; no need for system panic if we
|
|
* have trouble while fooling with old log segments.
|
|
*/
|
|
END_CRIT_SECTION();
|
|
|
|
/*
|
|
* Let smgr do post-checkpoint cleanup (eg, deleting old files).
|
|
*/
|
|
smgrpostckpt();
|
|
|
|
/*
|
|
* Delete old log files (those no longer needed even for previous
|
|
* checkpoint or the standbys in XLOG streaming).
|
|
*/
|
|
if (_logSegNo)
|
|
{
|
|
KeepLogSeg(recptr, &_logSegNo);
|
|
_logSegNo--;
|
|
RemoveOldXlogFiles(_logSegNo, recptr);
|
|
}
|
|
|
|
/*
|
|
* Make more log segments if needed. (Do this after recycling old log
|
|
* segments, since that may supply some of the needed files.)
|
|
*/
|
|
if (!shutdown)
|
|
PreallocXlogFiles(recptr);
|
|
|
|
/*
|
|
* Truncate pg_subtrans if possible. We can throw away all data before
|
|
* the oldest XMIN of any running transaction. No future transaction will
|
|
* attempt to reference any pg_subtrans entry older than that (see Asserts
|
|
* in subtrans.c). During recovery, though, we mustn't do this because
|
|
* StartupSUBTRANS hasn't been called yet.
|
|
*/
|
|
if (!RecoveryInProgress())
|
|
TruncateSUBTRANS(GetOldestXmin(true, false));
|
|
|
|
/* Real work is done, but log and update stats before releasing lock. */
|
|
LogCheckpointEnd(false);
|
|
|
|
TRACE_POSTGRESQL_CHECKPOINT_DONE(CheckpointStats.ckpt_bufs_written,
|
|
NBuffers,
|
|
CheckpointStats.ckpt_segs_added,
|
|
CheckpointStats.ckpt_segs_removed,
|
|
CheckpointStats.ckpt_segs_recycled);
|
|
|
|
LWLockRelease(CheckpointLock);
|
|
}
|
|
|
|
/*
|
|
* Flush all data in shared memory to disk, and fsync
|
|
*
|
|
* This is the common code shared between regular checkpoints and
|
|
* recovery restartpoints.
|
|
*/
|
|
static void
|
|
CheckPointGuts(XLogRecPtr checkPointRedo, int flags)
|
|
{
|
|
CheckPointCLOG();
|
|
CheckPointSUBTRANS();
|
|
CheckPointMultiXact();
|
|
CheckPointPredicate();
|
|
CheckPointRelationMap();
|
|
CheckPointBuffers(flags); /* performs all required fsyncs */
|
|
/* We deliberately delay 2PC checkpointing as long as possible */
|
|
CheckPointTwoPhase(checkPointRedo);
|
|
}
|
|
|
|
/*
|
|
* Save a checkpoint for recovery restart if appropriate
|
|
*
|
|
* This function is called each time a checkpoint record is read from XLOG.
|
|
* It must determine whether the checkpoint represents a safe restartpoint or
|
|
* not. If so, the checkpoint record is stashed in shared memory so that
|
|
* CreateRestartPoint can consult it. (Note that the latter function is
|
|
* executed by the checkpointer, while this one will be executed by the
|
|
* startup process.)
|
|
*/
|
|
static void
|
|
RecoveryRestartPoint(const CheckPoint *checkPoint)
|
|
{
|
|
int rmid;
|
|
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
/*
|
|
* Is it safe to restartpoint? We must ask each of the resource managers
|
|
* whether they have any partial state information that might prevent a
|
|
* correct restart from this point. If so, we skip this opportunity, but
|
|
* return at the next checkpoint record for another try.
|
|
*/
|
|
for (rmid = 0; rmid <= RM_MAX_ID; rmid++)
|
|
{
|
|
if (RmgrTable[rmid].rm_safe_restartpoint != NULL)
|
|
if (!(RmgrTable[rmid].rm_safe_restartpoint()))
|
|
{
|
|
elog(trace_recovery(DEBUG2),
|
|
"RM %d not safe to record restart point at %X/%X",
|
|
rmid,
|
|
(uint32) (checkPoint->redo >> 32),
|
|
(uint32) checkPoint->redo);
|
|
return;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Also refrain from creating a restartpoint if we have seen any
|
|
* references to non-existent pages. Restarting recovery from the
|
|
* restartpoint would not see the references, so we would lose the
|
|
* cross-check that the pages belonged to a relation that was dropped
|
|
* later.
|
|
*/
|
|
if (XLogHaveInvalidPages())
|
|
{
|
|
elog(trace_recovery(DEBUG2),
|
|
"could not record restart point at %X/%X because there "
|
|
"are unresolved references to invalid pages",
|
|
(uint32) (checkPoint->redo >> 32),
|
|
(uint32) checkPoint->redo);
|
|
return;
|
|
}
|
|
|
|
/*
|
|
* Copy the checkpoint record to shared memory, so that checkpointer can
|
|
* work out the next time it wants to perform a restartpoint.
|
|
*/
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->lastCheckPointRecPtr = ReadRecPtr;
|
|
xlogctl->lastCheckPoint = *checkPoint;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/*
|
|
* Establish a restartpoint if possible.
|
|
*
|
|
* This is similar to CreateCheckPoint, but is used during WAL recovery
|
|
* to establish a point from which recovery can roll forward without
|
|
* replaying the entire recovery log.
|
|
*
|
|
* Returns true if a new restartpoint was established. We can only establish
|
|
* a restartpoint if we have replayed a safe checkpoint record since last
|
|
* restartpoint.
|
|
*/
|
|
bool
|
|
CreateRestartPoint(int flags)
|
|
{
|
|
XLogRecPtr lastCheckPointRecPtr;
|
|
CheckPoint lastCheckPoint;
|
|
XLogSegNo _logSegNo;
|
|
TimestampTz xtime;
|
|
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
/*
|
|
* Acquire CheckpointLock to ensure only one restartpoint or checkpoint
|
|
* happens at a time.
|
|
*/
|
|
LWLockAcquire(CheckpointLock, LW_EXCLUSIVE);
|
|
|
|
/* Get a local copy of the last safe checkpoint record. */
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
lastCheckPointRecPtr = xlogctl->lastCheckPointRecPtr;
|
|
lastCheckPoint = xlogctl->lastCheckPoint;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
/*
|
|
* Check that we're still in recovery mode. It's ok if we exit recovery
|
|
* mode after this check, the restart point is valid anyway.
|
|
*/
|
|
if (!RecoveryInProgress())
|
|
{
|
|
ereport(DEBUG2,
|
|
(errmsg("skipping restartpoint, recovery has already ended")));
|
|
LWLockRelease(CheckpointLock);
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* If the last checkpoint record we've replayed is already our last
|
|
* restartpoint, we can't perform a new restart point. We still update
|
|
* minRecoveryPoint in that case, so that if this is a shutdown restart
|
|
* point, we won't start up earlier than before. That's not strictly
|
|
* necessary, but when hot standby is enabled, it would be rather weird if
|
|
* the database opened up for read-only connections at a point-in-time
|
|
* before the last shutdown. Such time travel is still possible in case of
|
|
* immediate shutdown, though.
|
|
*
|
|
* We don't explicitly advance minRecoveryPoint when we do create a
|
|
* restartpoint. It's assumed that flushing the buffers will do that as a
|
|
* side-effect.
|
|
*/
|
|
if (XLogRecPtrIsInvalid(lastCheckPointRecPtr) ||
|
|
XLByteLE(lastCheckPoint.redo, ControlFile->checkPointCopy.redo))
|
|
{
|
|
ereport(DEBUG2,
|
|
(errmsg("skipping restartpoint, already performed at %X/%X",
|
|
(uint32) (lastCheckPoint.redo >> 32), (uint32) lastCheckPoint.redo)));
|
|
|
|
UpdateMinRecoveryPoint(InvalidXLogRecPtr, true);
|
|
if (flags & CHECKPOINT_IS_SHUTDOWN)
|
|
{
|
|
LWLockAcquire(ControlFileLock, LW_EXCLUSIVE);
|
|
ControlFile->state = DB_SHUTDOWNED_IN_RECOVERY;
|
|
ControlFile->time = (pg_time_t) time(NULL);
|
|
UpdateControlFile();
|
|
LWLockRelease(ControlFileLock);
|
|
}
|
|
LWLockRelease(CheckpointLock);
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* Update the shared RedoRecPtr so that the startup process can calculate
|
|
* the number of segments replayed since last restartpoint, and request a
|
|
* restartpoint if it exceeds checkpoint_segments.
|
|
*
|
|
* You need to hold WALInsertLock and info_lck to update it, although
|
|
* during recovery acquiring WALInsertLock is just pro forma, because
|
|
* there is no other processes updating Insert.RedoRecPtr.
|
|
*/
|
|
LWLockAcquire(WALInsertLock, LW_EXCLUSIVE);
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->Insert.RedoRecPtr = lastCheckPoint.redo;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
LWLockRelease(WALInsertLock);
|
|
|
|
/*
|
|
* Prepare to accumulate statistics.
|
|
*
|
|
* Note: because it is possible for log_checkpoints to change while a
|
|
* checkpoint proceeds, we always accumulate stats, even if
|
|
* log_checkpoints is currently off.
|
|
*/
|
|
MemSet(&CheckpointStats, 0, sizeof(CheckpointStats));
|
|
CheckpointStats.ckpt_start_t = GetCurrentTimestamp();
|
|
|
|
if (log_checkpoints)
|
|
LogCheckpointStart(flags, true);
|
|
|
|
CheckPointGuts(lastCheckPoint.redo, flags);
|
|
|
|
/*
|
|
* Select point at which we can truncate the xlog, which we base on the
|
|
* prior checkpoint's earliest info.
|
|
*/
|
|
XLByteToSeg(ControlFile->checkPointCopy.redo, _logSegNo);
|
|
|
|
/*
|
|
* Update pg_control, using current time. Check that it still shows
|
|
* IN_ARCHIVE_RECOVERY state and an older checkpoint, else do nothing;
|
|
* this is a quick hack to make sure nothing really bad happens if somehow
|
|
* we get here after the end-of-recovery checkpoint.
|
|
*/
|
|
LWLockAcquire(ControlFileLock, LW_EXCLUSIVE);
|
|
if (ControlFile->state == DB_IN_ARCHIVE_RECOVERY &&
|
|
XLByteLT(ControlFile->checkPointCopy.redo, lastCheckPoint.redo))
|
|
{
|
|
ControlFile->prevCheckPoint = ControlFile->checkPoint;
|
|
ControlFile->checkPoint = lastCheckPointRecPtr;
|
|
ControlFile->checkPointCopy = lastCheckPoint;
|
|
ControlFile->time = (pg_time_t) time(NULL);
|
|
if (flags & CHECKPOINT_IS_SHUTDOWN)
|
|
ControlFile->state = DB_SHUTDOWNED_IN_RECOVERY;
|
|
UpdateControlFile();
|
|
}
|
|
LWLockRelease(ControlFileLock);
|
|
|
|
/*
|
|
* Delete old log files (those no longer needed even for previous
|
|
* checkpoint/restartpoint) to prevent the disk holding the xlog from
|
|
* growing full.
|
|
*/
|
|
if (_logSegNo)
|
|
{
|
|
XLogRecPtr endptr;
|
|
|
|
/* Get the current (or recent) end of xlog */
|
|
endptr = GetStandbyFlushRecPtr();
|
|
|
|
KeepLogSeg(endptr, &_logSegNo);
|
|
_logSegNo--;
|
|
RemoveOldXlogFiles(_logSegNo, endptr);
|
|
|
|
/*
|
|
* Make more log segments if needed. (Do this after recycling old log
|
|
* segments, since that may supply some of the needed files.)
|
|
*/
|
|
PreallocXlogFiles(endptr);
|
|
}
|
|
|
|
/*
|
|
* Truncate pg_subtrans if possible. We can throw away all data before
|
|
* the oldest XMIN of any running transaction. No future transaction will
|
|
* attempt to reference any pg_subtrans entry older than that (see Asserts
|
|
* in subtrans.c). When hot standby is disabled, though, we mustn't do
|
|
* this because StartupSUBTRANS hasn't been called yet.
|
|
*/
|
|
if (EnableHotStandby)
|
|
TruncateSUBTRANS(GetOldestXmin(true, false));
|
|
|
|
/* Real work is done, but log and update before releasing lock. */
|
|
LogCheckpointEnd(true);
|
|
|
|
xtime = GetLatestXTime();
|
|
ereport((log_checkpoints ? LOG : DEBUG2),
|
|
(errmsg("recovery restart point at %X/%X",
|
|
(uint32) (lastCheckPoint.redo >> 32), (uint32) lastCheckPoint.redo),
|
|
xtime ? errdetail("last completed transaction was at log time %s",
|
|
timestamptz_to_str(xtime)) : 0));
|
|
|
|
LWLockRelease(CheckpointLock);
|
|
|
|
/*
|
|
* Finally, execute archive_cleanup_command, if any.
