granicus.if.org Git - postgresql/blob - src/backend/postmaster/postmaster.c

   1 /*-------------------------------------------------------------------------
   2  *
   3  * postmaster.c
   4  *        This program acts as a clearing house for requests to the
   5  *        POSTGRES system.      Frontend programs send a startup message
   6  *        to the Postmaster and the postmaster uses the info in the
   7  *        message to setup a backend process.
   8  *
   9  *        The postmaster also manages system-wide operations such as
  10  *        startup and shutdown. The postmaster itself doesn't do those
  11  *        operations, mind you --- it just forks off a subprocess to do them
  12  *        at the right times.  It also takes care of resetting the system
  13  *        if a backend crashes.
  14  *
  15  *        The postmaster process creates the shared memory and semaphore
  16  *        pools during startup, but as a rule does not touch them itself.
  17  *        In particular, it is not a member of the PGPROC array of backends
  18  *        and so it cannot participate in lock-manager operations.      Keeping
  19  *        the postmaster away from shared memory operations makes it simpler
  20  *        and more reliable.  The postmaster is almost always able to recover
  21  *        from crashes of individual backends by resetting shared memory;
  22  *        if it did much with shared memory then it would be prone to crashing
  23  *        along with the backends.
  24  *
  25  *        When a request message is received, we now fork() immediately.
  26  *        The child process performs authentication of the request, and
  27  *        then becomes a backend if successful.  This allows the auth code
  28  *        to be written in a simple single-threaded style (as opposed to the
  29  *        crufty "poor man's multitasking" code that used to be needed).
  30  *        More importantly, it ensures that blockages in non-multithreaded
  31  *        libraries like SSL or PAM cannot cause denial of service to other
  32  *        clients.
  33  *
  34  *
  35  * Portions Copyright (c) 1996-2008, PostgreSQL Global Development Group
  36  * Portions Copyright (c) 1994, Regents of the University of California
  37  *
  38  *
  39  * IDENTIFICATION
  40  *        $PostgreSQL: pgsql/src/backend/postmaster/postmaster.c,v 1.550 2008/01/01 19:45:51 momjian Exp $
  41  *
  42  * NOTES
  43  *
  44  * Initialization:
  45  *              The Postmaster sets up shared memory data structures
  46  *              for the backends.
  47  *
  48  * Synchronization:
  49  *              The Postmaster shares memory with the backends but should avoid
  50  *              touching shared memory, so as not to become stuck if a crashing
  51  *              backend screws up locks or shared memory.  Likewise, the Postmaster
  52  *              should never block on messages from frontend clients.
  53  *
  54  * Garbage Collection:
  55  *              The Postmaster cleans up after backends if they have an emergency
  56  *              exit and/or core dump.
  57  *
  58  * Error Reporting:
  59  *              Use write_stderr() only for reporting "interactive" errors
  60  *              (essentially, bogus arguments on the command line).  Once the
  61  *              postmaster is launched, use ereport().  In particular, don't use
  62  *              write_stderr() for anything that occurs after pmdaemonize.
  63  *
  64  *-------------------------------------------------------------------------
  65  */
  66
  67 #include "postgres.h"
  68
  69 #include <unistd.h>
  70 #include <signal.h>
  71 #include <time.h>
  72 #include <sys/wait.h>
  73 #include <ctype.h>
  74 #include <sys/stat.h>
  75 #include <sys/socket.h>
  76 #include <fcntl.h>
  77 #include <sys/param.h>
  78 #include <netinet/in.h>
  79 #include <arpa/inet.h>
  80 #include <netdb.h>
  81 #include <limits.h>
  82
  83 #ifdef HAVE_SYS_SELECT_H
  84 #include <sys/select.h>
  85 #endif
  86
  87 #ifdef HAVE_GETOPT_H
  88 #include <getopt.h>
  89 #endif
  90
  91 #ifdef USE_BONJOUR
  92 #include <DNSServiceDiscovery/DNSServiceDiscovery.h>
  93 #endif
  94
  95 #include "access/transam.h"
  96 #include "bootstrap/bootstrap.h"
  97 #include "catalog/pg_control.h"
  98 #include "lib/dllist.h"
  99 #include "libpq/auth.h"
 100 #include "libpq/ip.h"
 101 #include "libpq/libpq.h"
 102 #include "libpq/pqsignal.h"
 103 #include "miscadmin.h"
 104 #include "pgstat.h"
 105 #include "postmaster/autovacuum.h"
 106 #include "postmaster/fork_process.h"
 107 #include "postmaster/pgarch.h"
 108 #include "postmaster/postmaster.h"
 109 #include "postmaster/syslogger.h"
 110 #include "storage/fd.h"
 111 #include "storage/ipc.h"
 112 #include "storage/pg_shmem.h"
 113 #include "storage/pmsignal.h"
 114 #include "storage/proc.h"
 115 #include "tcop/tcopprot.h"
 116 #include "utils/builtins.h"
 117 #include "utils/datetime.h"
 118 #include "utils/memutils.h"
 119 #include "utils/ps_status.h"
 120
 121 #ifdef EXEC_BACKEND
 122 #include "storage/spin.h"
 123 #endif
 124
 125
 126 /*
 127  * List of active backends (or child processes anyway; we don't actually
 128  * know whether a given child has become a backend or is still in the
 129  * authorization phase).  This is used mainly to keep track of how many
 130  * children we have and send them appropriate signals when necessary.
 131  *
 132  * "Special" children such as the startup, bgwriter and autovacuum launcher
 133  * tasks are not in this list.  Autovacuum worker processes are in it.
 134  * Also, "dead_end" children are in it: these are children launched just
 135  * for the purpose of sending a friendly rejection message to a would-be
 136  * client.      We must track them because they are attached to shared memory,
 137  * but we know they will never become live backends.
 138  */
 139 typedef struct bkend
 140 {
 141         pid_t           pid;                    /* process id of backend */
 142         long            cancel_key;             /* cancel key for cancels for this backend */
 143         bool            is_autovacuum;  /* is it an autovacuum process? */
 144         bool            dead_end;               /* is it going to send an error and quit? */
 145 } Backend;
 146
 147 static Dllist *BackendList;
 148
 149 #ifdef EXEC_BACKEND
 150 /*
 151  * Number of entries in the shared-memory backend table.  This table is used
 152  * only for sending cancels, and therefore only includes children we allow
 153  * cancels on: regular backends and autovac workers.  In particular we exclude
 154  * dead_end children, allowing the table to have a known maximum size, to wit
 155  * the same too-many-children limit enforced by canAcceptConnections().
 156  */
 157 #define NUM_BACKENDARRAY_ELEMS (2*MaxBackends)
 158
 159 static Backend *ShmemBackendArray;
 160 #endif
 161
 162 /* The socket number we are listening for connections on */
 163 int                     PostPortNumber;
 164 char       *UnixSocketDir;
 165 char       *ListenAddresses;
 166
 167 /*
 168  * ReservedBackends is the number of backends reserved for superuser use.
 169  * This number is taken out of the pool size given by MaxBackends so
 170  * number of backend slots available to non-superusers is
 171  * (MaxBackends - ReservedBackends).  Note what this really means is
 172  * "if there are <= ReservedBackends connections available, only superusers
 173  * can make new connections" --- pre-existing superuser connections don't
 174  * count against the limit.
 175  */
 176 int                     ReservedBackends;
 177
 178 /* The socket(s) we're listening to. */
 179 #define MAXLISTEN       64
 180 static int      ListenSocket[MAXLISTEN];
 181
 182 /*
 183  * Set by the -o option
 184  */
 185 static char ExtraOptions[MAXPGPATH];
 186
 187 /*
 188  * These globals control the behavior of the postmaster in case some
 189  * backend dumps core.  Normally, it kills all peers of the dead backend
 190  * and reinitializes shared memory.  By specifying -s or -n, we can have
 191  * the postmaster stop (rather than kill) peers and not reinitialize
 192  * shared data structures.      (Reinit is currently dead code, though.)
 193  */
 194 static bool Reinit = true;
 195 static int      SendStop = false;
 196
 197 /* still more option variables */
 198 bool            EnableSSL = false;
 199 bool            SilentMode = false; /* silent mode (-S) */
 200
 201 int                     PreAuthDelay = 0;
 202 int                     AuthenticationTimeout = 60;
 203
 204 bool            log_hostname;           /* for ps display and logging */
 205 bool            Log_connections = false;
 206 bool            Db_user_namespace = false;
 207
 208 char       *bonjour_name;
 209
 210 /* PIDs of special child processes; 0 when not running */
 211 static pid_t StartupPID = 0,
 212                         BgWriterPID = 0,
 213                         WalWriterPID = 0,
 214                         AutoVacPID = 0,
 215                         PgArchPID = 0,
 216                         PgStatPID = 0,
 217                         SysLoggerPID = 0;
 218
 219 /* Startup/shutdown state */
 220 #define                 NoShutdown              0
 221 #define                 SmartShutdown   1
 222 #define                 FastShutdown    2
 223
 224 static int      Shutdown = NoShutdown;
 225
 226 static bool FatalError = false; /* T if recovering from backend crash */
 227
 228 /*
 229  * We use a simple state machine to control startup, shutdown, and
 230  * crash recovery (which is rather like shutdown followed by startup).
 231  *
 232  * Normal child backends can only be launched when we are in PM_RUN state.
 233  * In other states we handle connection requests by launching "dead_end"
 234  * child processes, which will simply send the client an error message and
 235  * quit.  (We track these in the BackendList so that we can know when they
 236  * are all gone; this is important because they're still connected to shared
 237  * memory, and would interfere with an attempt to destroy the shmem segment,
 238  * possibly leading to SHMALL failure when we try to make a new one.)
 239  * In PM_WAIT_DEAD_END state we are waiting for all the dead_end children
 240  * to drain out of the system, and therefore stop accepting connection
 241  * requests at all until the last existing child has quit (which hopefully
 242  * will not be very long).
 243  *
 244  * Notice that this state variable does not distinguish *why* we entered
 245  * PM_WAIT_BACKENDS or later states --- Shutdown and FatalError must be
 246  * consulted to find that out.  FatalError is never true in PM_RUN state, nor
 247  * in PM_SHUTDOWN state (because we don't enter that state when trying to
 248  * recover from a crash).  It can be true in PM_STARTUP state, because we
 249  * don't clear it until we've successfully recovered.
 250  */
 251 typedef enum
 252 {
 253         PM_INIT,                                        /* postmaster starting */
 254         PM_STARTUP,                                     /* waiting for startup subprocess */
 255         PM_RUN,                                         /* normal "database is alive" state */
 256         PM_WAIT_BACKENDS,                       /* waiting for live backends to exit */
 257         PM_SHUTDOWN,                            /* waiting for bgwriter to do shutdown ckpt */
 258         PM_WAIT_DEAD_END,                       /* waiting for dead_end children to exit */
 259         PM_NO_CHILDREN                          /* all important children have exited */
 260 } PMState;
 261
 262 static PMState pmState = PM_INIT;
 263
 264 bool            ClientAuthInProgress = false;           /* T during new-client
 265                                                                                                  * authentication */
 266
 267 bool            redirection_done = false;       /* stderr redirected for syslogger? */
 268
 269 /* received START_AUTOVAC_LAUNCHER signal */
 270 static volatile sig_atomic_t start_autovac_launcher = false;
 271
 272 /*
 273  * State for assigning random salts and cancel keys.
 274  * Also, the global MyCancelKey passes the cancel key assigned to a given
 275  * backend from the postmaster to that backend (via fork).
 276  */
 277 static unsigned int random_seed = 0;
 278 static struct timeval random_start_time;
 279
 280 extern char *optarg;
 281 extern int      optind,
 282                         opterr;
 283
 284 #ifdef HAVE_INT_OPTRESET
 285 extern int      optreset;
 286 #endif
 287
 288 /*
 289  * postmaster.c - function prototypes
 290  */
 291 static void checkDataDir(void);
 292
 293 #ifdef USE_BONJOUR
 294 static void reg_reply(DNSServiceRegistrationReplyErrorType errorCode,
 295                   void *context);
 296 #endif
 297 static void pmdaemonize(void);
 298 static Port *ConnCreate(int serverFd);
 299 static void ConnFree(Port *port);
 300 static void reset_shared(int port);
 301 static void SIGHUP_handler(SIGNAL_ARGS);
 302 static void pmdie(SIGNAL_ARGS);
 303 static void reaper(SIGNAL_ARGS);
 304 static void sigusr1_handler(SIGNAL_ARGS);
 305 static void dummy_handler(SIGNAL_ARGS);
 306 static void CleanupBackend(int pid, int exitstatus);
 307 static void HandleChildCrash(int pid, int exitstatus, const char *procname);
 308 static void LogChildExit(int lev, const char *procname,
 309                          int pid, int exitstatus);
 310 static void PostmasterStateMachine(void);
 311 static void BackendInitialize(Port *port);
 312 static int      BackendRun(Port *port);
 313 static void ExitPostmaster(int status);
 314 static int      ServerLoop(void);
 315 static int      BackendStartup(Port *port);
 316 static int      ProcessStartupPacket(Port *port, bool SSLdone);
 317 static void processCancelRequest(Port *port, void *pkt);
 318 static int      initMasks(fd_set *rmask);
 319 static void report_fork_failure_to_client(Port *port, int errnum);
 320 static enum CAC_state canAcceptConnections(void);
 321 static long PostmasterRandom(void);
 322 static void RandomSalt(char *cryptSalt, char *md5Salt);
 323 static void signal_child(pid_t pid, int signal);
 324 static void SignalSomeChildren(int signal, bool only_autovac);
 325
 326 #define SignalChildren(sig)                     SignalSomeChildren(sig, false)
 327 #define SignalAutovacWorkers(sig)       SignalSomeChildren(sig, true)
 328 static int      CountChildren(void);
 329 static bool CreateOptsFile(int argc, char *argv[], char *fullprogname);
 330 static pid_t StartChildProcess(AuxProcType type);
 331 static void StartAutovacuumWorker(void);
 332
 333 #ifdef EXEC_BACKEND
 334
 335 #ifdef WIN32
 336 static pid_t win32_waitpid(int *exitstatus);
 337 static void WINAPI pgwin32_deadchild_callback(PVOID lpParameter, BOOLEAN TimerOrWaitFired);
 338
 339 static HANDLE win32ChildQueue;
 340
 341 typedef struct
 342 {
 343         HANDLE          waitHandle;
 344         HANDLE          procHandle;
 345         DWORD           procId;
 346 }       win32_deadchild_waitinfo;
 347
 348 HANDLE          PostmasterHandle;
 349 #endif
 350
 351 static pid_t backend_forkexec(Port *port);
 352 static pid_t internal_forkexec(int argc, char *argv[], Port *port);
 353
 354 /* Type for a socket that can be inherited to a client process */
 355 #ifdef WIN32
 356 typedef struct
 357 {
 358         SOCKET          origsocket;             /* Original socket value, or -1 if not a
 359                                                                  * socket */
 360         WSAPROTOCOL_INFO wsainfo;
 361 }       InheritableSocket;
 362 #else
 363 typedef int InheritableSocket;
 364 #endif
 365
 366 typedef struct LWLock LWLock;   /* ugly kluge */
 367
 368 /*
 369  * Structure contains all variables passed to exec:ed backends
 370  */
 371 typedef struct
 372 {
 373         Port            port;
 374         InheritableSocket portsocket;
 375         char            DataDir[MAXPGPATH];
 376         int                     ListenSocket[MAXLISTEN];
 377         long            MyCancelKey;
 378         unsigned long UsedShmemSegID;
 379         void       *UsedShmemSegAddr;
 380         slock_t    *ShmemLock;
 381         VariableCache ShmemVariableCache;
 382         Backend    *ShmemBackendArray;
 383         LWLock     *LWLockArray;
 384         slock_t    *ProcStructLock;
 385         PROC_HDR   *ProcGlobal;
 386         PGPROC     *AuxiliaryProcs;
 387         InheritableSocket pgStatSock;
 388         pid_t           PostmasterPid;
 389         TimestampTz PgStartTime;
 390         bool            redirection_done;
 391 #ifdef WIN32
 392         HANDLE          PostmasterHandle;
 393         HANDLE          initial_signal_pipe;
 394         HANDLE          syslogPipe[2];
 395 #else
 396         int                     syslogPipe[2];
 397 #endif
 398         char            my_exec_path[MAXPGPATH];
 399         char            pkglib_path[MAXPGPATH];
 400         char            ExtraOptions[MAXPGPATH];
 401         char            lc_collate[LOCALE_NAME_BUFLEN];
 402         char            lc_ctype[LOCALE_NAME_BUFLEN];
 403 }       BackendParameters;
 404
 405 static void read_backend_variables(char *id, Port *port);
 406 static void restore_backend_variables(BackendParameters * param, Port *port);
 407
 408 #ifndef WIN32
 409 static bool save_backend_variables(BackendParameters * param, Port *port);
 410 #else
 411 static bool save_backend_variables(BackendParameters * param, Port *port,
 412                                            HANDLE childProcess, pid_t childPid);
 413 #endif
 414
 415 static void ShmemBackendArrayAdd(Backend *bn);
 416 static void ShmemBackendArrayRemove(pid_t pid);
 417 #endif   /* EXEC_BACKEND */
 418
 419 #define StartupDataBase()               StartChildProcess(StartupProcess)
 420 #define StartBackgroundWriter() StartChildProcess(BgWriterProcess)
 421 #define StartWalWriter()                StartChildProcess(WalWriterProcess)
 422
 423 /* Macros to check exit status of a child process */
 424 #define EXIT_STATUS_0(st)  ((st) == 0)
 425 #define EXIT_STATUS_1(st)  (WIFEXITED(st) && WEXITSTATUS(st) == 1)
 426
 427
 428 /*
 429  * Postmaster main entry point
 430  */
 431 int
 432 PostmasterMain(int argc, char *argv[])
 433 {
 434         int                     opt;
 435         int                     status;
 436         char       *userDoption = NULL;
 437         int                     i;
 438
 439         MyProcPid = PostmasterPid = getpid();
 440
 441         MyStartTime = time(NULL);
 442
 443         IsPostmasterEnvironment = true;
 444
 445         /*
 446          * for security, no dir or file created can be group or other accessible
 447          */
 448         umask((mode_t) 0077);
 449
 450         /*
 451          * Fire up essential subsystems: memory management
 452          */
 453         MemoryContextInit();
 454
 455         /*
 456          * By default, palloc() requests in the postmaster will be allocated in
 457          * the PostmasterContext, which is space that can be recycled by backends.
 458          * Allocated data that needs to be available to backends should be
 459          * allocated in TopMemoryContext.
 460          */
 461         PostmasterContext = AllocSetContextCreate(TopMemoryContext,
 462                                                                                           "Postmaster",
 463                                                                                           ALLOCSET_DEFAULT_MINSIZE,
 464                                                                                           ALLOCSET_DEFAULT_INITSIZE,
 465                                                                                           ALLOCSET_DEFAULT_MAXSIZE);
 466         MemoryContextSwitchTo(PostmasterContext);
 467
 468         if (find_my_exec(argv[0], my_exec_path) < 0)
 469                 elog(FATAL, "%s: could not locate my own executable path",
 470                          argv[0]);
 471
 472         get_pkglib_path(my_exec_path, pkglib_path);
 473
 474         /*
 475          * Options setup
 476          */
 477         InitializeGUCOptions();
 478
 479         opterr = 1;
 480
 481         /*
 482          * Parse command-line options.  CAUTION: keep this in sync with
 483          * tcop/postgres.c (the option sets should not conflict) and with the
 484          * common help() function in main/main.c.