|
|
*/
|
|
if (XLogCtl->archiveCleanupCommand[0])
|
|
ExecuteRecoveryCommand(XLogCtl->archiveCleanupCommand,
|
|
"archive_cleanup_command",
|
|
false);
|
|
|
|
return true;
|
|
}
|
|
|
|
/*
|
|
* Calculate the last segment that we need to retain because of
|
|
* wal_keep_segments, by subtracting wal_keep_segments from
|
|
* the given xlog location, recptr.
|
|
*/
|
|
static void
|
|
KeepLogSeg(XLogRecPtr recptr, XLogSegNo *logSegNo)
|
|
{
|
|
XLogSegNo segno;
|
|
|
|
if (wal_keep_segments == 0)
|
|
return;
|
|
|
|
XLByteToSeg(recptr, segno);
|
|
|
|
/* avoid underflow, don't go below 1 */
|
|
if (segno <= wal_keep_segments)
|
|
segno = 1;
|
|
else
|
|
segno = *logSegNo - wal_keep_segments;
|
|
|
|
/* don't delete WAL segments newer than the calculated segment */
|
|
if (segno < *logSegNo)
|
|
*logSegNo = segno;
|
|
}
|
|
|
|
/*
|
|
* Write a NEXTOID log record
|
|
*/
|
|
void
|
|
XLogPutNextOid(Oid nextOid)
|
|
{
|
|
XLogRecData rdata;
|
|
|
|
rdata.data = (char *) (&nextOid);
|
|
rdata.len = sizeof(Oid);
|
|
rdata.buffer = InvalidBuffer;
|
|
rdata.next = NULL;
|
|
(void) XLogInsert(RM_XLOG_ID, XLOG_NEXTOID, &rdata);
|
|
|
|
/*
|
|
* We need not flush the NEXTOID record immediately, because any of the
|
|
* just-allocated OIDs could only reach disk as part of a tuple insert or
|
|
* update that would have its own XLOG record that must follow the NEXTOID
|
|
* record. Therefore, the standard buffer LSN interlock applied to those
|
|
* records will ensure no such OID reaches disk before the NEXTOID record
|
|
* does.
|
|
*
|
|
* Note, however, that the above statement only covers state "within" the
|
|
* database. When we use a generated OID as a file or directory name, we
|
|
* are in a sense violating the basic WAL rule, because that filesystem
|
|
* change may reach disk before the NEXTOID WAL record does. The impact
|
|
* of this is that if a database crash occurs immediately afterward, we
|
|
* might after restart re-generate the same OID and find that it conflicts
|
|
* with the leftover file or directory. But since for safety's sake we
|
|
* always loop until finding a nonconflicting filename, this poses no real
|
|
* problem in practice. See pgsql-hackers discussion 27-Sep-2006.
|
|
*/
|
|
}
|
|
|
|
/*
|
|
* Write an XLOG SWITCH record.
|
|
*
|
|
* Here we just blindly issue an XLogInsert request for the record.
|
|
* All the magic happens inside XLogInsert.
|
|
*
|
|
* The return value is either the end+1 address of the switch record,
|
|
* or the end+1 address of the prior segment if we did not need to
|
|
* write a switch record because we are already at segment start.
|
|
*/
|
|
XLogRecPtr
|
|
RequestXLogSwitch(void)
|
|
{
|
|
XLogRecPtr RecPtr;
|
|
XLogRecData rdata;
|
|
|
|
/* XLOG SWITCH, alone among xlog record types, has no data */
|
|
rdata.buffer = InvalidBuffer;
|
|
rdata.data = NULL;
|
|
rdata.len = 0;
|
|
rdata.next = NULL;
|
|
|
|
RecPtr = XLogInsert(RM_XLOG_ID, XLOG_SWITCH, &rdata);
|
|
|
|
return RecPtr;
|
|
}
|
|
|
|
/*
|
|
* Write a RESTORE POINT record
|
|
*/
|
|
XLogRecPtr
|
|
XLogRestorePoint(const char *rpName)
|
|
{
|
|
XLogRecPtr RecPtr;
|
|
XLogRecData rdata;
|
|
xl_restore_point xlrec;
|
|
|
|
xlrec.rp_time = GetCurrentTimestamp();
|
|
strncpy(xlrec.rp_name, rpName, MAXFNAMELEN);
|
|
|
|
rdata.buffer = InvalidBuffer;
|
|
rdata.data = (char *) &xlrec;
|
|
rdata.len = sizeof(xl_restore_point);
|
|
rdata.next = NULL;
|
|
|
|
RecPtr = XLogInsert(RM_XLOG_ID, XLOG_RESTORE_POINT, &rdata);
|
|
|
|
ereport(LOG,
|
|
(errmsg("restore point \"%s\" created at %X/%X",
|
|
rpName, (uint32) (RecPtr >> 32), (uint32) RecPtr)));
|
|
|
|
return RecPtr;
|
|
}
|
|
|
|
/*
|
|
* Check if any of the GUC parameters that are critical for hot standby
|
|
* have changed, and update the value in pg_control file if necessary.
|
|
*/
|
|
static void
|
|
XLogReportParameters(void)
|
|
{
|
|
if (wal_level != ControlFile->wal_level ||
|
|
MaxConnections != ControlFile->MaxConnections ||
|
|
max_prepared_xacts != ControlFile->max_prepared_xacts ||
|
|
max_locks_per_xact != ControlFile->max_locks_per_xact)
|
|
{
|
|
/*
|
|
* The change in number of backend slots doesn't need to be WAL-logged
|
|
* if archiving is not enabled, as you can't start archive recovery
|
|
* with wal_level=minimal anyway. We don't really care about the
|
|
* values in pg_control either if wal_level=minimal, but seems better
|
|
* to keep them up-to-date to avoid confusion.
|
|
*/
|
|
if (wal_level != ControlFile->wal_level || XLogIsNeeded())
|
|
{
|
|
XLogRecData rdata;
|
|
xl_parameter_change xlrec;
|
|
|
|
xlrec.MaxConnections = MaxConnections;
|
|
xlrec.max_prepared_xacts = max_prepared_xacts;
|
|
xlrec.max_locks_per_xact = max_locks_per_xact;
|
|
xlrec.wal_level = wal_level;
|
|
|
|
rdata.buffer = InvalidBuffer;
|
|
rdata.data = (char *) &xlrec;
|
|
rdata.len = sizeof(xlrec);
|
|
rdata.next = NULL;
|
|
|
|
XLogInsert(RM_XLOG_ID, XLOG_PARAMETER_CHANGE, &rdata);
|
|
}
|
|
|
|
ControlFile->MaxConnections = MaxConnections;
|
|
ControlFile->max_prepared_xacts = max_prepared_xacts;
|
|
ControlFile->max_locks_per_xact = max_locks_per_xact;
|
|
ControlFile->wal_level = wal_level;
|
|
UpdateControlFile();
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Update full_page_writes in shared memory, and write an
|
|
* XLOG_FPW_CHANGE record if necessary.
|
|
*
|
|
* Note: this function assumes there is no other process running
|
|
* concurrently that could update it.
|
|
*/
|
|
void
|
|
UpdateFullPageWrites(void)
|
|
{
|
|
XLogCtlInsert *Insert = &XLogCtl->Insert;
|
|
|
|
/*
|
|
* Do nothing if full_page_writes has not been changed.
|
|
*
|
|
* It's safe to check the shared full_page_writes without the lock,
|
|
* because we assume that there is no concurrently running process which
|
|
* can update it.
|
|
*/
|
|
if (fullPageWrites == Insert->fullPageWrites)
|
|
return;
|
|
|
|
START_CRIT_SECTION();
|
|
|
|
/*
|
|
* It's always safe to take full page images, even when not strictly
|
|
* required, but not the other round. So if we're setting full_page_writes
|
|
* to true, first set it true and then write the WAL record. If we're
|
|
* setting it to false, first write the WAL record and then set the global
|
|
* flag.
|
|
*/
|
|
if (fullPageWrites)
|
|
{
|
|
LWLockAcquire(WALInsertLock, LW_EXCLUSIVE);
|
|
Insert->fullPageWrites = true;
|
|
LWLockRelease(WALInsertLock);
|
|
}
|
|
|
|
/*
|
|
* Write an XLOG_FPW_CHANGE record. This allows us to keep track of
|
|
* full_page_writes during archive recovery, if required.
|
|
*/
|
|
if (XLogStandbyInfoActive() && !RecoveryInProgress())
|
|
{
|
|
XLogRecData rdata;
|
|
|
|
rdata.data = (char *) (&fullPageWrites);
|
|
rdata.len = sizeof(bool);
|
|
rdata.buffer = InvalidBuffer;
|
|
rdata.next = NULL;
|
|
|
|
XLogInsert(RM_XLOG_ID, XLOG_FPW_CHANGE, &rdata);
|
|
}
|
|
|
|
if (!fullPageWrites)
|
|
{
|
|
LWLockAcquire(WALInsertLock, LW_EXCLUSIVE);
|
|
Insert->fullPageWrites = false;
|
|
LWLockRelease(WALInsertLock);
|
|
}
|
|
END_CRIT_SECTION();
|
|
}
|
|
|
|
/*
|
|
* Check that it's OK to switch to new timeline during recovery.
|
|
*
|
|
* 'lsn' is the address of the shutdown checkpoint record we're about to
|
|
* replay. (Currently, timeline can only change at a shutdown checkpoint).
|
|
*/
|
|
static void
|
|
checkTimeLineSwitch(XLogRecPtr lsn, TimeLineID newTLI)
|
|
{
|
|
/*
|
|
* The new timeline better be in the list of timelines we expect
|
|
* to see, according to the timeline history. It should also not
|
|
* decrease.
|
|
*/
|
|
if (newTLI < ThisTimeLineID || !tliInHistory(newTLI, expectedTLEs))
|
|
ereport(PANIC,
|
|
(errmsg("unexpected timeline ID %u (after %u) in checkpoint record",
|
|
newTLI, ThisTimeLineID)));
|
|
|
|
/*
|
|
* If we have not yet reached min recovery point, and we're about
|
|
* to switch to a timeline greater than the timeline of the min
|
|
* recovery point: trouble. After switching to the new timeline,
|
|
* we could not possibly visit the min recovery point on the
|
|
* correct timeline anymore. This can happen if there is a newer
|
|
* timeline in the archive that branched before the timeline the
|
|
* min recovery point is on, and you attempt to do PITR to the
|
|
* new timeline.
|
|
*/
|
|
if (!XLogRecPtrIsInvalid(minRecoveryPoint) &&
|
|
XLByteLT(lsn, minRecoveryPoint) &&
|
|
newTLI > minRecoveryPointTLI)
|
|
ereport(PANIC,
|
|
(errmsg("unexpected timeline ID %u in checkpoint record, before reaching minimum recovery point %X/%X on timeline %u",
|
|
newTLI,
|
|
(uint32) (minRecoveryPoint >> 32),
|
|
(uint32) minRecoveryPoint,
|
|
minRecoveryPointTLI)));
|
|
|
|
/* Looks good */
|
|
}
|
|
|
|
/*
|
|
* XLOG resource manager's routines
|
|
*
|
|
* Definitions of info values are in include/catalog/pg_control.h, though
|
|
* not all record types are related to control file updates.
|
|
*/
|
|
void
|
|
xlog_redo(XLogRecPtr lsn, XLogRecord *record)
|
|
{
|
|
uint8 info = record->xl_info & ~XLR_INFO_MASK;
|
|
|
|
/* Backup blocks are not used in xlog records */
|
|
Assert(!(record->xl_info & XLR_BKP_BLOCK_MASK));
|
|
|
|
if (info == XLOG_NEXTOID)
|
|
{
|
|
Oid nextOid;
|
|
|
|
/*
|
|
* We used to try to take the maximum of ShmemVariableCache->nextOid
|
|
* and the recorded nextOid, but that fails if the OID counter wraps
|
|
* around. Since no OID allocation should be happening during replay
|
|
* anyway, better to just believe the record exactly. We still take
|
|
* OidGenLock while setting the variable, just in case.
|
|
*/
|
|
memcpy(&nextOid, XLogRecGetData(record), sizeof(Oid));
|
|
LWLockAcquire(OidGenLock, LW_EXCLUSIVE);
|
|
ShmemVariableCache->nextOid = nextOid;
|
|
ShmemVariableCache->oidCount = 0;
|
|
LWLockRelease(OidGenLock);
|
|
}
|
|
else if (info == XLOG_CHECKPOINT_SHUTDOWN)
|
|
{
|
|
CheckPoint checkPoint;
|
|
|
|
memcpy(&checkPoint, XLogRecGetData(record), sizeof(CheckPoint));
|
|
/* In a SHUTDOWN checkpoint, believe the counters exactly */
|
|
LWLockAcquire(XidGenLock, LW_EXCLUSIVE);
|
|
ShmemVariableCache->nextXid = checkPoint.nextXid;
|
|
LWLockRelease(XidGenLock);
|
|
LWLockAcquire(OidGenLock, LW_EXCLUSIVE);
|
|
ShmemVariableCache->nextOid = checkPoint.nextOid;
|
|
ShmemVariableCache->oidCount = 0;
|
|
LWLockRelease(OidGenLock);
|
|
MultiXactSetNextMXact(checkPoint.nextMulti,
|
|
checkPoint.nextMultiOffset);
|
|
SetTransactionIdLimit(checkPoint.oldestXid, checkPoint.oldestXidDB);
|
|
|
|
/*
|
|
* If we see a shutdown checkpoint while waiting for an end-of-backup
|
|
* record, the backup was canceled and the end-of-backup record will
|
|
* never arrive.