 485          */
 486         while ((opt = getopt(argc, argv, "A:B:c:D:d:EeFf:h:ijk:lN:nOo:Pp:r:S:sTt:W:-:")) != -1)
 487         {
 488                 switch (opt)
 489                 {
 490                         case 'A':
 491                                 SetConfigOption("debug_assertions", optarg, PGC_POSTMASTER, PGC_S_ARGV);
 492                                 break;
 493
 494                         case 'B':
 495                                 SetConfigOption("shared_buffers", optarg, PGC_POSTMASTER, PGC_S_ARGV);
 496                                 break;
 497
 498                         case 'D':
 499                                 userDoption = optarg;
 500                                 break;
 501
 502                         case 'd':
 503                                 set_debug_options(atoi(optarg), PGC_POSTMASTER, PGC_S_ARGV);
 504                                 break;
 505
 506                         case 'E':
 507                                 SetConfigOption("log_statement", "all", PGC_POSTMASTER, PGC_S_ARGV);
 508                                 break;
 509
 510                         case 'e':
 511                                 SetConfigOption("datestyle", "euro", PGC_POSTMASTER, PGC_S_ARGV);
 512                                 break;
 513
 514                         case 'F':
 515                                 SetConfigOption("fsync", "false", PGC_POSTMASTER, PGC_S_ARGV);
 516                                 break;
 517
 518                         case 'f':
 519                                 if (!set_plan_disabling_options(optarg, PGC_POSTMASTER, PGC_S_ARGV))
 520                                 {
 521                                         write_stderr("%s: invalid argument for option -f: \"%s\"\n",
 522                                                                  progname, optarg);
 523                                         ExitPostmaster(1);
 524                                 }
 525                                 break;
 526
 527                         case 'h':
 528                                 SetConfigOption("listen_addresses", optarg, PGC_POSTMASTER, PGC_S_ARGV);
 529                                 break;
 530
 531                         case 'i':
 532                                 SetConfigOption("listen_addresses", "*", PGC_POSTMASTER, PGC_S_ARGV);
 533                                 break;
 534
 535                         case 'j':
 536                                 /* only used by interactive backend */
 537                                 break;
 538
 539                         case 'k':
 540                                 SetConfigOption("unix_socket_directory", optarg, PGC_POSTMASTER, PGC_S_ARGV);
 541                                 break;
 542
 543                         case 'l':
 544                                 SetConfigOption("ssl", "true", PGC_POSTMASTER, PGC_S_ARGV);
 545                                 break;
 546
 547                         case 'N':
 548                                 SetConfigOption("max_connections", optarg, PGC_POSTMASTER, PGC_S_ARGV);
 549                                 break;
 550
 551                         case 'n':
 552                                 /* Don't reinit shared mem after abnormal exit */
 553                                 Reinit = false;
 554                                 break;
 555
 556                         case 'O':
 557                                 SetConfigOption("allow_system_table_mods", "true", PGC_POSTMASTER, PGC_S_ARGV);
 558                                 break;
 559
 560                         case 'o':
 561                                 /* Other options to pass to the backend on the command line */
 562                                 snprintf(ExtraOptions + strlen(ExtraOptions),
 563                                                  sizeof(ExtraOptions) - strlen(ExtraOptions),
 564                                                  " %s", optarg);
 565                                 break;
 566
 567                         case 'P':
 568                                 SetConfigOption("ignore_system_indexes", "true", PGC_POSTMASTER, PGC_S_ARGV);
 569                                 break;
 570
 571                         case 'p':
 572                                 SetConfigOption("port", optarg, PGC_POSTMASTER, PGC_S_ARGV);
 573                                 break;
 574
 575                         case 'r':
 576                                 /* only used by single-user backend */
 577                                 break;
 578
 579                         case 'S':
 580                                 SetConfigOption("work_mem", optarg, PGC_POSTMASTER, PGC_S_ARGV);
 581                                 break;
 582
 583                         case 's':
 584                                 SetConfigOption("log_statement_stats", "true", PGC_POSTMASTER, PGC_S_ARGV);
 585                                 break;
 586
 587                         case 'T':
 588
 589                                 /*
 590                                  * In the event that some backend dumps core, send SIGSTOP,
 591                                  * rather than SIGQUIT, to all its peers.  This lets the wily
 592                                  * post_hacker collect core dumps from everyone.
 593                                  */
 594                                 SendStop = true;
 595                                 break;
 596
 597                         case 't':
 598                                 {
 599                                         const char *tmp = get_stats_option_name(optarg);
 600
 601                                         if (tmp)
 602                                         {
 603                                                 SetConfigOption(tmp, "true", PGC_POSTMASTER, PGC_S_ARGV);
 604                                         }
 605                                         else
 606                                         {
 607                                                 write_stderr("%s: invalid argument for option -t: \"%s\"\n",
 608                                                                          progname, optarg);
 609                                                 ExitPostmaster(1);
 610                                         }
 611                                         break;
 612                                 }
 613
 614                         case 'W':
 615                                 SetConfigOption("post_auth_delay", optarg, PGC_POSTMASTER, PGC_S_ARGV);
 616                                 break;
 617
 618                         case 'c':
 619                         case '-':
 620                                 {
 621                                         char       *name,
 622                                                            *value;
 623
 624                                         ParseLongOption(optarg, &name, &value);
 625                                         if (!value)
 626                                         {
 627                                                 if (opt == '-')
 628                                                         ereport(ERROR,
 629                                                                         (errcode(ERRCODE_SYNTAX_ERROR),
 630                                                                          errmsg("--%s requires a value",
 631                                                                                         optarg)));
 632                                                 else
 633                                                         ereport(ERROR,
 634                                                                         (errcode(ERRCODE_SYNTAX_ERROR),
 635                                                                          errmsg("-c %s requires a value",
 636                                                                                         optarg)));
 637                                         }
 638
 639                                         SetConfigOption(name, value, PGC_POSTMASTER, PGC_S_ARGV);
 640                                         free(name);
 641                                         if (value)
 642                                                 free(value);
 643                                         break;
 644                                 }
 645
 646                         default:
 647                                 write_stderr("Try \"%s --help\" for more information.\n",
 648                                                          progname);
 649                                 ExitPostmaster(1);
 650                 }
 651         }
 652
 653         /*
 654          * Postmaster accepts no non-option switch arguments.
 655          */
 656         if (optind < argc)
 657         {
 658                 write_stderr("%s: invalid argument: \"%s\"\n",
 659                                          progname, argv[optind]);
 660                 write_stderr("Try \"%s --help\" for more information.\n",
 661                                          progname);
 662                 ExitPostmaster(1);
 663         }
 664
 665 #ifdef EXEC_BACKEND
 666         /* Locate executable backend before we change working directory */
 667         if (find_other_exec(argv[0], "postgres", PG_VERSIONSTR,
 668                                                 postgres_exec_path) < 0)
 669                 ereport(FATAL,
 670                                 (errmsg("%s: could not locate matching postgres executable",
 671                                                 progname)));
 672 #endif
 673
 674         /*
 675          * Locate the proper configuration files and data directory, and read
 676          * postgresql.conf for the first time.
 677          */
 678         if (!SelectConfigFiles(userDoption, progname))
 679                 ExitPostmaster(2);
 680
 681         /* Verify that DataDir looks reasonable */
 682         checkDataDir();
 683
 684         /* And switch working directory into it */
 685         ChangeToDataDir();
 686
 687         /*
 688          * Check for invalid combinations of GUC settings.
 689          */
 690         if (NBuffers < 2 * MaxBackends || NBuffers < 16)
 691         {
 692                 /*
 693                  * Do not accept -B so small that backends are likely to starve for
 694                  * lack of buffers.  The specific choices here are somewhat arbitrary.
 695                  */
 696                 write_stderr("%s: the number of buffers (-B) must be at least twice the number of allowed connections (-N) and at least 16\n", progname);
 697                 ExitPostmaster(1);
 698         }
 699
 700         if (ReservedBackends >= MaxBackends)
 701         {
 702                 write_stderr("%s: superuser_reserved_connections must be less than max_connections\n", progname);
 703                 ExitPostmaster(1);
 704         }
 705
 706         /*
 707          * Other one-time internal sanity checks can go here, if they are fast.
 708          * (Put any slow processing further down, after postmaster.pid creation.)
 709          */
 710         if (!CheckDateTokenTables())
 711         {
 712                 write_stderr("%s: invalid datetoken tables, please fix\n", progname);
 713                 ExitPostmaster(1);
 714         }
 715
 716         /*
 717          * Now that we are done processing the postmaster arguments, reset
 718          * getopt(3) library so that it will work correctly in subprocesses.
 719          */
 720         optind = 1;
 721 #ifdef HAVE_INT_OPTRESET
 722         optreset = 1;                           /* some systems need this too */
 723 #endif
 724
 725         /* For debugging: display postmaster environment */
 726         {
 727                 extern char **environ;
 728                 char      **p;
 729
 730                 ereport(DEBUG3,
 731                                 (errmsg_internal("%s: PostmasterMain: initial environ dump:",
 732                                                                  progname)));
 733                 ereport(DEBUG3,
 734                          (errmsg_internal("-----------------------------------------")));
 735                 for (p = environ; *p; ++p)
 736                         ereport(DEBUG3,
 737                                         (errmsg_internal("\t%s", *p)));
 738                 ereport(DEBUG3,
 739                          (errmsg_internal("-----------------------------------------")));
 740         }
 741
 742         /*
 743          * Fork away from controlling terminal, if -S specified.
 744          *
 745          * Must do this before we grab any interlock files, else the interlocks
 746          * will show the wrong PID.
 747          */
 748         if (SilentMode)
 749                 pmdaemonize();
 750
 751         /*
 752          * Create lockfile for data directory.
 753          *
 754          * We want to do this before we try to grab the input sockets, because the
 755          * data directory interlock is more reliable than the socket-file
 756          * interlock (thanks to whoever decided to put socket files in /tmp :-().
 757          * For the same reason, it's best to grab the TCP socket(s) before the
 758          * Unix socket.
 759          */
 760         CreateDataDirLockFile(true);
 761
 762         /*
 763          * If timezone is not set, determine what the OS uses.  (In theory this
 764          * should be done during GUC initialization, but because it can take as
 765          * much as several seconds, we delay it until after we've created the
 766          * postmaster.pid file.  This prevents problems with boot scripts that
 767          * expect the pidfile to appear quickly.  Also, we avoid problems with
 768          * trying to locate the timezone files too early in initialization.)
 769          */
 770         pg_timezone_initialize();
 771
 772         /*
 773          * Likewise, init timezone_abbreviations if not already set.
 774          */
 775         pg_timezone_abbrev_initialize();
 776
 777         /*
 778          * Initialize SSL library, if specified.
 779          */
 780 #ifdef USE_SSL
 781         if (EnableSSL)
 782                 secure_initialize();
 783 #endif
 784
 785         /*
 786          * process any libraries that should be preloaded at postmaster start
 787          */
 788         process_shared_preload_libraries();
 789
 790         /*
 791          * Remove old temporary files.  At this point there can be no other
 792          * Postgres processes running in this directory, so this should be safe.
 793          */
 794         RemovePgTempFiles();
 795
 796         /*
 797          * Establish input sockets.
 798          */
 799         for (i = 0; i < MAXLISTEN; i++)
 800                 ListenSocket[i] = -1;
 801
 802         if (ListenAddresses)
 803         {
 804                 char       *rawstring;
 805                 List       *elemlist;
 806                 ListCell   *l;
 807                 int                     success = 0;
 808
 809                 /* Need a modifiable copy of ListenAddresses */
 810                 rawstring = pstrdup(ListenAddresses);
 811
 812                 /* Parse string into list of identifiers */
 813                 if (!SplitIdentifierString(rawstring, ',', &elemlist))
 814                 {
 815                         /* syntax error in list */
 816                         ereport(FATAL,
 817                                         (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
 818                                          errmsg("invalid list syntax for \"listen_addresses\"")));
 819                 }
 820
 821                 foreach(l, elemlist)
 822                 {
 823                         char       *curhost = (char *) lfirst(l);
 824
 825                         if (strcmp(curhost, "*") == 0)
 826                                 status = StreamServerPort(AF_UNSPEC, NULL,
 827                                                                                   (unsigned short) PostPortNumber,
 828                                                                                   UnixSocketDir,
 829                                                                                   ListenSocket, MAXLISTEN);
 830                         else
 831                                 status = StreamServerPort(AF_UNSPEC, curhost,
 832                                                                                   (unsigned short) PostPortNumber,
 833                                                                                   UnixSocketDir,
 834                                                                                   ListenSocket, MAXLISTEN);
 835                         if (status == STATUS_OK)
 836                                 success++;
 837                         else
 838                                 ereport(WARNING,
 839                                                 (errmsg("could not create listen socket for \"%s\"",
 840                                                                 curhost)));
 841                 }
 842
 843                 if (!success && list_length(elemlist))
 844                         ereport(FATAL,
 845                                         (errmsg("could not create any TCP/IP sockets")));
 846
 847                 list_free(elemlist);
 848                 pfree(rawstring);
 849         }
 850
 851 #ifdef USE_BONJOUR
 852         /* Register for Bonjour only if we opened TCP socket(s) */
 853         if (ListenSocket[0] != -1 && bonjour_name != NULL)
 854         {
 855                 DNSServiceRegistrationCreate(bonjour_name,
 856                                                                          "_postgresql._tcp.",
 857                                                                          "",
 858                                                                          htons(PostPortNumber),
 859                                                                          "",
 860                                                                          (DNSServiceRegistrationReply) reg_reply,
 861                                                                          NULL);
 862         }
 863 #endif
 864
 865 #ifdef HAVE_UNIX_SOCKETS
 866         status = StreamServerPort(AF_UNIX, NULL,
 867                                                           (unsigned short) PostPortNumber,
 868                                                           UnixSocketDir,
 869                                                           ListenSocket, MAXLISTEN);
 870         if (status != STATUS_OK)
 871                 ereport(WARNING,
 872                                 (errmsg("could not create Unix-domain socket")));
 873 #endif
 874
 875         /*
 876          * check that we have some socket to listen on
 877          */
 878         if (ListenSocket[0] == -1)
 879                 ereport(FATAL,
 880                                 (errmsg("no socket created for listening")));
 881
 882         /*
 883          * Set up shared memory and semaphores.
 884          */
 885         reset_shared(PostPortNumber);
 886
 887         /*
 888          * Estimate number of openable files.  This must happen after setting up
 889          * semaphores, because on some platforms semaphores count as open files.
 890          */
 891         set_max_safe_fds();
 892
 893         /*
 894          * Load configuration files for client authentication.
 895          */
 896         load_hba();
 897         load_ident();
 898
 899         /*
 900          * Initialize the list of active backends.
 901          */
 902         BackendList = DLNewList();
 903
 904 #ifdef WIN32
 905
 906         /*
 907          * Initialize I/O completion port used to deliver list of dead children.
 908          */
 909         win32ChildQueue = CreateIoCompletionPort(INVALID_HANDLE_VALUE, NULL, 0, 1);
 910         if (win32ChildQueue == NULL)
 911                 ereport(FATAL,
 912                    (errmsg("could not create I/O completion port for child queue")));
 913
 914         /*
 915          * Set up a handle that child processes can use to check whether the
 916          * postmaster is still running.
 917          */
 918         if (DuplicateHandle(GetCurrentProcess(),
 919                                                 GetCurrentProcess(),
 920                                                 GetCurrentProcess(),
 921                                                 &PostmasterHandle,
 922                                                 0,
 923                                                 TRUE,
 924                                                 DUPLICATE_SAME_ACCESS) == 0)
 925                 ereport(FATAL,
 926                                 (errmsg_internal("could not duplicate postmaster handle: error code %d",
 927                                                                  (int) GetLastError())));
 928 #endif
 929
 930         /*
 931          * Record postmaster options.  We delay this till now to avoid recording
 932          * bogus options (eg, NBuffers too high for available memory).
 933          */
 934         if (!CreateOptsFile(argc, argv, my_exec_path))
 935                 ExitPostmaster(1);
 936
 937 #ifdef EXEC_BACKEND
 938         /* Write out nondefault GUC settings for child processes to use */
 939         write_nondefault_variables(PGC_POSTMASTER);
 940 #endif
 941
 942         /*
 943          * Write the external PID file if requested
 944          */
 945         if (external_pid_file)
 946         {
 947                 FILE       *fpidfile = fopen(external_pid_file, "w");
 948
 949                 if (fpidfile)
 950                 {
 951                         fprintf(fpidfile, "%d\n", MyProcPid);
 952                         fclose(fpidfile);
 953                         /* Should we remove the pid file on postmaster exit? */
 954                 }
 955                 else
 956                         write_stderr("%s: could not write external PID file \"%s\": %s\n",
 957                                                  progname, external_pid_file, strerror(errno));
 958         }
 959
 960         /*
 961          * Set up signal handlers for the postmaster process.
 962          *
 963          * CAUTION: when changing this list, check for side-effects on the signal
 964          * handling setup of child processes.  See tcop/postgres.c,
 965          * bootstrap/bootstrap.c, postmaster/bgwriter.c, postmaster/walwriter.c,
 966          * postmaster/autovacuum.c, postmaster/pgarch.c, postmaster/pgstat.c, and
 967          * postmaster/syslogger.c.
 968          */
 969         pqinitmask();
 970         PG_SETMASK(&BlockSig);
 971
 972         pqsignal(SIGHUP, SIGHUP_handler);       /* reread config file and have
 973                                                                                  * children do same */
 974         pqsignal(SIGINT, pmdie);        /* send SIGTERM and shut down */
 975         pqsignal(SIGQUIT, pmdie);       /* send SIGQUIT and die */
 976         pqsignal(SIGTERM, pmdie);       /* wait for children and shut down */
 977         pqsignal(SIGALRM, SIG_IGN); /* ignored */
 978         pqsignal(SIGPIPE, SIG_IGN); /* ignored */
 979         pqsignal(SIGUSR1, sigusr1_handler); /* message from child process */
 980         pqsignal(SIGUSR2, dummy_handler);       /* unused, reserve for children */
 981         pqsignal(SIGCHLD, reaper);      /* handle child termination */
 982         pqsignal(SIGTTIN, SIG_IGN); /* ignored */
 983         pqsignal(SIGTTOU, SIG_IGN); /* ignored */
 984         /* ignore SIGXFSZ, so that ulimit violations work like disk full */
 985 #ifdef SIGXFSZ
 986         pqsignal(SIGXFSZ, SIG_IGN); /* ignored */
 987 #endif
 988
 989         /*
 990          * If enabled, start up syslogger collection subprocess
 991          */
 992         SysLoggerPID = SysLogger_Start();
 993
 994         /*
 995          * Reset whereToSendOutput from DestDebug (its starting state) to
 996          * DestNone. This stops ereport from sending log messages to stderr unless
 997          * Log_destination permits.  We don't do this until the postmaster is
 998          * fully launched, since startup failures may as well be reported to
 999          * stderr.
1000          */
1001         whereToSendOutput = DestNone;
1002
1003         /*
1004          * Initialize stats collection subsystem (this does NOT start the
1005          * collector process!)
1006          */
1007         pgstat_init();
1008
1009         /*
1010          * Initialize the autovacuum subsystem (again, no process start yet)
1011          */
1012         autovac_init();
1013
1014         /*
1015          * Remember postmaster startup time
1016          */
1017         PgStartTime = GetCurrentTimestamp();
1018         /* PostmasterRandom wants its own copy */
1019         gettimeofday(&random_start_time, NULL);
1020
1021         /*
1022          * We're ready to rock and roll...
1023          */
1024         StartupPID = StartupDataBase();
1025         Assert(StartupPID != 0);
1026         pmState = PM_STARTUP;
1027
1028         status = ServerLoop();
1029
1030         /*
1031          * ServerLoop probably shouldn't ever return, but if it does, close down.
1032          */
1033         ExitPostmaster(status != STATUS_OK);
1034
1035         return 0;                                       /* not reached */
1036 }
1037
1038
1039 /*
1040  * Validate the proposed data directory
1041  */
1042 static void
1043 checkDataDir(void)
1044 {
1045         char            path[MAXPGPATH];
1046         FILE       *fp;
1047         struct stat stat_buf;
1048
1049         Assert(DataDir);
1050
1051         if (stat(DataDir, &stat_buf) != 0)
1052         {
1053                 if (errno == ENOENT)
1054                         ereport(FATAL,
1055                                         (errcode_for_file_access(),
1056                                          errmsg("data directory \"%s\" does not exist",
1057                                                         DataDir)));
1058                 else
1059                         ereport(FATAL,
1060                                         (errcode_for_file_access(),
1061                                  errmsg("could not read permissions of directory \"%s\": %m",
1062                                                 DataDir)));
1063         }
1064
1065         /*
1066          * Check that the directory belongs to my userid; if not, reject.
1067          *
1068          * This check is an essential part of the interlock that prevents two
1069          * postmasters from starting in the same directory (see CreateLockFile()).
1070          * Do not remove or weaken it.
1071          *
1072          * XXX can we safely enable this check on Windows?
1073          */
1074 #if !defined(WIN32) && !defined(__CYGWIN__)
1075         if (stat_buf.st_uid != geteuid())
1076                 ereport(FATAL,
1077                                 (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
1078                                  errmsg("data directory \"%s\" has wrong ownership",
1079                                                 DataDir),
1080                                  errhint("The server must be started by the user that owns the data directory.")));
1081 #endif
1082
1083         /*
1084          * Check if the directory has group or world access.  If so, reject.