|
|
*/
|
|
if (InArchiveRecovery &&
|
|
!XLogRecPtrIsInvalid(ControlFile->backupStartPoint) &&
|
|
XLogRecPtrIsInvalid(ControlFile->backupEndPoint))
|
|
ereport(PANIC,
|
|
(errmsg("online backup was canceled, recovery cannot continue")));
|
|
|
|
/*
|
|
* If we see a shutdown checkpoint, we know that nothing was running
|
|
* on the master at this point. So fake-up an empty running-xacts
|
|
* record and use that here and now. Recover additional standby state
|
|
* for prepared transactions.
|
|
*/
|
|
if (standbyState >= STANDBY_INITIALIZED)
|
|
{
|
|
TransactionId *xids;
|
|
int nxids;
|
|
TransactionId oldestActiveXID;
|
|
TransactionId latestCompletedXid;
|
|
RunningTransactionsData running;
|
|
|
|
oldestActiveXID = PrescanPreparedTransactions(&xids, &nxids);
|
|
|
|
/*
|
|
* Construct a RunningTransactions snapshot representing a shut
|
|
* down server, with only prepared transactions still alive. We're
|
|
* never overflowed at this point because all subxids are listed
|
|
* with their parent prepared transactions.
|
|
*/
|
|
running.xcnt = nxids;
|
|
running.subxcnt = 0;
|
|
running.subxid_overflow = false;
|
|
running.nextXid = checkPoint.nextXid;
|
|
running.oldestRunningXid = oldestActiveXID;
|
|
latestCompletedXid = checkPoint.nextXid;
|
|
TransactionIdRetreat(latestCompletedXid);
|
|
Assert(TransactionIdIsNormal(latestCompletedXid));
|
|
running.latestCompletedXid = latestCompletedXid;
|
|
running.xids = xids;
|
|
|
|
ProcArrayApplyRecoveryInfo(&running);
|
|
|
|
StandbyRecoverPreparedTransactions(true);
|
|
}
|
|
|
|
/* ControlFile->checkPointCopy always tracks the latest ckpt XID */
|
|
ControlFile->checkPointCopy.nextXidEpoch = checkPoint.nextXidEpoch;
|
|
ControlFile->checkPointCopy.nextXid = checkPoint.nextXid;
|
|
|
|
/* Update shared-memory copy of checkpoint XID/epoch */
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->ckptXidEpoch = checkPoint.nextXidEpoch;
|
|
xlogctl->ckptXid = checkPoint.nextXid;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/*
|
|
* We should've already switched to the new TLI before replaying this
|
|
* record.
|
|
*/
|
|
if (checkPoint.ThisTimeLineID != ThisTimeLineID)
|
|
ereport(PANIC,
|
|
(errmsg("unexpected timeline ID %u (should be %u) in checkpoint record",
|
|
checkPoint.ThisTimeLineID, ThisTimeLineID)));
|
|
|
|
RecoveryRestartPoint(&checkPoint);
|
|
}
|
|
else if (info == XLOG_CHECKPOINT_ONLINE)
|
|
{
|
|
CheckPoint checkPoint;
|
|
|
|
memcpy(&checkPoint, XLogRecGetData(record), sizeof(CheckPoint));
|
|
/* In an ONLINE checkpoint, treat the XID counter as a minimum */
|
|
LWLockAcquire(XidGenLock, LW_EXCLUSIVE);
|
|
if (TransactionIdPrecedes(ShmemVariableCache->nextXid,
|
|
checkPoint.nextXid))
|
|
ShmemVariableCache->nextXid = checkPoint.nextXid;
|
|
LWLockRelease(XidGenLock);
|
|
/* ... but still treat OID counter as exact */
|
|
LWLockAcquire(OidGenLock, LW_EXCLUSIVE);
|
|
ShmemVariableCache->nextOid = checkPoint.nextOid;
|
|
ShmemVariableCache->oidCount = 0;
|
|
LWLockRelease(OidGenLock);
|
|
MultiXactAdvanceNextMXact(checkPoint.nextMulti,
|
|
checkPoint.nextMultiOffset);
|
|
if (TransactionIdPrecedes(ShmemVariableCache->oldestXid,
|
|
checkPoint.oldestXid))
|
|
SetTransactionIdLimit(checkPoint.oldestXid,
|
|
checkPoint.oldestXidDB);
|
|
|
|
/* ControlFile->checkPointCopy always tracks the latest ckpt XID */
|
|
ControlFile->checkPointCopy.nextXidEpoch = checkPoint.nextXidEpoch;
|
|
ControlFile->checkPointCopy.nextXid = checkPoint.nextXid;
|
|
|
|
/* Update shared-memory copy of checkpoint XID/epoch */
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->ckptXidEpoch = checkPoint.nextXidEpoch;
|
|
xlogctl->ckptXid = checkPoint.nextXid;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/* TLI should not change in an on-line checkpoint */
|
|
if (checkPoint.ThisTimeLineID != ThisTimeLineID)
|
|
ereport(PANIC,
|
|
(errmsg("unexpected timeline ID %u (should be %u) in checkpoint record",
|
|
checkPoint.ThisTimeLineID, ThisTimeLineID)));
|
|
|
|
RecoveryRestartPoint(&checkPoint);
|
|
}
|
|
else if (info == XLOG_NOOP)
|
|
{
|
|
/* nothing to do here */
|
|
}
|
|
else if (info == XLOG_SWITCH)
|
|
{
|
|
/* nothing to do here */
|
|
}
|
|
else if (info == XLOG_RESTORE_POINT)
|
|
{
|
|
/* nothing to do here */
|
|
}
|
|
else if (info == XLOG_BACKUP_END)
|
|
{
|
|
XLogRecPtr startpoint;
|
|
|
|
memcpy(&startpoint, XLogRecGetData(record), sizeof(startpoint));
|
|
|
|
if (XLByteEQ(ControlFile->backupStartPoint, startpoint))
|
|
{
|
|
/*
|
|
* We have reached the end of base backup, the point where
|
|
* pg_stop_backup() was done. The data on disk is now consistent.
|
|
* Reset backupStartPoint, and update minRecoveryPoint to make
|
|
* sure we don't allow starting up at an earlier point even if
|
|
* recovery is stopped and restarted soon after this.
|
|
*/
|
|
elog(DEBUG1, "end of backup reached");
|
|
|
|
LWLockAcquire(ControlFileLock, LW_EXCLUSIVE);
|
|
|
|
if (XLByteLT(ControlFile->minRecoveryPoint, lsn))
|
|
{
|
|
ControlFile->minRecoveryPoint = lsn;
|
|
ControlFile->minRecoveryPointTLI = ThisTimeLineID;
|
|
}
|
|
MemSet(&ControlFile->backupStartPoint, 0, sizeof(XLogRecPtr));
|
|
ControlFile->backupEndRequired = false;
|
|
UpdateControlFile();
|
|
|
|
LWLockRelease(ControlFileLock);
|
|
}
|
|
}
|
|
else if (info == XLOG_PARAMETER_CHANGE)
|
|
{
|
|
xl_parameter_change xlrec;
|
|
|
|
/* Update our copy of the parameters in pg_control */
|
|
memcpy(&xlrec, XLogRecGetData(record), sizeof(xl_parameter_change));
|
|
|
|
LWLockAcquire(ControlFileLock, LW_EXCLUSIVE);
|
|
ControlFile->MaxConnections = xlrec.MaxConnections;
|
|
ControlFile->max_prepared_xacts = xlrec.max_prepared_xacts;
|
|
ControlFile->max_locks_per_xact = xlrec.max_locks_per_xact;
|
|
ControlFile->wal_level = xlrec.wal_level;
|
|
|
|
/*
|
|
* Update minRecoveryPoint to ensure that if recovery is aborted, we
|
|
* recover back up to this point before allowing hot standby again.
|
|
* This is particularly important if wal_level was set to 'archive'
|
|
* before, and is now 'hot_standby', to ensure you don't run queries
|
|
* against the WAL preceding the wal_level change. Same applies to
|
|
* decreasing max_* settings.
|
|
*/
|
|
minRecoveryPoint = ControlFile->minRecoveryPoint;
|
|
minRecoveryPointTLI = ControlFile->minRecoveryPointTLI;
|
|
if (minRecoveryPoint != 0 && XLByteLT(minRecoveryPoint, lsn))
|
|
{
|
|
ControlFile->minRecoveryPoint = lsn;
|
|
ControlFile->minRecoveryPointTLI = ThisTimeLineID;
|
|
}
|
|
|
|
UpdateControlFile();
|
|
LWLockRelease(ControlFileLock);
|
|
|
|
/* Check to see if any changes to max_connections give problems */
|
|
CheckRequiredParameterValues();
|
|
}
|
|
else if (info == XLOG_FPW_CHANGE)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
bool fpw;
|
|
|
|
memcpy(&fpw, XLogRecGetData(record), sizeof(bool));
|
|
|
|
/*
|
|
* Update the LSN of the last replayed XLOG_FPW_CHANGE record so that
|
|
* do_pg_start_backup() and do_pg_stop_backup() can check whether
|
|
* full_page_writes has been disabled during online backup.
|
|
*/
|
|
if (!fpw)
|
|
{
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
if (XLByteLT(xlogctl->lastFpwDisableRecPtr, ReadRecPtr))
|
|
xlogctl->lastFpwDisableRecPtr = ReadRecPtr;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
/* Keep track of full_page_writes */
|
|
lastFullPageWrites = fpw;
|
|
}
|
|
}
|
|
|
|
#ifdef WAL_DEBUG
|
|
|
|
static void
|
|
xlog_outrec(StringInfo buf, XLogRecord *record)
|
|
{
|
|
int i;
|
|
|
|
appendStringInfo(buf, "prev %X/%X; xid %u",
|
|
(uint32) (record->xl_prev >> 32),
|
|
(uint32) record->xl_prev,
|
|
record->xl_xid);
|
|
|
|
appendStringInfo(buf, "; len %u",
|
|
record->xl_len);
|
|
|
|
for (i = 0; i < XLR_MAX_BKP_BLOCKS; i++)
|
|
{
|
|
if (record->xl_info & XLR_BKP_BLOCK(i))
|
|
appendStringInfo(buf, "; bkpb%d", i);
|
|
}
|
|
|
|
appendStringInfo(buf, ": %s", RmgrTable[record->xl_rmid].rm_name);
|
|
}
|
|
#endif /* WAL_DEBUG */
|
|
|
|
|
|
/*
|
|
* Return the (possible) sync flag used for opening a file, depending on the
|
|
* value of the GUC wal_sync_method.
|
|
*/
|
|
static int
|
|
get_sync_bit(int method)
|
|
{
|
|
int o_direct_flag = 0;
|
|
|
|
/* If fsync is disabled, never open in sync mode */
|
|
if (!enableFsync)
|
|
return 0;
|
|
|
|
/*
|
|
* Optimize writes by bypassing kernel cache with O_DIRECT when using
|
|
* O_SYNC/O_FSYNC and O_DSYNC. But only if archiving and streaming are
|
|
* disabled, otherwise the archive command or walsender process will read
|
|
* the WAL soon after writing it, which is guaranteed to cause a physical
|
|
* read if we bypassed the kernel cache. We also skip the
|
|
* posix_fadvise(POSIX_FADV_DONTNEED) call in XLogFileClose() for the same
|
|
* reason.
|
|
*
|
|
* Never use O_DIRECT in walreceiver process for similar reasons; the WAL
|
|
* written by walreceiver is normally read by the startup process soon
|
|
* after its written. Also, walreceiver performs unaligned writes, which
|
|
* don't work with O_DIRECT, so it is required for correctness too.
|
|
*/
|
|
if (!XLogIsNeeded() && !AmWalReceiverProcess())
|
|
o_direct_flag = PG_O_DIRECT;
|
|
|
|
switch (method)
|
|
{
|
|
/*
|
|
* enum values for all sync options are defined even if they are
|
|
* not supported on the current platform. But if not, they are
|
|
* not included in the enum option array, and therefore will never
|
|
* be seen here.