1085          *
1086          * It would be possible to allow weaker constraints (for example, allow
1087          * group access) but we cannot make a general assumption that that is
1088          * okay; for example there are platforms where nearly all users
1089          * customarily belong to the same group.  Perhaps this test should be
1090          * configurable.
1091          *
1092          * XXX temporarily suppress check when on Windows, because there may not
1093          * be proper support for Unix-y file permissions.  Need to think of a
1094          * reasonable check to apply on Windows.
1095          */
1096 #if !defined(WIN32) && !defined(__CYGWIN__)
1097         if (stat_buf.st_mode & (S_IRWXG | S_IRWXO))
1098                 ereport(FATAL,
1099                                 (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
1100                                  errmsg("data directory \"%s\" has group or world access",
1101                                                 DataDir),
1102                                  errdetail("Permissions should be u=rwx (0700).")));
1103 #endif
1104
1105         /* Look for PG_VERSION before looking for pg_control */
1106         ValidatePgVersion(DataDir);
1107
1108         snprintf(path, sizeof(path), "%s/global/pg_control", DataDir);
1109
1110         fp = AllocateFile(path, PG_BINARY_R);
1111         if (fp == NULL)
1112         {
1113                 write_stderr("%s: could not find the database system\n"
1114                                          "Expected to find it in the directory \"%s\",\n"
1115                                          "but could not open file \"%s\": %s\n",
1116                                          progname, DataDir, path, strerror(errno));
1117                 ExitPostmaster(2);
1118         }
1119         FreeFile(fp);
1120 }
1121
1122
1123 #ifdef USE_BONJOUR
1124
1125 /*
1126  * empty callback function for DNSServiceRegistrationCreate()
1127  */
1128 static void
1129 reg_reply(DNSServiceRegistrationReplyErrorType errorCode, void *context)
1130 {
1131 }
1132 #endif   /* USE_BONJOUR */
1133
1134
1135 /*
1136  * Fork away from the controlling terminal (-S option)
1137  */
1138 static void
1139 pmdaemonize(void)
1140 {
1141 #ifndef WIN32
1142         int                     i;
1143         pid_t           pid;
1144
1145         pid = fork_process();
1146         if (pid == (pid_t) -1)
1147         {
1148                 write_stderr("%s: could not fork background process: %s\n",
1149                                          progname, strerror(errno));
1150                 ExitPostmaster(1);
1151         }
1152         else if (pid)
1153         {                                                       /* parent */
1154                 /* Parent should just exit, without doing any atexit cleanup */
1155                 _exit(0);
1156         }
1157
1158         MyProcPid = PostmasterPid = getpid();           /* reset PID vars to child */
1159
1160         MyStartTime = time(NULL);
1161
1162         /*
1163          * GH: If there's no setsid(), we hopefully don't need silent mode. Until
1164          * there's a better solution.
1165          */
1166 #ifdef HAVE_SETSID
1167         if (setsid() < 0)
1168         {
1169                 write_stderr("%s: could not dissociate from controlling TTY: %s\n",
1170                                          progname, strerror(errno));
1171                 ExitPostmaster(1);
1172         }
1173 #endif
1174         i = open(NULL_DEV, O_RDWR, 0);
1175         dup2(i, 0);
1176         dup2(i, 1);
1177         dup2(i, 2);
1178         close(i);
1179 #else                                                   /* WIN32 */
1180         /* not supported */
1181         elog(FATAL, "SilentMode not supported under WIN32");
1182 #endif   /* WIN32 */
1183 }
1184
1185
1186 /*
1187  * Main idle loop of postmaster
1188  */
1189 static int
1190 ServerLoop(void)
1191 {
1192         fd_set          readmask;
1193         int                     nSockets;
1194         time_t          now,
1195                                 last_touch_time;
1196
1197         last_touch_time = time(NULL);
1198
1199         nSockets = initMasks(&readmask);
1200
1201         for (;;)
1202         {
1203                 fd_set          rmask;
1204                 int                     selres;
1205
1206                 /*
1207                  * Wait for a connection request to arrive.
1208                  *
1209                  * We wait at most one minute, to ensure that the other background
1210                  * tasks handled below get done even when no requests are arriving.
1211                  *
1212                  * If we are in PM_WAIT_DEAD_END state, then we don't want to accept
1213                  * any new connections, so we don't call select() at all; just sleep
1214                  * for a little bit with signals unblocked.
1215                  */
1216                 memcpy((char *) &rmask, (char *) &readmask, sizeof(fd_set));
1217
1218                 PG_SETMASK(&UnBlockSig);
1219
1220                 if (pmState == PM_WAIT_DEAD_END)
1221                 {
1222                         pg_usleep(100000L); /* 100 msec seems reasonable */
1223                         selres = 0;
1224                 }
1225                 else
1226                 {
1227                         /* must set timeout each time; some OSes change it! */
1228                         struct timeval timeout;
1229
1230                         timeout.tv_sec = 60;
1231                         timeout.tv_usec = 0;
1232
1233                         selres = select(nSockets, &rmask, NULL, NULL, &timeout);
1234                 }
1235
1236                 /*
1237                  * Block all signals until we wait again.  (This makes it safe for our
1238                  * signal handlers to do nontrivial work.)
1239                  */
1240                 PG_SETMASK(&BlockSig);
1241
1242                 /* Now check the select() result */
1243                 if (selres < 0)
1244                 {
1245                         if (errno != EINTR && errno != EWOULDBLOCK)
1246                         {
1247                                 ereport(LOG,
1248                                                 (errcode_for_socket_access(),
1249                                                  errmsg("select() failed in postmaster: %m")));
1250                                 return STATUS_ERROR;
1251                         }
1252                 }
1253
1254                 /*
1255                  * New connection pending on any of our sockets? If so, fork a child
1256                  * process to deal with it.
1257                  */
1258                 if (selres > 0)
1259                 {
1260                         int                     i;
1261
1262                         for (i = 0; i < MAXLISTEN; i++)
1263                         {
1264                                 if (ListenSocket[i] == -1)
1265                                         break;
1266                                 if (FD_ISSET(ListenSocket[i], &rmask))
1267                                 {
1268                                         Port       *port;
1269
1270                                         port = ConnCreate(ListenSocket[i]);
1271                                         if (port)
1272                                         {
1273                                                 BackendStartup(port);
1274
1275                                                 /*
1276                                                  * We no longer need the open socket or port structure
1277                                                  * in this process
1278                                                  */
1279                                                 StreamClose(port->sock);
1280                                                 ConnFree(port);
1281                                         }
1282                                 }
1283                         }
1284                 }
1285
1286                 /* If we have lost the log collector, try to start a new one */
1287                 if (SysLoggerPID == 0 && Logging_collector)
1288                         SysLoggerPID = SysLogger_Start();
1289
1290                 /*
1291                  * If no background writer process is running, and we are not in a
1292                  * state that prevents it, start one.  It doesn't matter if this
1293                  * fails, we'll just try again later.
1294                  */
1295                 if (BgWriterPID == 0 && pmState == PM_RUN)
1296                         BgWriterPID = StartBackgroundWriter();
1297
1298                 /*
1299                  * Likewise, if we have lost the walwriter process, try to start a new
1300                  * one.
1301                  */
1302                 if (WalWriterPID == 0 && pmState == PM_RUN)
1303                         WalWriterPID = StartWalWriter();
1304
1305                 /* If we have lost the autovacuum launcher, try to start a new one */
1306                 if (AutoVacPID == 0 &&
1307                         (AutoVacuumingActive() || start_autovac_launcher) &&
1308                         pmState == PM_RUN)
1309                 {
1310                         AutoVacPID = StartAutoVacLauncher();
1311                         if (AutoVacPID != 0)
1312                                 start_autovac_launcher = false; /* signal processed */
1313                 }
1314
1315                 /*
1316                  * If we have lost the archiver, try to start a new one. We do this
1317                  * even if we are shutting down, to allow archiver to take care of any
1318                  * remaining WAL files.
1319                  */
1320                 if (XLogArchivingActive() && PgArchPID == 0 && pmState >= PM_RUN)
1321                         PgArchPID = pgarch_start();
1322
1323                 /* If we have lost the stats collector, try to start a new one */
1324                 if (PgStatPID == 0 && pmState == PM_RUN)
1325                         PgStatPID = pgstat_start();
1326
1327                 /*
1328                  * Touch the socket and lock file every 58 minutes, to ensure that
1329                  * they are not removed by overzealous /tmp-cleaning tasks.  We assume
1330                  * no one runs cleaners with cutoff times of less than an hour ...
1331                  */
1332                 now = time(NULL);
1333                 if (now - last_touch_time >= 58 * SECS_PER_MINUTE)
1334                 {
1335                         TouchSocketFile();
1336                         TouchSocketLockFile();
1337                         last_touch_time = now;
1338                 }
1339         }
1340 }
1341
1342
1343 /*
1344  * Initialise the masks for select() for the ports we are listening on.
1345  * Return the number of sockets to listen on.
1346  */
1347 static int
1348 initMasks(fd_set *rmask)
1349 {
1350         int                     maxsock = -1;
1351         int                     i;
1352
1353         FD_ZERO(rmask);
1354
1355         for (i = 0; i < MAXLISTEN; i++)
1356         {
1357                 int                     fd = ListenSocket[i];
1358
1359                 if (fd == -1)
1360                         break;
1361                 FD_SET(fd, rmask);
1362                 if (fd > maxsock)
1363                         maxsock = fd;
1364         }
1365
1366         return maxsock + 1;
1367 }
1368
1369
1370 /*
1371  * Read a client's startup packet and do something according to it.
1372  *
1373  * Returns STATUS_OK or STATUS_ERROR, or might call ereport(FATAL) and
1374  * not return at all.
1375  *
1376  * (Note that ereport(FATAL) stuff is sent to the client, so only use it
1377  * if that's what you want.  Return STATUS_ERROR if you don't want to
1378  * send anything to the client, which would typically be appropriate
1379  * if we detect a communications failure.)
1380  */
1381 static int
1382 ProcessStartupPacket(Port *port, bool SSLdone)
1383 {
1384         int32           len;
1385         void       *buf;
1386         ProtocolVersion proto;
1387         MemoryContext oldcontext;
1388
1389         if (pq_getbytes((char *) &len, 4) == EOF)
1390         {
1391                 /*
1392                  * EOF after SSLdone probably means the client didn't like our
1393                  * response to NEGOTIATE_SSL_CODE.      That's not an error condition, so
1394                  * don't clutter the log with a complaint.
1395                  */
1396                 if (!SSLdone)
1397                         ereport(COMMERROR,
1398                                         (errcode(ERRCODE_PROTOCOL_VIOLATION),
1399                                          errmsg("incomplete startup packet")));
1400                 return STATUS_ERROR;
1401         }
1402
1403         len = ntohl(len);
1404         len -= 4;
1405
1406         if (len < (int32) sizeof(ProtocolVersion) ||
1407                 len > MAX_STARTUP_PACKET_LENGTH)
1408         {
1409                 ereport(COMMERROR,
1410                                 (errcode(ERRCODE_PROTOCOL_VIOLATION),
1411                                  errmsg("invalid length of startup packet")));
1412                 return STATUS_ERROR;
1413         }
1414
1415         /*
1416          * Allocate at least the size of an old-style startup packet, plus one
1417          * extra byte, and make sure all are zeroes.  This ensures we will have
1418          * null termination of all strings, in both fixed- and variable-length
1419          * packet layouts.
1420          */
1421         if (len <= (int32) sizeof(StartupPacket))
1422                 buf = palloc0(sizeof(StartupPacket) + 1);
1423         else
1424                 buf = palloc0(len + 1);
1425
1426         if (pq_getbytes(buf, len) == EOF)
1427         {
1428                 ereport(COMMERROR,
1429                                 (errcode(ERRCODE_PROTOCOL_VIOLATION),
1430                                  errmsg("incomplete startup packet")));
1431                 return STATUS_ERROR;
1432         }
1433
1434         /*
1435          * The first field is either a protocol version number or a special
1436          * request code.
1437          */
1438         port->proto = proto = ntohl(*((ProtocolVersion *) buf));
1439
1440         if (proto == CANCEL_REQUEST_CODE)
1441         {
1442                 processCancelRequest(port, buf);
1443                 return 127;                             /* XXX */
1444         }
1445
1446         if (proto == NEGOTIATE_SSL_CODE && !SSLdone)
1447         {
1448                 char            SSLok;
1449
1450 #ifdef USE_SSL
1451                 /* No SSL when disabled or on Unix sockets */
1452                 if (!EnableSSL || IS_AF_UNIX(port->laddr.addr.ss_family))
1453                         SSLok = 'N';
1454                 else
1455                         SSLok = 'S';            /* Support for SSL */
1456 #else
1457                 SSLok = 'N';                    /* No support for SSL */
1458 #endif
1459
1460 retry1:
1461                 if (send(port->sock, &SSLok, 1, 0) != 1)
1462                 {
1463                         if (errno == EINTR)
1464                                 goto retry1;    /* if interrupted, just retry */
1465                         ereport(COMMERROR,
1466                                         (errcode_for_socket_access(),
1467                                          errmsg("failed to send SSL negotiation response: %m")));
1468                         return STATUS_ERROR;    /* close the connection */
1469                 }
1470
1471 #ifdef USE_SSL
1472                 if (SSLok == 'S' && secure_open_server(port) == -1)
1473                         return STATUS_ERROR;
1474 #endif
1475                 /* regular startup packet, cancel, etc packet should follow... */
1476                 /* but not another SSL negotiation request */
1477                 return ProcessStartupPacket(port, true);
1478         }
1479
1480         /* Could add additional special packet types here */
1481
1482         /*
1483          * Set FrontendProtocol now so that ereport() knows what format to send if
1484          * we fail during startup.
1485          */
1486         FrontendProtocol = proto;
1487
1488         /* Check we can handle the protocol the frontend is using. */
1489
1490         if (PG_PROTOCOL_MAJOR(proto) < PG_PROTOCOL_MAJOR(PG_PROTOCOL_EARLIEST) ||
1491                 PG_PROTOCOL_MAJOR(proto) > PG_PROTOCOL_MAJOR(PG_PROTOCOL_LATEST) ||
1492                 (PG_PROTOCOL_MAJOR(proto) == PG_PROTOCOL_MAJOR(PG_PROTOCOL_LATEST) &&
1493                  PG_PROTOCOL_MINOR(proto) > PG_PROTOCOL_MINOR(PG_PROTOCOL_LATEST)))
1494                 ereport(FATAL,
1495                                 (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
1496                                  errmsg("unsupported frontend protocol %u.%u: server supports %u.0 to %u.%u",
1497                                                 PG_PROTOCOL_MAJOR(proto), PG_PROTOCOL_MINOR(proto),
1498                                                 PG_PROTOCOL_MAJOR(PG_PROTOCOL_EARLIEST),
1499                                                 PG_PROTOCOL_MAJOR(PG_PROTOCOL_LATEST),
1500                                                 PG_PROTOCOL_MINOR(PG_PROTOCOL_LATEST))));
1501
1502         /*
1503          * Now fetch parameters out of startup packet and save them into the Port
1504          * structure.  All data structures attached to the Port struct must be
1505          * allocated in TopMemoryContext so that they won't disappear when we pass
1506          * them to PostgresMain (see BackendRun).  We need not worry about leaking
1507          * this storage on failure, since we aren't in the postmaster process
1508          * anymore.
1509          */
1510         oldcontext = MemoryContextSwitchTo(TopMemoryContext);
1511
1512         if (PG_PROTOCOL_MAJOR(proto) >= 3)
1513         {
1514                 int32           offset = sizeof(ProtocolVersion);
1515
1516                 /*
1517                  * Scan packet body for name/option pairs.      We can assume any string
1518                  * beginning within the packet body is null-terminated, thanks to
1519                  * zeroing extra byte above.
1520                  */
1521                 port->guc_options = NIL;
1522
1523                 while (offset < len)
1524                 {
1525                         char       *nameptr = ((char *) buf) + offset;
1526                         int32           valoffset;
1527                         char       *valptr;
1528
1529                         if (*nameptr == '\0')
1530                                 break;                  /* found packet terminator */
1531                         valoffset = offset + strlen(nameptr) + 1;
1532                         if (valoffset >= len)
1533                                 break;                  /* missing value, will complain below */
1534                         valptr = ((char *) buf) + valoffset;
1535
1536                         if (strcmp(nameptr, "database") == 0)
1537                                 port->database_name = pstrdup(valptr);
1538                         else if (strcmp(nameptr, "user") == 0)
1539                                 port->user_name = pstrdup(valptr);
1540                         else if (strcmp(nameptr, "options") == 0)
1541                                 port->cmdline_options = pstrdup(valptr);
1542                         else
1543                         {
1544                                 /* Assume it's a generic GUC option */
1545                                 port->guc_options = lappend(port->guc_options,
1546                                                                                         pstrdup(nameptr));
1547                                 port->guc_options = lappend(port->guc_options,
1548                                                                                         pstrdup(valptr));
1549                         }
1550                         offset = valoffset + strlen(valptr) + 1;
1551                 }
1552
1553                 /*
1554                  * If we didn't find a packet terminator exactly at the end of the
1555                  * given packet length, complain.
1556                  */
1557                 if (offset != len - 1)
1558                         ereport(FATAL,
1559                                         (errcode(ERRCODE_PROTOCOL_VIOLATION),
1560                                          errmsg("invalid startup packet layout: expected terminator as last byte")));
1561         }
1562         else
1563         {
1564                 /*
1565                  * Get the parameters from the old-style, fixed-width-fields startup
1566                  * packet as C strings.  The packet destination was cleared first so a
1567                  * short packet has zeros silently added.  We have to be prepared to
1568                  * truncate the pstrdup result for oversize fields, though.
1569                  */
1570                 StartupPacket *packet = (StartupPacket *) buf;
1571
1572                 port->database_name = pstrdup(packet->database);
1573                 if (strlen(port->database_name) > sizeof(packet->database))
1574                         port->database_name[sizeof(packet->database)] = '\0';
1575                 port->user_name = pstrdup(packet->user);
1576                 if (strlen(port->user_name) > sizeof(packet->user))
1577                         port->user_name[sizeof(packet->user)] = '\0';
1578                 port->cmdline_options = pstrdup(packet->options);
1579                 if (strlen(port->cmdline_options) > sizeof(packet->options))
1580                         port->cmdline_options[sizeof(packet->options)] = '\0';
1581                 port->guc_options = NIL;
1582         }
1583
1584         /* Check a user name was given. */
1585         if (port->user_name == NULL || port->user_name[0] == '\0')
1586                 ereport(FATAL,
1587                                 (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
1588                          errmsg("no PostgreSQL user name specified in startup packet")));
1589
1590         /* The database defaults to the user name. */
1591         if (port->database_name == NULL || port->database_name[0] == '\0')
1592                 port->database_name = pstrdup(port->user_name);
1593
1594         if (Db_user_namespace)
1595         {
1596                 /*
1597                  * If user@, it is a global user, remove '@'. We only want to do this
1598                  * if there is an '@' at the end and no earlier in the user string or
1599                  * they may fake as a local user of another database attaching to this
1600                  * database.
1601                  */
1602                 if (strchr(port->user_name, '@') ==
1603                         port->user_name + strlen(port->user_name) - 1)
1604                         *strchr(port->user_name, '@') = '\0';
1605                 else
1606                 {
1607                         /* Append '@' and dbname */
1608                         char       *db_user;
1609
1610                         db_user = palloc(strlen(port->user_name) +
1611                                                          strlen(port->database_name) + 2);
1612                         sprintf(db_user, "%s@%s", port->user_name, port->database_name);
1613                         port->user_name = db_user;
1614                 }
1615         }
1616
1617         /*
1618          * Truncate given database and user names to length of a Postgres name.
1619          * This avoids lookup failures when overlength names are given.
1620          */
1621         if (strlen(port->database_name) >= NAMEDATALEN)
1622                 port->database_name[NAMEDATALEN - 1] = '\0';
1623         if (strlen(port->user_name) >= NAMEDATALEN)
1624                 port->user_name[NAMEDATALEN - 1] = '\0';
1625
1626         /*
1627          * Done putting stuff in TopMemoryContext.