|
|
*/
|
|
case SYNC_METHOD_FSYNC:
|
|
case SYNC_METHOD_FSYNC_WRITETHROUGH:
|
|
case SYNC_METHOD_FDATASYNC:
|
|
return 0;
|
|
#ifdef OPEN_SYNC_FLAG
|
|
case SYNC_METHOD_OPEN:
|
|
return OPEN_SYNC_FLAG | o_direct_flag;
|
|
#endif
|
|
#ifdef OPEN_DATASYNC_FLAG
|
|
case SYNC_METHOD_OPEN_DSYNC:
|
|
return OPEN_DATASYNC_FLAG | o_direct_flag;
|
|
#endif
|
|
default:
|
|
/* can't happen (unless we are out of sync with option array) */
|
|
elog(ERROR, "unrecognized wal_sync_method: %d", method);
|
|
return 0; /* silence warning */
|
|
}
|
|
}
|
|
|
|
/*
|
|
* GUC support
|
|
*/
|
|
void
|
|
assign_xlog_sync_method(int new_sync_method, void *extra)
|
|
{
|
|
if (sync_method != new_sync_method)
|
|
{
|
|
/*
|
|
* To ensure that no blocks escape unsynced, force an fsync on the
|
|
* currently open log segment (if any). Also, if the open flag is
|
|
* changing, close the log file so it will be reopened (with new flag
|
|
* bit) at next use.
|
|
*/
|
|
if (openLogFile >= 0)
|
|
{
|
|
if (pg_fsync(openLogFile) != 0)
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not fsync log segment %s: %m",
|
|
XLogFileNameP(ThisTimeLineID, openLogSegNo))));
|
|
if (get_sync_bit(sync_method) != get_sync_bit(new_sync_method))
|
|
XLogFileClose();
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
/*
|
|
* Issue appropriate kind of fsync (if any) for an XLOG output file.
|
|
*
|
|
* 'fd' is a file descriptor for the XLOG file to be fsync'd.
|
|
* 'log' and 'seg' are for error reporting purposes.
|
|
*/
|
|
void
|
|
issue_xlog_fsync(int fd, XLogSegNo segno)
|
|
{
|
|
switch (sync_method)
|
|
{
|
|
case SYNC_METHOD_FSYNC:
|
|
if (pg_fsync_no_writethrough(fd) != 0)
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not fsync log file %s: %m",
|
|
XLogFileNameP(ThisTimeLineID, segno))));
|
|
break;
|
|
#ifdef HAVE_FSYNC_WRITETHROUGH
|
|
case SYNC_METHOD_FSYNC_WRITETHROUGH:
|
|
if (pg_fsync_writethrough(fd) != 0)
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not fsync write-through log file %s: %m",
|
|
XLogFileNameP(ThisTimeLineID, segno))));
|
|
break;
|
|
#endif
|
|
#ifdef HAVE_FDATASYNC
|
|
case SYNC_METHOD_FDATASYNC:
|
|
if (pg_fdatasync(fd) != 0)
|
|
ereport(PANIC,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not fdatasync log file %s: %m",
|
|
XLogFileNameP(ThisTimeLineID, segno))));
|
|
break;
|
|
#endif
|
|
case SYNC_METHOD_OPEN:
|
|
case SYNC_METHOD_OPEN_DSYNC:
|
|
/* write synced it already */
|
|
break;
|
|
default:
|
|
elog(PANIC, "unrecognized wal_sync_method: %d", sync_method);
|
|
break;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Return the filename of given log segment, as a palloc'd string.
|
|
*/
|
|
char *
|
|
XLogFileNameP(TimeLineID tli, XLogSegNo segno)
|
|
{
|
|
char *result = palloc(MAXFNAMELEN);
|
|
XLogFileName(result, tli, segno);
|
|
return result;
|
|
}
|
|
|
|
/*
|
|
* do_pg_start_backup is the workhorse of the user-visible pg_start_backup()
|
|
* function. It creates the necessary starting checkpoint and constructs the
|
|
* backup label file.
|
|
*
|
|
* There are two kind of backups: exclusive and non-exclusive. An exclusive
|
|
* backup is started with pg_start_backup(), and there can be only one active
|
|
* at a time. The backup label file of an exclusive backup is written to
|
|
* $PGDATA/backup_label, and it is removed by pg_stop_backup().
|
|
*
|
|
* A non-exclusive backup is used for the streaming base backups (see
|
|
* src/backend/replication/basebackup.c). The difference to exclusive backups
|
|
* is that the backup label file is not written to disk. Instead, its would-be
|
|
* contents are returned in *labelfile, and the caller is responsible for
|
|
* including it in the backup archive as 'backup_label'. There can be many
|
|
* non-exclusive backups active at the same time, and they don't conflict
|
|
* with an exclusive backup either.
|
|
*
|
|
* Every successfully started non-exclusive backup must be stopped by calling
|
|
* do_pg_stop_backup() or do_pg_abort_backup().
|
|
*/
|
|
XLogRecPtr
|
|
do_pg_start_backup(const char *backupidstr, bool fast, char **labelfile)
|
|
{
|
|
bool exclusive = (labelfile == NULL);
|
|
bool backup_started_in_recovery = false;
|
|
XLogRecPtr checkpointloc;
|
|
XLogRecPtr startpoint;
|
|
pg_time_t stamp_time;
|
|
char strfbuf[128];
|
|
char xlogfilename[MAXFNAMELEN];
|
|
XLogSegNo _logSegNo;
|
|
struct stat stat_buf;
|
|
FILE *fp;
|
|
StringInfoData labelfbuf;
|
|
|
|
backup_started_in_recovery = RecoveryInProgress();
|
|
|
|
if (!superuser() && !is_authenticated_user_replication_role())
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
|
|
errmsg("must be superuser or replication role to run a backup")));
|
|
|
|
/*
|
|
* Currently only non-exclusive backup can be taken during recovery.
|
|
*/
|
|
if (backup_started_in_recovery && exclusive)
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("recovery is in progress"),
|
|
errhint("WAL control functions cannot be executed during recovery.")));
|
|
|
|
/*
|
|
* During recovery, we don't need to check WAL level. Because, if WAL
|
|
* level is not sufficient, it's impossible to get here during recovery.
|
|
*/
|
|
if (!backup_started_in_recovery && !XLogIsNeeded())
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("WAL level not sufficient for making an online backup"),
|
|
errhint("wal_level must be set to \"archive\" or \"hot_standby\" at server start.")));
|
|
|
|
if (strlen(backupidstr) > MAXPGPATH)
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
|
|
errmsg("backup label too long (max %d bytes)",
|
|
MAXPGPATH)));
|
|
|
|
/*
|
|
* Mark backup active in shared memory. We must do full-page WAL writes
|
|
* during an on-line backup even if not doing so at other times, because
|
|
* it's quite possible for the backup dump to obtain a "torn" (partially
|
|
* written) copy of a database page if it reads the page concurrently with
|
|
* our write to the same page. This can be fixed as long as the first
|
|
* write to the page in the WAL sequence is a full-page write. Hence, we
|
|
* turn on forcePageWrites and then force a CHECKPOINT, to ensure there
|
|
* are no dirty pages in shared memory that might get dumped while the
|
|
* backup is in progress without having a corresponding WAL record. (Once
|
|
* the backup is complete, we need not force full-page writes anymore,
|
|
* since we expect that any pages not modified during the backup interval
|
|
* must have been correctly captured by the backup.)
|
|
*
|
|
* Note that forcePageWrites has no effect during an online backup from
|
|
* the standby.
|
|
*
|
|
* We must hold WALInsertLock to change the value of forcePageWrites, to
|
|
* ensure adequate interlocking against XLogInsert().
|
|
*/
|
|
LWLockAcquire(WALInsertLock, LW_EXCLUSIVE);
|
|
if (exclusive)
|
|
{
|
|
if (XLogCtl->Insert.exclusiveBackup)
|
|
{
|
|
LWLockRelease(WALInsertLock);
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("a backup is already in progress"),
|
|
errhint("Run pg_stop_backup() and try again.")));
|
|
}
|
|
XLogCtl->Insert.exclusiveBackup = true;
|
|
}
|
|
else
|
|
XLogCtl->Insert.nonExclusiveBackups++;
|
|
XLogCtl->Insert.forcePageWrites = true;
|
|
LWLockRelease(WALInsertLock);
|
|
|
|
/* Ensure we release forcePageWrites if fail below */
|
|
PG_ENSURE_ERROR_CLEANUP(pg_start_backup_callback, (Datum) BoolGetDatum(exclusive));
|
|
{
|
|
bool gotUniqueStartpoint = false;
|
|
|
|
/*
|
|
* Force an XLOG file switch before the checkpoint, to ensure that the
|
|
* WAL segment the checkpoint is written to doesn't contain pages with
|
|
* old timeline IDs. That would otherwise happen if you called
|
|
* pg_start_backup() right after restoring from a PITR archive: the
|
|
* first WAL segment containing the startup checkpoint has pages in
|
|
* the beginning with the old timeline ID. That can cause trouble at
|
|
* recovery: we won't have a history file covering the old timeline if
|
|
* pg_xlog directory was not included in the base backup and the WAL
|
|
* archive was cleared too before starting the backup.
|
|
*
|
|
* This also ensures that we have emitted a WAL page header that has
|
|
* XLP_BKP_REMOVABLE off before we emit the checkpoint record.
|
|
* Therefore, if a WAL archiver (such as pglesslog) is trying to
|
|
* compress out removable backup blocks, it won't remove any that
|
|
* occur after this point.
|
|
*
|
|
* During recovery, we skip forcing XLOG file switch, which means that
|
|
* the backup taken during recovery is not available for the special
|
|
* recovery case described above.
|
|
*/
|
|
if (!backup_started_in_recovery)
|
|
RequestXLogSwitch();
|
|
|
|
do
|
|
{
|
|
bool checkpointfpw;
|
|
|
|
/*
|
|
* Force a CHECKPOINT. Aside from being necessary to prevent torn
|
|
* page problems, this guarantees that two successive backup runs
|
|
* will have different checkpoint positions and hence different
|
|
* history file names, even if nothing happened in between.
|
|
*
|
|
* During recovery, establish a restartpoint if possible. We use
|
|
* the last restartpoint as the backup starting checkpoint. This
|
|
* means that two successive backup runs can have same checkpoint
|
|
* positions.
|
|
*
|
|
* Since the fact that we are executing do_pg_start_backup()
|
|
* during recovery means that checkpointer is running, we can use
|
|
* RequestCheckpoint() to establish a restartpoint.
|
|
*
|
|
* We use CHECKPOINT_IMMEDIATE only if requested by user (via
|
|
* passing fast = true). Otherwise this can take awhile.
|
|
*/
|
|
RequestCheckpoint(CHECKPOINT_FORCE | CHECKPOINT_WAIT |
|
|
(fast ? CHECKPOINT_IMMEDIATE : 0));
|
|
|
|
/*
|
|
* Now we need to fetch the checkpoint record location, and also
|
|
* its REDO pointer. The oldest point in WAL that would be needed
|
|
* to restore starting from the checkpoint is precisely the REDO
|
|
* pointer.
|
|
*/
|
|
LWLockAcquire(ControlFileLock, LW_SHARED);
|
|
checkpointloc = ControlFile->checkPoint;
|
|
startpoint = ControlFile->checkPointCopy.redo;
|
|
checkpointfpw = ControlFile->checkPointCopy.fullPageWrites;
|
|
LWLockRelease(ControlFileLock);
|
|
|
|
if (backup_started_in_recovery)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
XLogRecPtr recptr;
|
|
|
|
/*
|
|
* Check to see if all WAL replayed during online backup
|
|
* (i.e., since last restartpoint used as backup starting
|
|
* checkpoint) contain full-page writes.
|
|
*/
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
recptr = xlogctl->lastFpwDisableRecPtr;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
if (!checkpointfpw || XLByteLE(startpoint, recptr))
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("WAL generated with full_page_writes=off was replayed "
|
|
"since last restartpoint"),
|
|
errhint("This means that the backup being taken on standby "
|
|
"is corrupt and should not be used. "
|
|
"Enable full_page_writes and run CHECKPOINT on the master, "
|
|
"and then try an online backup again.")));
|
|
|
|
/*
|
|
* During recovery, since we don't use the end-of-backup WAL
|
|
* record and don't write the backup history file, the
|
|
* starting WAL location doesn't need to be unique. This means
|
|
* that two base backups started at the same time might use
|
|
* the same checkpoint as starting locations.
|
|
*/
|
|
gotUniqueStartpoint = true;
|
|
}
|
|
|
|
/*
|
|
* If two base backups are started at the same time (in WAL sender
|
|
* processes), we need to make sure that they use different
|
|
* checkpoints as starting locations, because we use the starting
|
|
* WAL location as a unique identifier for the base backup in the
|
|
* end-of-backup WAL record and when we write the backup history
|
|
* file. Perhaps it would be better generate a separate unique ID
|
|
* for each backup instead of forcing another checkpoint, but
|
|
* taking a checkpoint right after another is not that expensive
|
|
* either because only few buffers have been dirtied yet.
|
|
*/
|
|
LWLockAcquire(WALInsertLock, LW_SHARED);
|
|
if (XLByteLT(XLogCtl->Insert.lastBackupStart, startpoint))
|
|
{
|
|
XLogCtl->Insert.lastBackupStart = startpoint;
|
|
gotUniqueStartpoint = true;
|
|
}
|
|
LWLockRelease(WALInsertLock);
|
|
} while (!gotUniqueStartpoint);
|
|
|
|
XLByteToSeg(startpoint, _logSegNo);
|
|
XLogFileName(xlogfilename, ThisTimeLineID, _logSegNo);
|
|
|
|
/*
|
|
* Construct backup label file
|
|
*/
|
|
initStringInfo(&labelfbuf);
|
|
|
|
/* Use the log timezone here, not the session timezone */
|
|
stamp_time = (pg_time_t) time(NULL);
|
|
pg_strftime(strfbuf, sizeof(strfbuf),
|
|
"%Y-%m-%d %H:%M:%S %Z",
|
|
pg_localtime(&stamp_time, log_timezone));
|
|
appendStringInfo(&labelfbuf, "START WAL LOCATION: %X/%X (file %s)\n",
|
|
(uint32) (startpoint >> 32), (uint32) startpoint, xlogfilename);
|
|
appendStringInfo(&labelfbuf, "CHECKPOINT LOCATION: %X/%X\n",
|
|
(uint32) (checkpointloc >> 32), (uint32) checkpointloc);
|
|
appendStringInfo(&labelfbuf, "BACKUP METHOD: %s\n",
|
|
exclusive ? "pg_start_backup" : "streamed");
|
|
appendStringInfo(&labelfbuf, "BACKUP FROM: %s\n",
|
|
backup_started_in_recovery ? "standby" : "master");
|
|
appendStringInfo(&labelfbuf, "START TIME: %s\n", strfbuf);
|
|
appendStringInfo(&labelfbuf, "LABEL: %s\n", backupidstr);
|
|
|
|
/*
|
|
* Okay, write the file, or return its contents to caller.
|
|
*/
|
|
if (exclusive)
|
|
{
|
|
/*
|
|
* Check for existing backup label --- implies a backup is already
|
|
* running. (XXX given that we checked exclusiveBackup above,
|
|
* maybe it would be OK to just unlink any such label file?)
|
|
*/
|
|
if (stat(BACKUP_LABEL_FILE, &stat_buf) != 0)
|
|
{
|
|
if (errno != ENOENT)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not stat file \"%s\": %m",
|
|
BACKUP_LABEL_FILE)));
|
|
}
|
|
else
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("a backup is already in progress"),
|
|
errhint("If you're sure there is no backup in progress, remove file \"%s\" and try again.",
|
|
BACKUP_LABEL_FILE)));
|
|
|
|
fp = AllocateFile(BACKUP_LABEL_FILE, "w");
|
|
|
|
if (!fp)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not create file \"%s\": %m",
|
|
BACKUP_LABEL_FILE)));
|
|
if (fwrite(labelfbuf.data, labelfbuf.len, 1, fp) != 1 ||
|
|
fflush(fp) != 0 ||
|
|
pg_fsync(fileno(fp)) != 0 ||
|
|
ferror(fp) ||
|
|
FreeFile(fp))
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not write file \"%s\": %m",
|
|
BACKUP_LABEL_FILE)));
|
|
pfree(labelfbuf.data);
|
|
}
|
|
else
|
|
*labelfile = labelfbuf.data;
|
|
}
|
|
PG_END_ENSURE_ERROR_CLEANUP(pg_start_backup_callback, (Datum) BoolGetDatum(exclusive));
|
|
|
|
/*
|
|
* We're done. As a convenience, return the starting WAL location.
|
|
*/
|
|
return startpoint;
|
|
}
|
|
|
|
/* Error cleanup callback for pg_start_backup */
|
|
static void
|
|
pg_start_backup_callback(int code, Datum arg)
|
|
{
|
|
bool exclusive = DatumGetBool(arg);
|
|
|
|
/* Update backup counters and forcePageWrites on failure */
|
|
LWLockAcquire(WALInsertLock, LW_EXCLUSIVE);
|
|
if (exclusive)
|
|
{
|
|
Assert(XLogCtl->Insert.exclusiveBackup);
|
|
XLogCtl->Insert.exclusiveBackup = false;
|
|
}
|
|
else
|
|
{
|
|
Assert(XLogCtl->Insert.nonExclusiveBackups > 0);
|
|
XLogCtl->Insert.nonExclusiveBackups--;
|
|
}
|
|
|
|
if (!XLogCtl->Insert.exclusiveBackup &&
|
|
XLogCtl->Insert.nonExclusiveBackups == 0)
|
|
{
|
|
XLogCtl->Insert.forcePageWrites = false;
|
|
}
|
|
LWLockRelease(WALInsertLock);
|
|
}
|
|
|
|
/*
|
|
* do_pg_stop_backup is the workhorse of the user-visible pg_stop_backup()
|
|
* function.
|
|
|
|
* If labelfile is NULL, this stops an exclusive backup. Otherwise this stops
|
|
* the non-exclusive backup specified by 'labelfile'.
|
|
*/
|
|
XLogRecPtr
|
|
do_pg_stop_backup(char *labelfile, bool waitforarchive)
|
|
{
|
|
bool exclusive = (labelfile == NULL);
|
|
bool backup_started_in_recovery = false;
|
|
XLogRecPtr startpoint;
|
|
XLogRecPtr stoppoint;
|
|
XLogRecData rdata;
|
|
pg_time_t stamp_time;
|
|
char strfbuf[128];
|
|
char histfilepath[MAXPGPATH];
|
|
char startxlogfilename[MAXFNAMELEN];
|
|
char stopxlogfilename[MAXFNAMELEN];
|
|
char lastxlogfilename[MAXFNAMELEN];
|
|
char histfilename[MAXFNAMELEN];
|
|
char backupfrom[20];
|
|
XLogSegNo _logSegNo;
|
|
FILE *lfp;
|
|
FILE *fp;
|
|
char ch;
|
|
int seconds_before_warning;
|
|
int waits = 0;
|
|
bool reported_waiting = false;
|
|
char *remaining;
|
|
char *ptr;
|
|
uint32 hi,
|
|
lo;
|
|
|
|
backup_started_in_recovery = RecoveryInProgress();
|
|
|
|
if (!superuser() && !is_authenticated_user_replication_role())
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
|
|
(errmsg("must be superuser or replication role to run a backup"))));
|
|
|
|
/*
|
|
* Currently only non-exclusive backup can be taken during recovery.
|
|
*/
|
|
if (backup_started_in_recovery && exclusive)
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("recovery is in progress"),
|
|
errhint("WAL control functions cannot be executed during recovery.")));
|
|
|
|
/*
|
|
* During recovery, we don't need to check WAL level. Because, if WAL
|
|
* level is not sufficient, it's impossible to get here during recovery.
|
|
*/
|
|
if (!backup_started_in_recovery && !XLogIsNeeded())
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("WAL level not sufficient for making an online backup"),
|
|
errhint("wal_level must be set to \"archive\" or \"hot_standby\" at server start.")));
|
|
|
|
/*
|
|
* OK to update backup counters and forcePageWrites
|
|
*/
|
|
LWLockAcquire(WALInsertLock, LW_EXCLUSIVE);
|
|
if (exclusive)
|
|
XLogCtl->Insert.exclusiveBackup = false;
|
|
else
|
|
{
|
|
/*
|
|
* The user-visible pg_start/stop_backup() functions that operate on
|
|
* exclusive backups can be called at any time, but for non-exclusive
|
|
* backups, it is expected that each do_pg_start_backup() call is
|
|
* matched by exactly one do_pg_stop_backup() call.
|
|
*/
|
|
Assert(XLogCtl->Insert.nonExclusiveBackups > 0);
|
|
XLogCtl->Insert.nonExclusiveBackups--;
|
|
}
|
|
|
|
if (!XLogCtl->Insert.exclusiveBackup &&
|
|
XLogCtl->Insert.nonExclusiveBackups == 0)
|
|
{
|
|
XLogCtl->Insert.forcePageWrites = false;
|
|
}
|
|
LWLockRelease(WALInsertLock);
|
|
|
|
if (exclusive)
|
|
{
|
|
/*
|
|
* Read the existing label file into memory.
|
|
*/
|
|
struct stat statbuf;
|
|
int r;
|
|
|
|
if (stat(BACKUP_LABEL_FILE, &statbuf))
|
|
{
|
|
if (errno != ENOENT)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not stat file \"%s\": %m",
|
|
BACKUP_LABEL_FILE)));
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("a backup is not in progress")));
|
|
}
|
|
|
|
lfp = AllocateFile(BACKUP_LABEL_FILE, "r");
|
|
if (!lfp)
|
|
{
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not read file \"%s\": %m",
|
|
BACKUP_LABEL_FILE)));
|
|
}
|
|
labelfile = palloc(statbuf.st_size + 1);
|
|
r = fread(labelfile, statbuf.st_size, 1, lfp);
|
|
labelfile[statbuf.st_size] = '\0';
|
|
|
|
/*
|
|
* Close and remove the backup label file
|
|
*/
|
|
if (r != 1 || ferror(lfp) || FreeFile(lfp))
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not read file \"%s\": %m",
|
|
BACKUP_LABEL_FILE)));
|
|
if (unlink(BACKUP_LABEL_FILE) != 0)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not remove file \"%s\": %m",
|
|
BACKUP_LABEL_FILE)));
|
|
}
|
|
|
|
/*
|
|
* Read and parse the START WAL LOCATION line (this code is pretty crude,
|
|
* but we are not expecting any variability in the file format).
|
|
*/
|
|
if (sscanf(labelfile, "START WAL LOCATION: %X/%X (file %24s)%c",
|
|
&hi, &lo, startxlogfilename,
|
|
&ch) != 4 || ch != '\n')
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("invalid data in file \"%s\"", BACKUP_LABEL_FILE)));
|
|
startpoint = ((uint64) hi) << 32 | lo;
|
|
remaining = strchr(labelfile, '\n') + 1; /* %n is not portable enough */
|
|
|
|
/*
|
|
* Parse the BACKUP FROM line. If we are taking an online backup from the
|
|
* standby, we confirm that the standby has not been promoted during the
|
|
* backup.
|
|
*/
|
|
ptr = strstr(remaining, "BACKUP FROM:");
|
|
if (!ptr || sscanf(ptr, "BACKUP FROM: %19s\n", backupfrom) != 1)
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("invalid data in file \"%s\"", BACKUP_LABEL_FILE)));
|
|
if (strcmp(backupfrom, "standby") == 0 && !backup_started_in_recovery)
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("the standby was promoted during online backup"),
|
|
errhint("This means that the backup being taken is corrupt "
|
|
"and should not be used. "
|
|
"Try taking another online backup.")));
|
|
|
|
/*
|
|
* During recovery, we don't write an end-of-backup record. We assume that
|
|
* pg_control was backed up last and its minimum recovery point can be
|
|
* available as the backup end location. Since we don't have an
|
|
* end-of-backup record, we use the pg_control value to check whether
|
|
* we've reached the end of backup when starting recovery from this
|
|
* backup. We have no way of checking if pg_control wasn't backed up last
|
|
* however.
|
|
*
|
|
* We don't force a switch to new WAL file and wait for all the required
|
|
* files to be archived. This is okay if we use the backup to start the
|
|
* standby. But, if it's for an archive recovery, to ensure all the
|
|
* required files are available, a user should wait for them to be
|
|
* archived, or include them into the backup.
|
|
*
|
|
* We return the current minimum recovery point as the backup end
|
|
* location. Note that it can be greater than the exact backup end
|
|
* location if the minimum recovery point is updated after the backup of
|
|
* pg_control. This is harmless for current uses.
|
|
*
|
|
* XXX currently a backup history file is for informational and debug
|
|
* purposes only. It's not essential for an online backup. Furthermore,
|
|
* even if it's created, it will not be archived during recovery because
|
|
* an archiver is not invoked. So it doesn't seem worthwhile to write a
|
|
* backup history file during recovery.
|
|
*/
|
|
if (backup_started_in_recovery)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
XLogRecPtr recptr;
|
|
|
|
/*
|
|
* Check to see if all WAL replayed during online backup contain
|
|
* full-page writes.
|
|
*/
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
recptr = xlogctl->lastFpwDisableRecPtr;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
if (XLByteLE(startpoint, recptr))
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("WAL generated with full_page_writes=off was replayed "
|
|
"during online backup"),
|
|
errhint("This means that the backup being taken on standby "
|
|
"is corrupt and should not be used. "
|
|
"Enable full_page_writes and run CHECKPOINT on the master, "
|
|
"and then try an online backup again.")));
|
|
|
|
|
|
LWLockAcquire(ControlFileLock, LW_SHARED);
|
|
stoppoint = ControlFile->minRecoveryPoint;
|
|
LWLockRelease(ControlFileLock);
|
|
|
|
return stoppoint;
|
|
}
|
|
|
|
/*
|
|
* Write the backup-end xlog record
|
|
*/
|
|
rdata.data = (char *) (&startpoint);
|
|
rdata.len = sizeof(startpoint);
|
|
rdata.buffer = InvalidBuffer;
|
|
rdata.next = NULL;
|
|
stoppoint = XLogInsert(RM_XLOG_ID, XLOG_BACKUP_END, &rdata);
|
|
|
|
/*
|
|
* Force a switch to a new xlog segment file, so that the backup is valid
|
|
* as soon as archiver moves out the current segment file.