1628          */
1629         MemoryContextSwitchTo(oldcontext);
1630
1631         /*
1632          * If we're going to reject the connection due to database state, say so
1633          * now instead of wasting cycles on an authentication exchange. (This also
1634          * allows a pg_ping utility to be written.)
1635          */
1636         switch (port->canAcceptConnections)
1637         {
1638                 case CAC_STARTUP:
1639                         ereport(FATAL,
1640                                         (errcode(ERRCODE_CANNOT_CONNECT_NOW),
1641                                          errmsg("the database system is starting up")));
1642                         break;
1643                 case CAC_SHUTDOWN:
1644                         ereport(FATAL,
1645                                         (errcode(ERRCODE_CANNOT_CONNECT_NOW),
1646                                          errmsg("the database system is shutting down")));
1647                         break;
1648                 case CAC_RECOVERY:
1649                         ereport(FATAL,
1650                                         (errcode(ERRCODE_CANNOT_CONNECT_NOW),
1651                                          errmsg("the database system is in recovery mode")));
1652                         break;
1653                 case CAC_TOOMANY:
1654                         ereport(FATAL,
1655                                         (errcode(ERRCODE_TOO_MANY_CONNECTIONS),
1656                                          errmsg("sorry, too many clients already")));
1657                         break;
1658                 case CAC_OK:
1659                         break;
1660         }
1661
1662         return STATUS_OK;
1663 }
1664
1665
1666 /*
1667  * The client has sent a cancel request packet, not a normal
1668  * start-a-new-connection packet.  Perform the necessary processing.
1669  * Nothing is sent back to the client.
1670  */
1671 static void
1672 processCancelRequest(Port *port, void *pkt)
1673 {
1674         CancelRequestPacket *canc = (CancelRequestPacket *) pkt;
1675         int                     backendPID;
1676         long            cancelAuthCode;
1677         Backend    *bp;
1678
1679 #ifndef EXEC_BACKEND
1680         Dlelem     *curr;
1681 #else
1682         int                     i;
1683 #endif
1684
1685         backendPID = (int) ntohl(canc->backendPID);
1686         cancelAuthCode = (long) ntohl(canc->cancelAuthCode);
1687
1688         /*
1689          * See if we have a matching backend.  In the EXEC_BACKEND case, we can no
1690          * longer access the postmaster's own backend list, and must rely on the
1691          * duplicate array in shared memory.
1692          */
1693 #ifndef EXEC_BACKEND
1694         for (curr = DLGetHead(BackendList); curr; curr = DLGetSucc(curr))
1695         {
1696                 bp = (Backend *) DLE_VAL(curr);
1697 #else
1698         for (i = 0; i < NUM_BACKENDARRAY_ELEMS; i++)
1699         {
1700                 bp = (Backend *) &ShmemBackendArray[i];
1701 #endif
1702                 if (bp->pid == backendPID)
1703                 {
1704                         if (bp->cancel_key == cancelAuthCode)
1705                         {
1706                                 /* Found a match; signal that backend to cancel current op */
1707                                 ereport(DEBUG2,
1708                                                 (errmsg_internal("processing cancel request: sending SIGINT to process %d",
1709                                                                                  backendPID)));
1710                                 signal_child(bp->pid, SIGINT);
1711                         }
1712                         else
1713                                 /* Right PID, wrong key: no way, Jose */
1714                                 ereport(LOG,
1715                                                 (errmsg("wrong key in cancel request for process %d",
1716                                                                 backendPID)));
1717                         return;
1718                 }
1719         }
1720
1721         /* No matching backend */
1722         ereport(LOG,
1723                         (errmsg("PID %d in cancel request did not match any process",
1724                                         backendPID)));
1725 }
1726
1727 /*
1728  * canAcceptConnections --- check to see if database state allows connections.
1729  */
1730 static enum CAC_state
1731 canAcceptConnections(void)
1732 {
1733         /* Can't start backends when in startup/shutdown/recovery state. */
1734         if (pmState != PM_RUN)
1735         {
1736                 if (Shutdown > NoShutdown)
1737                         return CAC_SHUTDOWN;    /* shutdown is pending */
1738                 if (pmState == PM_STARTUP && !FatalError)
1739                         return CAC_STARTUP; /* normal startup */
1740                 return CAC_RECOVERY;    /* else must be crash recovery */
1741         }
1742
1743         /*
1744          * Don't start too many children.
1745          *
1746          * We allow more connections than we can have backends here because some
1747          * might still be authenticating; they might fail auth, or some existing
1748          * backend might exit before the auth cycle is completed. The exact
1749          * MaxBackends limit is enforced when a new backend tries to join the
1750          * shared-inval backend array.
1751          *
1752          * In the EXEC_BACKEND case, the limit here must match the size of the
1753          * ShmemBackendArray, since all these processes will have cancel codes.
1754          */
1755         if (CountChildren() >= 2 * MaxBackends)
1756                 return CAC_TOOMANY;
1757
1758         return CAC_OK;
1759 }
1760
1761
1762 /*
1763  * ConnCreate -- create a local connection data structure
1764  */
1765 static Port *
1766 ConnCreate(int serverFd)
1767 {
1768         Port       *port;
1769
1770         if (!(port = (Port *) calloc(1, sizeof(Port))))
1771         {
1772                 ereport(LOG,
1773                                 (errcode(ERRCODE_OUT_OF_MEMORY),
1774                                  errmsg("out of memory")));
1775                 ExitPostmaster(1);
1776         }
1777
1778         if (StreamConnection(serverFd, port) != STATUS_OK)
1779         {
1780                 if (port->sock >= 0)
1781                         StreamClose(port->sock);
1782                 ConnFree(port);
1783                 port = NULL;
1784         }
1785         else
1786         {
1787                 /*
1788                  * Precompute password salt values to use for this connection. It's
1789                  * slightly annoying to do this long in advance of knowing whether
1790                  * we'll need 'em or not, but we must do the random() calls before we
1791                  * fork, not after.  Else the postmaster's random sequence won't get
1792                  * advanced, and all backends would end up using the same salt...
1793                  */
1794                 RandomSalt(port->cryptSalt, port->md5Salt);
1795         }
1796
1797         /*
1798          * Allocate GSSAPI specific state struct
1799          */
1800 #ifndef EXEC_BACKEND
1801 #if defined(ENABLE_GSS) || defined(ENABLE_SSPI)
1802         port->gss = (pg_gssinfo *) calloc(1, sizeof(pg_gssinfo));
1803         if (!port->gss)
1804         {
1805                 ereport(LOG,
1806                                 (errcode(ERRCODE_OUT_OF_MEMORY),
1807                                  errmsg("out of memory")));
1808                 ExitPostmaster(1);
1809         }
1810 #endif
1811 #endif
1812
1813         return port;
1814 }
1815
1816
1817 /*
1818  * ConnFree -- free a local connection data structure
1819  */
1820 static void
1821 ConnFree(Port *conn)
1822 {
1823 #ifdef USE_SSL
1824         secure_close(conn);
1825 #endif
1826         if (conn->gss)
1827                 free(conn->gss);
1828         free(conn);
1829 }
1830
1831
1832 /*
1833  * ClosePostmasterPorts -- close all the postmaster's open sockets
1834  *
1835  * This is called during child process startup to release file descriptors
1836  * that are not needed by that child process.  The postmaster still has
1837  * them open, of course.
1838  *
1839  * Note: we pass am_syslogger as a boolean because we don't want to set
1840  * the global variable yet when this is called.
1841  */
1842 void
1843 ClosePostmasterPorts(bool am_syslogger)
1844 {
1845         int                     i;
1846
1847         /* Close the listen sockets */
1848         for (i = 0; i < MAXLISTEN; i++)
1849         {
1850                 if (ListenSocket[i] != -1)
1851                 {
1852                         StreamClose(ListenSocket[i]);
1853                         ListenSocket[i] = -1;
1854                 }
1855         }
1856
1857         /* If using syslogger, close the read side of the pipe */
1858         if (!am_syslogger)
1859         {
1860 #ifndef WIN32
1861                 if (syslogPipe[0] >= 0)
1862                         close(syslogPipe[0]);
1863                 syslogPipe[0] = -1;
1864 #else
1865                 if (syslogPipe[0])
1866                         CloseHandle(syslogPipe[0]);
1867                 syslogPipe[0] = 0;
1868 #endif
1869         }
1870 }
1871
1872
1873 /*
1874  * reset_shared -- reset shared memory and semaphores
1875  */
1876 static void
1877 reset_shared(int port)
1878 {
1879         /*
1880          * Create or re-create shared memory and semaphores.
1881          *
1882          * Note: in each "cycle of life" we will normally assign the same IPC keys
1883          * (if using SysV shmem and/or semas), since the port number is used to
1884          * determine IPC keys.  This helps ensure that we will clean up dead IPC
1885          * objects if the postmaster crashes and is restarted.
1886          */
1887         CreateSharedMemoryAndSemaphores(false, port);
1888 }
1889
1890
1891 /*
1892  * SIGHUP -- reread config files, and tell children to do same
1893  */
1894 static void
1895 SIGHUP_handler(SIGNAL_ARGS)
1896 {
1897         int                     save_errno = errno;
1898
1899         PG_SETMASK(&BlockSig);
1900
1901         if (Shutdown <= SmartShutdown)
1902         {
1903                 ereport(LOG,
1904                                 (errmsg("received SIGHUP, reloading configuration files")));
1905                 ProcessConfigFile(PGC_SIGHUP);
1906                 SignalChildren(SIGHUP);
1907                 if (BgWriterPID != 0)
1908                         signal_child(BgWriterPID, SIGHUP);
1909                 if (WalWriterPID != 0)
1910                         signal_child(WalWriterPID, SIGHUP);
1911                 if (AutoVacPID != 0)
1912                         signal_child(AutoVacPID, SIGHUP);
1913                 if (PgArchPID != 0)
1914                         signal_child(PgArchPID, SIGHUP);
1915                 if (SysLoggerPID != 0)
1916                         signal_child(SysLoggerPID, SIGHUP);
1917                 /* PgStatPID does not currently need SIGHUP */
1918
1919                 /* Reload authentication config files too */
1920                 load_hba();
1921                 load_ident();
1922
1923 #ifdef EXEC_BACKEND
1924                 /* Update the starting-point file for future children */
1925                 write_nondefault_variables(PGC_SIGHUP);
1926 #endif
1927         }
1928
1929         PG_SETMASK(&UnBlockSig);
1930
1931         errno = save_errno;
1932 }
1933
1934
1935 /*
1936  * pmdie -- signal handler for processing various postmaster signals.