|
|
*/
|
|
RequestXLogSwitch();
|
|
|
|
XLByteToPrevSeg(stoppoint, _logSegNo);
|
|
XLogFileName(stopxlogfilename, ThisTimeLineID, _logSegNo);
|
|
|
|
/* Use the log timezone here, not the session timezone */
|
|
stamp_time = (pg_time_t) time(NULL);
|
|
pg_strftime(strfbuf, sizeof(strfbuf),
|
|
"%Y-%m-%d %H:%M:%S %Z",
|
|
pg_localtime(&stamp_time, log_timezone));
|
|
|
|
/*
|
|
* Write the backup history file
|
|
*/
|
|
XLByteToSeg(startpoint, _logSegNo);
|
|
BackupHistoryFilePath(histfilepath, ThisTimeLineID, _logSegNo,
|
|
(uint32) (startpoint % XLogSegSize));
|
|
fp = AllocateFile(histfilepath, "w");
|
|
if (!fp)
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not create file \"%s\": %m",
|
|
histfilepath)));
|
|
fprintf(fp, "START WAL LOCATION: %X/%X (file %s)\n",
|
|
(uint32) (startpoint >> 32), (uint32) startpoint, startxlogfilename);
|
|
fprintf(fp, "STOP WAL LOCATION: %X/%X (file %s)\n",
|
|
(uint32) (stoppoint >> 32), (uint32) stoppoint, stopxlogfilename);
|
|
/* transfer remaining lines from label to history file */
|
|
fprintf(fp, "%s", remaining);
|
|
fprintf(fp, "STOP TIME: %s\n", strfbuf);
|
|
if (fflush(fp) || ferror(fp) || FreeFile(fp))
|
|
ereport(ERROR,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not write file \"%s\": %m",
|
|
histfilepath)));
|
|
|
|
/*
|
|
* Clean out any no-longer-needed history files. As a side effect, this
|
|
* will post a .ready file for the newly created history file, notifying
|
|
* the archiver that history file may be archived immediately.
|
|
*/
|
|
CleanupBackupHistory();
|
|
|
|
/*
|
|
* If archiving is enabled, wait for all the required WAL files to be
|
|
* archived before returning. If archiving isn't enabled, the required WAL
|
|
* needs to be transported via streaming replication (hopefully with
|
|
* wal_keep_segments set high enough), or some more exotic mechanism like
|
|
* polling and copying files from pg_xlog with script. We have no
|
|
* knowledge of those mechanisms, so it's up to the user to ensure that he
|
|
* gets all the required WAL.
|
|
*
|
|
* We wait until both the last WAL file filled during backup and the
|
|
* history file have been archived, and assume that the alphabetic sorting
|
|
* property of the WAL files ensures any earlier WAL files are safely
|
|
* archived as well.
|
|
*
|
|
* We wait forever, since archive_command is supposed to work and we
|
|
* assume the admin wanted his backup to work completely. If you don't
|
|
* wish to wait, you can set statement_timeout. Also, some notices are
|
|
* issued to clue in anyone who might be doing this interactively.
|
|
*/
|
|
if (waitforarchive && XLogArchivingActive())
|
|
{
|
|
XLByteToPrevSeg(stoppoint, _logSegNo);
|
|
XLogFileName(lastxlogfilename, ThisTimeLineID, _logSegNo);
|
|
|
|
XLByteToSeg(startpoint, _logSegNo);
|
|
BackupHistoryFileName(histfilename, ThisTimeLineID, _logSegNo,
|
|
(uint32) (startpoint % XLogSegSize));
|
|
|
|
seconds_before_warning = 60;
|
|
waits = 0;
|
|
|
|
while (XLogArchiveIsBusy(lastxlogfilename) ||
|
|
XLogArchiveIsBusy(histfilename))
|
|
{
|
|
CHECK_FOR_INTERRUPTS();
|
|
|
|
if (!reported_waiting && waits > 5)
|
|
{
|
|
ereport(NOTICE,
|
|
(errmsg("pg_stop_backup cleanup done, waiting for required WAL segments to be archived")));
|
|
reported_waiting = true;
|
|
}
|
|
|
|
pg_usleep(1000000L);
|
|
|
|
if (++waits >= seconds_before_warning)
|
|
{
|
|
seconds_before_warning *= 2; /* This wraps in >10 years... */
|
|
ereport(WARNING,
|
|
(errmsg("pg_stop_backup still waiting for all required WAL segments to be archived (%d seconds elapsed)",
|
|
waits),
|
|
errhint("Check that your archive_command is executing properly. "
|
|
"pg_stop_backup can be canceled safely, "
|
|
"but the database backup will not be usable without all the WAL segments.")));
|
|
}
|
|
}
|
|
|
|
ereport(NOTICE,
|
|
(errmsg("pg_stop_backup complete, all required WAL segments have been archived")));
|
|
}
|
|
else if (waitforarchive)
|
|
ereport(NOTICE,
|
|
(errmsg("WAL archiving is not enabled; you must ensure that all required WAL segments are copied through other means to complete the backup")));
|
|
|
|
/*
|
|
* We're done. As a convenience, return the ending WAL location.
|
|
*/
|
|
return stoppoint;
|
|
}
|
|
|
|
|
|
/*
|
|
* do_pg_abort_backup: abort a running backup
|
|
*
|
|
* This does just the most basic steps of do_pg_stop_backup(), by taking the
|
|
* system out of backup mode, thus making it a lot more safe to call from
|
|
* an error handler.
|
|
*
|
|
* NB: This is only for aborting a non-exclusive backup that doesn't write
|
|
* backup_label. A backup started with pg_stop_backup() needs to be finished
|
|
* with pg_stop_backup().
|
|
*/
|
|
void
|
|
do_pg_abort_backup(void)
|
|
{
|
|
LWLockAcquire(WALInsertLock, LW_EXCLUSIVE);
|
|
Assert(XLogCtl->Insert.nonExclusiveBackups > 0);
|
|
XLogCtl->Insert.nonExclusiveBackups--;
|
|
|
|
if (!XLogCtl->Insert.exclusiveBackup &&
|
|
XLogCtl->Insert.nonExclusiveBackups == 0)
|
|
{
|
|
XLogCtl->Insert.forcePageWrites = false;
|
|
}
|
|
LWLockRelease(WALInsertLock);
|
|
}
|
|
|
|
/*
|
|
* Get latest redo apply position.
|
|
*
|
|
* Exported to allow WALReceiver to read the pointer directly.
|
|
*/
|
|
XLogRecPtr
|
|
GetXLogReplayRecPtr(void)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
XLogRecPtr recptr;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
recptr = xlogctl->lastReplayedEndRecPtr;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
|
|
return recptr;
|
|
}
|
|
|
|
/*
|
|
* Get current standby flush position, ie, the last WAL position
|
|
* known to be fsync'd to disk in standby.
|
|
*/
|
|
XLogRecPtr
|
|
GetStandbyFlushRecPtr(void)
|
|
{
|
|
XLogRecPtr receivePtr;
|
|
XLogRecPtr replayPtr;
|
|
|
|
receivePtr = GetWalRcvWriteRecPtr(NULL, NULL);
|
|
replayPtr = GetXLogReplayRecPtr();
|
|
|
|
if (XLByteLT(receivePtr, replayPtr))
|
|
return replayPtr;
|
|
else
|
|
return receivePtr;
|
|
}
|
|
|
|
/*
|
|
* Get latest WAL insert pointer
|
|
*/
|
|
XLogRecPtr
|
|
GetXLogInsertRecPtr(void)
|
|
{
|
|
XLogCtlInsert *Insert = &XLogCtl->Insert;
|
|
XLogRecPtr current_recptr;
|
|
|
|
LWLockAcquire(WALInsertLock, LW_SHARED);
|
|
INSERT_RECPTR(current_recptr, Insert, Insert->curridx);
|
|
LWLockRelease(WALInsertLock);
|
|
|
|
return current_recptr;
|
|
}
|
|
|
|
/*
|
|
* Get latest WAL write pointer
|
|
*/
|
|
XLogRecPtr
|
|
GetXLogWriteRecPtr(void)
|
|
{
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
LogwrtResult = xlogctl->LogwrtResult;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|
|
|
|
return LogwrtResult.Write;
|
|
}
|
|
|
|
/*
|
|
* Returns the redo pointer of the last checkpoint or restartpoint. This is
|
|
* the oldest point in WAL that we still need, if we have to restart recovery.
|
|
*/
|
|
void
|
|
GetOldestRestartPoint(XLogRecPtr *oldrecptr, TimeLineID *oldtli)
|
|
{
|
|
LWLockAcquire(ControlFileLock, LW_SHARED);
|
|
*oldrecptr = ControlFile->checkPointCopy.redo;
|
|
*oldtli = ControlFile->checkPointCopy.ThisTimeLineID;
|
|
LWLockRelease(ControlFileLock);
|
|
}
|
|
|
|
/*
|
|
* read_backup_label: check to see if a backup_label file is present
|
|
*
|
|
* If we see a backup_label during recovery, we assume that we are recovering
|
|
* from a backup dump file, and we therefore roll forward from the checkpoint
|
|
* identified by the label file, NOT what pg_control says. This avoids the
|
|
* problem that pg_control might have been archived one or more checkpoints
|
|
* later than the start of the dump, and so if we rely on it as the start
|
|
* point, we will fail to restore a consistent database state.
|
|
*
|
|
* Returns TRUE if a backup_label was found (and fills the checkpoint
|
|
* location and its REDO location into *checkPointLoc and RedoStartLSN,
|
|
* respectively); returns FALSE if not. If this backup_label came from a
|
|
* streamed backup, *backupEndRequired is set to TRUE. If this backup_label
|
|
* was created during recovery, *backupFromStandby is set to TRUE.
|
|
*/
|
|
static bool
|
|
read_backup_label(XLogRecPtr *checkPointLoc, bool *backupEndRequired,
|
|
bool *backupFromStandby)
|
|
{
|
|
char startxlogfilename[MAXFNAMELEN];
|
|
TimeLineID tli;
|
|
FILE *lfp;
|
|
char ch;
|
|
char backuptype[20];
|
|
char backupfrom[20];
|
|
uint32 hi,
|
|
lo;
|
|
|
|
*backupEndRequired = false;
|
|
*backupFromStandby = false;
|
|
|
|
/*
|
|
* See if label file is present
|
|
*/
|
|
lfp = AllocateFile(BACKUP_LABEL_FILE, "r");
|
|
if (!lfp)
|
|
{
|
|
if (errno != ENOENT)
|
|
ereport(FATAL,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not read file \"%s\": %m",
|
|
BACKUP_LABEL_FILE)));
|
|
return false; /* it's not there, all is fine */
|
|
}
|
|
|
|
/*
|
|
* Read and parse the START WAL LOCATION and CHECKPOINT lines (this code
|
|
* is pretty crude, but we are not expecting any variability in the file
|
|
* format).
|
|
*/
|
|
if (fscanf(lfp, "START WAL LOCATION: %X/%X (file %08X%16s)%c",
|
|
&hi, &lo, &tli, startxlogfilename, &ch) != 5 || ch != '\n')
|
|
ereport(FATAL,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("invalid data in file \"%s\"", BACKUP_LABEL_FILE)));
|
|
RedoStartLSN = ((uint64) hi) << 32 | lo;
|
|
if (fscanf(lfp, "CHECKPOINT LOCATION: %X/%X%c",
|
|
&hi, &lo, &ch) != 3 || ch != '\n')
|
|
ereport(FATAL,
|
|
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
|
|
errmsg("invalid data in file \"%s\"", BACKUP_LABEL_FILE)));
|
|
*checkPointLoc = ((uint64) hi) << 32 | lo;
|
|
|
|
/*
|
|
* BACKUP METHOD and BACKUP FROM lines are new in 9.2. We can't restore
|
|
* from an older backup anyway, but since the information on it is not
|
|
* strictly required, don't error out if it's missing for some reason.
|
|
*/
|
|
if (fscanf(lfp, "BACKUP METHOD: %19s\n", backuptype) == 1)
|
|
{
|
|
if (strcmp(backuptype, "streamed") == 0)
|
|
*backupEndRequired = true;
|
|
}
|
|
|
|
if (fscanf(lfp, "BACKUP FROM: %19s\n", backupfrom) == 1)
|
|
{
|
|
if (strcmp(backupfrom, "standby") == 0)
|
|
*backupFromStandby = true;
|
|
}
|
|
|
|
if (ferror(lfp) || FreeFile(lfp))
|
|
ereport(FATAL,
|
|
(errcode_for_file_access(),
|
|
errmsg("could not read file \"%s\": %m",
|
|
BACKUP_LABEL_FILE)));
|
|
|
|
return true;
|
|
}
|
|
|
|
/*
|
|
* Error context callback for errors occurring during rm_redo().
|
|
*/
|
|
static void
|
|
rm_redo_error_callback(void *arg)
|
|
{
|
|
XLogRecord *record = (XLogRecord *) arg;
|
|
StringInfoData buf;
|
|
|
|
initStringInfo(&buf);
|
|
RmgrTable[record->xl_rmid].rm_desc(&buf,
|
|
record->xl_info,
|
|
XLogRecGetData(record));
|
|
|
|
/* don't bother emitting empty description */
|
|
if (buf.len > 0)
|
|
errcontext("xlog redo %s", buf.data);
|
|
|
|
pfree(buf.data);
|
|
}
|
|
|
|
/*
|
|
* BackupInProgress: check if online backup mode is active
|
|
*
|
|
* This is done by checking for existence of the "backup_label" file.
|
|
*/
|
|
bool
|
|
BackupInProgress(void)
|
|
{
|
|
struct stat stat_buf;
|
|
|
|
return (stat(BACKUP_LABEL_FILE, &stat_buf) == 0);
|
|
}
|
|
|
|
/*
|
|
* CancelBackup: rename the "backup_label" file to cancel backup mode
|
|
*
|
|
* If the "backup_label" file exists, it will be renamed to "backup_label.old".
|
|
* Note that this will render an online backup in progress useless.
|
|
* To correctly finish an online backup, pg_stop_backup must be called.
|
|
*/
|
|
void
|
|
CancelBackup(void)
|
|
{
|
|
struct stat stat_buf;
|
|
|
|
/* if the file is not there, return */
|
|
if (stat(BACKUP_LABEL_FILE, &stat_buf) < 0)
|
|
return;
|
|
|
|
/* remove leftover file from previously canceled backup if it exists */
|
|
unlink(BACKUP_LABEL_OLD);
|
|
|
|
if (rename(BACKUP_LABEL_FILE, BACKUP_LABEL_OLD) == 0)
|
|
{
|
|
ereport(LOG,
|
|
(errmsg("online backup mode canceled"),
|
|
errdetail("\"%s\" was renamed to \"%s\".",
|
|
BACKUP_LABEL_FILE, BACKUP_LABEL_OLD)));
|
|
}
|
|
else
|
|
{
|
|
ereport(WARNING,
|
|
(errcode_for_file_access(),
|
|
errmsg("online backup mode was not canceled"),
|
|
errdetail("Could not rename \"%s\" to \"%s\": %m.",
|
|
BACKUP_LABEL_FILE, BACKUP_LABEL_OLD)));
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Read the XLOG page containing RecPtr into readBuf (if not read already).
|
|
* Returns true if the page is read successfully.
|
|
*
|
|
* This is responsible for restoring files from archive as needed, as well
|
|
* as for waiting for the requested WAL record to arrive in standby mode.
|
|
*
|
|
* 'emode' specifies the log level used for reporting "file not found" or
|
|
* "end of WAL" situations in archive recovery, or in standby mode when a
|
|
* trigger file is found. If set to WARNING or below, XLogPageRead() returns
|
|
* false in those situations, on higher log levels the ereport() won't
|
|
* return.
|
|
*
|
|
* In standby mode, if after a successful return of XLogPageRead() the
|
|
* caller finds the record it's interested in to be broken, it should
|
|
* ereport the error with the level determined by
|
|
* emode_for_corrupt_record(), and then set lastSourceFailed
|
|
* and call XLogPageRead() again with the same arguments. This lets
|
|
* XLogPageRead() to try fetching the record from another source, or to
|
|
* sleep and retry.
|
|
*/
|
|
static bool
|
|
XLogPageRead(XLogRecPtr *RecPtr, int emode, bool fetching_ckpt,
|
|
bool randAccess)
|
|
{
|
|
uint32 targetPageOff;
|
|
uint32 targetRecOff;
|
|
XLogSegNo targetSegNo;
|
|
|
|
XLByteToSeg(*RecPtr, targetSegNo);
|
|
targetPageOff = (((*RecPtr) % XLogSegSize) / XLOG_BLCKSZ) * XLOG_BLCKSZ;
|
|
targetRecOff = (*RecPtr) % XLOG_BLCKSZ;
|
|
|
|
/* Fast exit if we have read the record in the current buffer already */
|
|
if (!lastSourceFailed && targetSegNo == readSegNo &&
|
|
targetPageOff == readOff && targetRecOff < readLen)
|
|
return true;
|
|
|
|
/*
|
|
* See if we need to switch to a new segment because the requested record
|
|
* is not in the currently open one.
|
|
*/
|
|
if (readFile >= 0 && !XLByteInSeg(*RecPtr, readSegNo))
|
|
{
|
|
/*
|
|
* Request a restartpoint if we've replayed too much xlog since the
|
|
* last one.
|
|
*/
|
|
if (StandbyMode && bgwriterLaunched)
|
|
{
|
|
if (XLogCheckpointNeeded(readSegNo))
|
|
{
|
|
(void) GetRedoRecPtr();
|
|
if (XLogCheckpointNeeded(readSegNo))
|
|
RequestCheckpoint(CHECKPOINT_CAUSE_XLOG);
|
|
}
|
|
}
|
|
|
|
close(readFile);
|
|
readFile = -1;
|
|
readSource = 0;
|
|
}
|
|
|
|
XLByteToSeg(*RecPtr, readSegNo);
|
|
|
|
retry:
|
|
/* See if we need to retrieve more data */
|
|
if (readFile < 0 ||
|
|
(readSource == XLOG_FROM_STREAM && !XLByteLT(*RecPtr, receivedUpto)))
|
|
{
|
|
if (StandbyMode)
|
|
{
|
|
if (!WaitForWALToBecomeAvailable(*RecPtr, randAccess,
|
|
fetching_ckpt))
|
|
goto triggered;
|
|
}
|
|
else
|
|
{
|
|
/* In archive or crash recovery. */
|
|
if (readFile < 0)
|
|
{
|
|
int source;
|
|
|
|
/* Reset curFileTLI if random fetch. */
|
|
if (randAccess)
|
|
curFileTLI = 0;
|
|
|
|
if (InArchiveRecovery)
|
|
source = XLOG_FROM_ANY;
|
|
else
|
|
source = XLOG_FROM_PG_XLOG;
|
|
|
|
readFile = XLogFileReadAnyTLI(readSegNo, emode, source);
|
|
if (readFile < 0)
|
|
return false;
|
|
}
|
|
}
|
|
}
|
|
|
|
/*
|
|
* At this point, we have the right segment open and if we're streaming we
|
|
* know the requested record is in it.
|
|
*/
|
|
Assert(readFile != -1);
|
|
|
|
/*
|
|
* If the current segment is being streamed from master, calculate how
|
|
* much of the current page we have received already. We know the
|
|
* requested record has been received, but this is for the benefit of
|
|
* future calls, to allow quick exit at the top of this function.
|
|
*/
|
|
if (readSource == XLOG_FROM_STREAM)
|
|
{
|
|
if (((*RecPtr) / XLOG_BLCKSZ) != (receivedUpto / XLOG_BLCKSZ))
|
|
{
|
|
readLen = XLOG_BLCKSZ;
|
|
}
|
|
else
|
|
readLen = receivedUpto % XLogSegSize - targetPageOff;
|
|
}
|
|
else
|
|
readLen = XLOG_BLCKSZ;
|
|
|
|
if (!readFileHeaderValidated && targetPageOff != 0)
|
|
{
|
|
/*
|
|
* Whenever switching to a new WAL segment, we read the first page of
|
|
* the file and validate its header, even if that's not where the
|
|
* target record is. This is so that we can check the additional
|
|
* identification info that is present in the first page's "long"
|
|
* header.
|
|
*/
|
|
readOff = 0;
|
|
if (read(readFile, readBuf, XLOG_BLCKSZ) != XLOG_BLCKSZ)
|
|
{
|
|
char fname[MAXFNAMELEN];
|
|
XLogFileName(fname, curFileTLI, readSegNo);
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errcode_for_file_access(),
|
|
errmsg("could not read from log segment %s, offset %u: %m",
|
|
fname, readOff)));
|
|
goto next_record_is_invalid;
|
|
}
|
|
if (!ValidXLogPageHeader((XLogPageHeader) readBuf, emode, true))
|
|
goto next_record_is_invalid;
|
|
}
|
|
|
|
/* Read the requested page */
|
|
readOff = targetPageOff;
|
|
if (lseek(readFile, (off_t) readOff, SEEK_SET) < 0)
|
|
{
|
|
char fname[MAXFNAMELEN];
|
|
XLogFileName(fname, curFileTLI, readSegNo);
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errcode_for_file_access(),
|
|
errmsg("could not seek in log segment %s to offset %u: %m",
|
|
fname, readOff)));
|
|
goto next_record_is_invalid;
|
|
}
|
|
if (read(readFile, readBuf, XLOG_BLCKSZ) != XLOG_BLCKSZ)
|
|
{
|
|
char fname[MAXFNAMELEN];
|
|
XLogFileName(fname, curFileTLI, readSegNo);
|
|
ereport(emode_for_corrupt_record(emode, *RecPtr),
|
|
(errcode_for_file_access(),
|
|
errmsg("could not read from log segment %s, offset %u: %m",
|
|
fname, readOff)));
|
|
goto next_record_is_invalid;
|
|
}
|
|
if (!ValidXLogPageHeader((XLogPageHeader) readBuf, emode, false))
|
|
goto next_record_is_invalid;
|
|
|
|
readFileHeaderValidated = true;
|
|
|
|
Assert(targetSegNo == readSegNo);
|
|
Assert(targetPageOff == readOff);
|
|
Assert(targetRecOff < readLen);
|
|
|
|
return true;
|
|
|
|
next_record_is_invalid:
|
|
lastSourceFailed = true;
|
|
|
|
if (readFile >= 0)
|
|
close(readFile);
|
|
readFile = -1;
|
|
readLen = 0;
|
|
readSource = 0;
|
|
|
|
/* In standby-mode, keep trying */
|
|
if (StandbyMode)
|
|
goto retry;
|
|
else
|
|
return false;
|
|
|
|
triggered:
|
|
if (readFile >= 0)
|
|
close(readFile);
|
|
readFile = -1;
|
|
readLen = 0;
|
|
readSource = 0;
|
|
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* In standby mode, wait for the requested record to become available, either
|
|
* via restore_command succeeding to restore the segment, or via walreceiver
|
|
* having streamed the record (or via someone copying the segment directly to
|
|
* pg_xlog, but that is not documented or recommended).
|
|
*
|
|
* When the requested record becomes available, the function opens the file
|
|
* containing it (if not open already), and returns true. When end of standby
|
|
* mode is triggered by the user, and there is no more WAL available, returns
|
|
* false.
|
|
*/
|
|
static bool
|
|
WaitForWALToBecomeAvailable(XLogRecPtr RecPtr, bool randAccess,
|
|
bool fetching_ckpt)
|
|
{
|
|
static pg_time_t last_fail_time = 0;
|
|
pg_time_t now;
|
|
|
|
/*-------
|
|
* Standby mode is implemented by a state machine:
|
|
*
|
|
* 1. Read from archive (XLOG_FROM_ARCHIVE)
|
|
* 2. Read from pg_xlog (XLOG_FROM_PG_XLOG)
|
|
* 3. Check trigger file
|
|
* 4. Read from primary server via walreceiver (XLOG_FROM_STREAM)
|
|
* 5. Rescan timelines
|
|
* 6. Sleep 5 seconds, and loop back to 1.
|
|
*
|
|
* Failure to read from the current source advances the state machine to
|
|
* the next state. In addition, successfully reading a file from pg_xlog
|
|
* moves the state machine from state 2 back to state 1 (we always prefer
|
|
* files in the archive over files in pg_xlog).
|
|
*
|
|
* 'currentSource' indicates the current state. There are no currentSource
|
|
* values for "check trigger", "rescan timelines", and "sleep" states,
|
|
* those actions are taken when reading from the previous source fails, as
|
|
* part of advancing to the next state.
|
|
*-------
|
|
*/
|
|
if (currentSource == 0)
|
|
currentSource = XLOG_FROM_ARCHIVE;
|
|
|
|
for (;;)
|
|
{
|
|
int oldSource = currentSource;
|
|
|
|
/*
|
|
* First check if we failed to read from the current source, and
|
|
* advance the state machine if so. The failure to read might've
|
|
* happened outside this function, e.g when a CRC check fails on a
|
|
* record, or within this loop.
|
|
*/
|
|
if (lastSourceFailed)
|
|
{
|
|
|
|
switch (currentSource)
|
|
{
|
|
case XLOG_FROM_ARCHIVE:
|
|
currentSource = XLOG_FROM_PG_XLOG;
|
|
break;
|
|
|
|
case XLOG_FROM_PG_XLOG:
|
|
/*
|
|
* Check to see if the trigger file exists. Note that we do
|
|
* this only after failure, so when you create the trigger
|
|
* file, we still finish replaying as much as we can from
|
|
* archive and pg_xlog before failover.
|
|
*/
|
|
if (CheckForStandbyTrigger())
|
|
{
|
|
ShutdownWalRcv();
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* If primary_conninfo is set, launch walreceiver to try to
|
|
* stream the missing WAL.
|
|
*
|
|
* If fetching_ckpt is TRUE, RecPtr points to the initial
|
|
* checkpoint location. In that case, we use RedoStartLSN
|
|
* as the streaming start position instead of RecPtr, so
|
|
* that when we later jump backwards to start redo at
|
|
* RedoStartLSN, we will have the logs streamed already.
|
|
*/
|
|
if (PrimaryConnInfo)
|
|
{
|
|
XLogRecPtr ptr = fetching_ckpt ? RedoStartLSN : RecPtr;
|
|
TimeLineID tli = tliOfPointInHistory(ptr, expectedTLEs);
|
|
|
|
if (curFileTLI > 0 && tli < curFileTLI)
|
|
elog(ERROR, "according to history file, WAL location %X/%X belongs to timeline %u, but previous recovered WAL file came from timeline %u",
|
|
(uint32) (ptr >> 32), (uint32) ptr,
|
|
tli, curFileTLI);
|
|
curFileTLI = tli;
|
|
RequestXLogStreaming(curFileTLI, ptr, PrimaryConnInfo);
|
|
}
|
|
/*
|
|
* Move to XLOG_FROM_STREAM state in either case. We'll get
|
|
* immediate failure if we didn't launch walreceiver, and
|
|
* move on to the next state.
|
|
*/
|
|
currentSource = XLOG_FROM_STREAM;
|
|
break;
|
|
|
|
case XLOG_FROM_STREAM:
|
|
/*
|
|
* Failure while streaming. Most likely, we got here because
|
|
* streaming replication was terminated, or promotion was
|
|
* triggered. But we also get here if we find an invalid
|
|
* record in the WAL streamed from master, in which case
|
|
* something is seriously wrong. There's little chance that
|
|
* the problem will just go away, but PANIC is not good for
|
|
* availability either, especially in hot standby mode. So,
|
|
* we treat that the same as disconnection, and retry from
|
|
* archive/pg_xlog again. The WAL in the archive should be
|
|
* identical to what was streamed, so it's unlikely that it
|
|
* helps, but one can hope...
|
|
*/
|
|
/*
|
|
* Before we leave XLOG_FROM_STREAM state, make sure that
|
|
* walreceiver is not active, so that it won't overwrite
|
|
* WAL that we restore from archive.
|
|
*/
|
|
if (WalRcvStreaming())
|
|
ShutdownWalRcv();
|
|
|
|
/*
|
|
* Before we sleep, re-scan for possible new timelines if
|
|
* we were requested to recover to the latest timeline.
|
|
*/
|
|
if (recoveryTargetIsLatest)
|
|
{
|
|
if (rescanLatestTimeLine())
|
|
{
|
|
currentSource = XLOG_FROM_ARCHIVE;
|
|
break;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* XLOG_FROM_STREAM is the last state in our state machine,
|
|
* so we've exhausted all the options for obtaining the
|
|
* requested WAL. We're going to loop back and retry from
|
|
* the archive, but if it hasn't been long since last
|
|
* attempt, sleep 5 seconds to avoid busy-waiting.
|
|
*/
|
|
now = (pg_time_t) time(NULL);
|
|
if ((now - last_fail_time) < 5)
|
|
{
|
|
pg_usleep(1000000L * (5 - (now - last_fail_time)));
|
|
now = (pg_time_t) time(NULL);
|
|
}
|
|
last_fail_time = now;
|
|
currentSource = XLOG_FROM_ARCHIVE;
|
|
break;
|
|
|
|
default:
|
|
elog(ERROR, "unexpected WAL source %d", currentSource);
|
|
}
|
|
}
|
|
else if (currentSource == XLOG_FROM_PG_XLOG)
|
|
{
|
|
/*
|
|
* We just successfully read a file in pg_xlog. We prefer files
|
|
* in the archive over ones in pg_xlog, so try the next file
|
|
* again from the archive first.
|
|
*/
|
|
currentSource = XLOG_FROM_ARCHIVE;
|
|
}
|
|
|
|
if (currentSource != oldSource)
|
|
elog(DEBUG2, "switched WAL source from %s to %s after %s",
|
|
xlogSourceNames[oldSource], xlogSourceNames[currentSource],
|
|
lastSourceFailed ? "failure" : "success");
|
|
|
|
/*
|
|
* We've now handled possible failure. Try to read from the chosen
|
|
* source.
|
|
*/
|
|
lastSourceFailed = false;
|
|
|
|
switch (currentSource)
|
|
{
|
|
case XLOG_FROM_ARCHIVE:
|
|
case XLOG_FROM_PG_XLOG:
|
|
/* Close any old file we might have open. */
|
|
if (readFile >= 0)
|
|
{
|
|
close(readFile);
|
|
readFile = -1;
|
|
}
|
|
/* Reset curFileTLI if random fetch. */
|
|
if (randAccess)
|
|
curFileTLI = 0;
|
|
|
|
/*
|
|
* Try to restore the file from archive, or read an existing
|
|
* file from pg_xlog.
|
|
*/
|
|
readFile = XLogFileReadAnyTLI(readSegNo, DEBUG2, currentSource);
|
|
if (readFile >= 0)
|
|
return true; /* success! */
|
|
|
|
/*
|
|
* Nope, not found in archive or pg_xlog.
|
|
*/
|
|
lastSourceFailed = true;
|
|
break;
|
|
|
|
case XLOG_FROM_STREAM:
|
|
{
|
|
bool havedata;
|
|
|
|
/*
|
|
* Check if WAL receiver is still active.
|
|
*/
|
|
if (!WalRcvStreaming())
|
|
{
|
|
lastSourceFailed = true;
|
|
break;
|
|
}
|
|
|
|
/*
|
|
* Walreceiver is active, so see if new data has arrived.
|
|
*
|
|
* We only advance XLogReceiptTime when we obtain fresh WAL
|
|
* from walreceiver and observe that we had already processed
|
|
* everything before the most recent "chunk" that it flushed to
|
|
* disk. In steady state where we are keeping up with the
|
|
* incoming data, XLogReceiptTime will be updated on each cycle.
|
|
* When we are behind, XLogReceiptTime will not advance, so the
|
|
* grace time allotted to conflicting queries will decrease.
|
|
*/
|
|
if (XLByteLT(RecPtr, receivedUpto))
|
|
havedata = true;
|
|
else
|
|
{
|
|
XLogRecPtr latestChunkStart;
|
|
|
|
receivedUpto = GetWalRcvWriteRecPtr(&latestChunkStart, &receiveTLI);
|
|
if (XLByteLT(RecPtr, receivedUpto) && receiveTLI == curFileTLI)
|
|
{
|
|
havedata = true;
|
|
if (!XLByteLT(RecPtr, latestChunkStart))
|
|
{
|
|
XLogReceiptTime = GetCurrentTimestamp();
|
|
SetCurrentChunkStartTime(XLogReceiptTime);
|
|
}
|
|
}
|
|
else
|
|
havedata = false;
|
|
}
|
|
if (havedata)
|
|
{
|
|
/*
|
|
* Great, streamed far enough. Open the file if it's not
|
|
* open already. Use XLOG_FROM_STREAM so that source info
|
|
* is set correctly and XLogReceiptTime isn't changed.
|
|
*/
|
|
if (readFile < 0)
|
|
{
|
|
readFile = XLogFileRead(readSegNo, PANIC,
|
|
recoveryTargetTLI,
|
|
XLOG_FROM_STREAM, false);
|
|
Assert(readFile >= 0);
|
|
}
|
|
else
|
|
{
|
|
/* just make sure source info is correct... */
|
|
readSource = XLOG_FROM_STREAM;
|
|
XLogReceiptSource = XLOG_FROM_STREAM;
|
|
return true;
|
|
}
|
|
break;
|
|
}
|
|
|
|
/*
|
|
* Data not here yet. Check for trigger, then wait for
|
|
* walreceiver to wake us up when new WAL arrives.
|
|
*/
|
|
if (CheckForStandbyTrigger())
|
|
{
|
|
/*
|
|
* Note that we don't "return false" immediately here.
|
|
* After being triggered, we still want to replay all the
|
|
* WAL that was already streamed. It's in pg_xlog now, so
|
|
* we just treat this as a failure, and the state machine
|
|
* will move on to replay the streamed WAL from pg_xlog,
|
|
* and then recheck the trigger and exit replay.
|
|
*/
|
|
lastSourceFailed = true;
|
|
break;
|
|
}
|
|
|
|
/*
|
|
* Wait for more WAL to arrive. Time out after 5 seconds, like
|
|
* when polling the archive, to react to a trigger file
|
|
* promptly.
|
|
*/
|
|
WaitLatch(&XLogCtl->recoveryWakeupLatch,
|
|
WL_LATCH_SET | WL_TIMEOUT,
|
|
5000L);
|
|
ResetLatch(&XLogCtl->recoveryWakeupLatch);
|
|
break;
|
|
}
|
|
|
|
default:
|
|
elog(ERROR, "unexpected WAL source %d", currentSource);
|
|
}
|
|
|
|
/*
|
|
* This possibly-long loop needs to handle interrupts of startup
|
|
* process.
|
|
*/
|
|
HandleStartupProcInterrupts();
|
|
}
|
|
|
|
return false; /* not reached */
|
|
}
|
|
|
|
/*
|
|
* Determine what log level should be used to report a corrupt WAL record
|
|
* in the current WAL page, previously read by XLogPageRead().
|
|
*
|
|
* 'emode' is the error mode that would be used to report a file-not-found
|
|
* or legitimate end-of-WAL situation. Generally, we use it as-is, but if
|
|
* we're retrying the exact same record that we've tried previously, only
|
|
* complain the first time to keep the noise down. However, we only do when
|
|
* reading from pg_xlog, because we don't expect any invalid records in archive
|
|
* or in records streamed from master. Files in the archive should be complete,
|
|
* and we should never hit the end of WAL because we stop and wait for more WAL
|
|
* to arrive before replaying it.
|
|
*
|
|
* NOTE: This function remembers the RecPtr value it was last called with,
|
|
* to suppress repeated messages about the same record. Only call this when
|
|
* you are about to ereport(), or you might cause a later message to be
|
|
* erroneously suppressed.
|
|
*/
|
|
static int
|
|
emode_for_corrupt_record(int emode, XLogRecPtr RecPtr)
|
|
{
|
|
static XLogRecPtr lastComplaint = 0;
|
|
|
|
if (readSource == XLOG_FROM_PG_XLOG && emode == LOG)
|
|
{
|
|
if (XLByteEQ(RecPtr, lastComplaint))
|
|
emode = DEBUG1;
|
|
else
|
|
lastComplaint = RecPtr;
|
|
}
|
|
return emode;
|
|
}
|
|
|
|
/*
|
|
* Check to see whether the user-specified trigger file exists and whether a
|
|
* promote request has arrived. If either condition holds, return true.
|
|
*/
|
|
static bool
|
|
CheckForStandbyTrigger(void)
|
|
{
|
|
struct stat stat_buf;
|
|
static bool triggered = false;
|
|
|
|
if (triggered)
|
|
return true;
|
|
|
|
if (IsPromoteTriggered())
|
|
{
|
|
ereport(LOG,
|
|
(errmsg("received promote request")));
|
|
ResetPromoteTriggered();
|
|
triggered = true;
|
|
return true;
|
|
}
|
|
|
|
if (TriggerFile == NULL)
|
|
return false;
|
|
|
|
if (stat(TriggerFile, &stat_buf) == 0)
|
|
{
|
|
ereport(LOG,
|
|
(errmsg("trigger file found: %s", TriggerFile)));
|
|
unlink(TriggerFile);
|
|
triggered = true;
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* Check to see if a promote request has arrived. Should be
|
|
* called by postmaster after receiving SIGUSR1.
|
|
*/
|
|
bool
|
|
CheckPromoteSignal(void)
|
|
{
|
|
struct stat stat_buf;
|
|
|
|
if (stat(PROMOTE_SIGNAL_FILE, &stat_buf) == 0)
|
|
{
|
|
/*
|
|
* Since we are in a signal handler, it's not safe to elog. We
|
|
* silently ignore any error from unlink.
|
|
*/
|
|
unlink(PROMOTE_SIGNAL_FILE);
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* Wake up startup process to replay newly arrived WAL, or to notice that
|
|
* failover has been requested.
|
|
*/
|
|
void
|
|
WakeupRecovery(void)
|
|
{
|
|
SetLatch(&XLogCtl->recoveryWakeupLatch);
|
|
}
|
|
|
|
/*
|
|
* Update the WalWriterSleeping flag.
|
|
*/
|
|
void
|
|
SetWalWriterSleeping(bool sleeping)
|
|
{
|
|
/* use volatile pointer to prevent code rearrangement */
|
|
volatile XLogCtlData *xlogctl = XLogCtl;
|
|
|
|
SpinLockAcquire(&xlogctl->info_lck);
|
|
xlogctl->WalWriterSleeping = sleeping;
|
|
SpinLockRelease(&xlogctl->info_lck);
|
|
}
|