1937  */
1938 static void
1939 pmdie(SIGNAL_ARGS)
1940 {
1941         int                     save_errno = errno;
1942
1943         PG_SETMASK(&BlockSig);
1944
1945         ereport(DEBUG2,
1946                         (errmsg_internal("postmaster received signal %d",
1947                                                          postgres_signal_arg)));
1948
1949         switch (postgres_signal_arg)
1950         {
1951                 case SIGTERM:
1952
1953                         /*
1954                          * Smart Shutdown:
1955                          *
1956                          * Wait for children to end their work, then shut down.
1957                          */
1958                         if (Shutdown >= SmartShutdown)
1959                                 break;
1960                         Shutdown = SmartShutdown;
1961                         ereport(LOG,
1962                                         (errmsg("received smart shutdown request")));
1963
1964                         if (pmState == PM_RUN)
1965                         {
1966                                 /* autovacuum workers are told to shut down immediately */
1967                                 SignalAutovacWorkers(SIGTERM);
1968                                 /* and the autovac launcher too */
1969                                 if (AutoVacPID != 0)
1970                                         signal_child(AutoVacPID, SIGTERM);
1971                                 /* and the walwriter too */
1972                                 if (WalWriterPID != 0)
1973                                         signal_child(WalWriterPID, SIGTERM);
1974                                 pmState = PM_WAIT_BACKENDS;
1975                         }
1976
1977                         /*
1978                          * Now wait for backends to exit.  If there are none,
1979                          * PostmasterStateMachine will take the next step.
1980                          */
1981                         PostmasterStateMachine();
1982                         break;
1983
1984                 case SIGINT:
1985
1986                         /*
1987                          * Fast Shutdown:
1988                          *
1989                          * Abort all children with SIGTERM (rollback active transactions
1990                          * and exit) and shut down when they are gone.
1991                          */
1992                         if (Shutdown >= FastShutdown)
1993                                 break;
1994                         Shutdown = FastShutdown;
1995                         ereport(LOG,
1996                                         (errmsg("received fast shutdown request")));
1997
1998                         if (StartupPID != 0)
1999                                 signal_child(StartupPID, SIGTERM);
2000                         if (pmState == PM_RUN)
2001                         {
2002                                 ereport(LOG,
2003                                                 (errmsg("aborting any active transactions")));
2004                                 /* shut down all backends and autovac workers */
2005                                 SignalChildren(SIGTERM);
2006                                 /* and the autovac launcher too */
2007                                 if (AutoVacPID != 0)
2008                                         signal_child(AutoVacPID, SIGTERM);
2009                                 /* and the walwriter too */
2010                                 if (WalWriterPID != 0)
2011                                         signal_child(WalWriterPID, SIGTERM);
2012                                 pmState = PM_WAIT_BACKENDS;
2013                         }
2014
2015                         /*
2016                          * Now wait for backends to exit.  If there are none,
2017                          * PostmasterStateMachine will take the next step.
2018                          */
2019                         PostmasterStateMachine();
2020                         break;
2021
2022                 case SIGQUIT:
2023
2024                         /*
2025                          * Immediate Shutdown:
2026                          *
2027                          * abort all children with SIGQUIT and exit without attempt to
2028                          * properly shut down data base system.
2029                          */
2030                         ereport(LOG,
2031                                         (errmsg("received immediate shutdown request")));
2032                         SignalChildren(SIGQUIT);
2033                         if (StartupPID != 0)
2034                                 signal_child(StartupPID, SIGQUIT);
2035                         if (BgWriterPID != 0)
2036                                 signal_child(BgWriterPID, SIGQUIT);
2037                         if (WalWriterPID != 0)
2038                                 signal_child(WalWriterPID, SIGQUIT);
2039                         if (AutoVacPID != 0)
2040                                 signal_child(AutoVacPID, SIGQUIT);
2041                         if (PgArchPID != 0)
2042                                 signal_child(PgArchPID, SIGQUIT);
2043                         if (PgStatPID != 0)
2044                                 signal_child(PgStatPID, SIGQUIT);
2045                         ExitPostmaster(0);
2046                         break;
2047         }
2048
2049         PG_SETMASK(&UnBlockSig);
2050
2051         errno = save_errno;
2052 }
2053
2054 /*
2055  * Reaper -- signal handler to cleanup after a child process dies.
2056  */
2057 static void
2058 reaper(SIGNAL_ARGS)
2059 {
2060         int                     save_errno = errno;
2061         int                     pid;                    /* process id of dead child process */
2062         int                     exitstatus;             /* its exit status */
2063
2064         /* These macros hide platform variations in getting child status */
2065 #ifdef HAVE_WAITPID
2066         int                     status;                 /* child exit status */
2067
2068 #define LOOPTEST()              ((pid = waitpid(-1, &status, WNOHANG)) > 0)
2069 #define LOOPHEADER()    (exitstatus = status)
2070 #else                                                   /* !HAVE_WAITPID */
2071 #ifndef WIN32
2072         union wait      status;                 /* child exit status */
2073
2074 #define LOOPTEST()              ((pid = wait3(&status, WNOHANG, NULL)) > 0)
2075 #define LOOPHEADER()    (exitstatus = status.w_status)
2076 #else                                                   /* WIN32 */
2077 #define LOOPTEST()              ((pid = win32_waitpid(&exitstatus)) > 0)
2078 #define LOOPHEADER()
2079 #endif   /* WIN32 */
2080 #endif   /* HAVE_WAITPID */
2081
2082         PG_SETMASK(&BlockSig);
2083
2084         ereport(DEBUG4,
2085                         (errmsg_internal("reaping dead processes")));
2086
2087         while (LOOPTEST())
2088         {
2089                 LOOPHEADER();
2090
2091                 /*
2092                  * Check if this child was a startup process.
2093                  */
2094                 if (pid == StartupPID)
2095                 {
2096                         StartupPID = 0;
2097                         Assert(pmState == PM_STARTUP);
2098
2099                         /* FATAL exit of startup is treated as catastrophic */
2100                         if (!EXIT_STATUS_0(exitstatus))
2101                         {
2102                                 LogChildExit(LOG, _("startup process"),
2103                                                          pid, exitstatus);
2104                                 ereport(LOG,
2105                                 (errmsg("aborting startup due to startup process failure")));
2106                                 ExitPostmaster(1);
2107                         }
2108
2109                         /*
2110                          * Startup succeeded - we are done with system startup or
2111                          * recovery.
2112                          */
2113                         FatalError = false;
2114
2115                         /*
2116                          * Go to shutdown mode if a shutdown request was pending.
2117                          */
2118                         if (Shutdown > NoShutdown)
2119                         {
2120                                 pmState = PM_WAIT_BACKENDS;
2121                                 /* PostmasterStateMachine logic does the rest */
2122                                 continue;
2123                         }
2124
2125                         /*
2126                          * Otherwise, commence normal operations.
2127                          */
2128                         pmState = PM_RUN;
2129
2130                         /*
2131                          * Load the flat authorization file into postmaster's cache. The
2132                          * startup process has recomputed this from the database contents,
2133                          * so we wait till it finishes before loading it.
2134                          */
2135                         load_role();
2136
2137                         /*
2138                          * Crank up the background writer.      It doesn't matter if this
2139                          * fails, we'll just try again later.
2140                          */
2141                         Assert(BgWriterPID == 0);
2142                         BgWriterPID = StartBackgroundWriter();
2143
2144                         /*
2145                          * Likewise, start other special children as needed.  In a restart
2146                          * situation, some of them may be alive already.
2147                          */
2148                         if (WalWriterPID == 0)
2149                                 WalWriterPID = StartWalWriter();
2150                         if (AutoVacuumingActive() && AutoVacPID == 0)
2151                                 AutoVacPID = StartAutoVacLauncher();
2152                         if (XLogArchivingActive() && PgArchPID == 0)
2153                                 PgArchPID = pgarch_start();
2154                         if (PgStatPID == 0)
2155                                 PgStatPID = pgstat_start();
2156
2157                         /* at this point we are really open for business */
2158                         ereport(LOG,
2159                                  (errmsg("database system is ready to accept connections")));
2160
2161                         continue;
2162                 }
2163
2164                 /*
2165                  * Was it the bgwriter?
2166                  */
2167                 if (pid == BgWriterPID)
2168                 {
2169                         BgWriterPID = 0;
2170                         if (EXIT_STATUS_0(exitstatus) && pmState == PM_SHUTDOWN)
2171                         {
2172                                 /*
2173                                  * OK, we saw normal exit of the bgwriter after it's been told
2174                                  * to shut down.  We expect that it wrote a shutdown
2175                                  * checkpoint.  (If for some reason it didn't, recovery will
2176                                  * occur on next postmaster start.)
2177                                  *
2178                                  * At this point we should have no normal children left (else
2179                                  * we'd not be in PM_SHUTDOWN state) but we might have
2180                                  * dead_end children.
2181                                  */
2182                                 Assert(Shutdown > NoShutdown);
2183                                 pmState = PM_WAIT_DEAD_END;
2184                         }
2185                         else
2186                         {
2187                                 /*
2188                                  * Any unexpected exit of the bgwriter (including FATAL exit)
2189                                  * is treated as a crash.
2190                                  */
2191                                 HandleChildCrash(pid, exitstatus,
2192                                                                  _("background writer process"));
2193                         }
2194
2195                         continue;
2196                 }
2197
2198                 /*
2199                  * Was it the wal writer?  Normal exit can be ignored; we'll start a
2200                  * new one at the next iteration of the postmaster's main loop, if
2201                  * necessary.  Any other exit condition is treated as a crash.
2202                  */
2203                 if (pid == WalWriterPID)
2204                 {
2205                         WalWriterPID = 0;
2206                         if (!EXIT_STATUS_0(exitstatus))
2207                                 HandleChildCrash(pid, exitstatus,
2208                                                                  _("WAL writer process"));
2209                         continue;
2210                 }
2211
2212                 /*
2213                  * Was it the autovacuum launcher?      Normal exit can be ignored; we'll
2214                  * start a new one at the next iteration of the postmaster's main
2215                  * loop, if necessary.  Any other exit condition is treated as a
2216                  * crash.
2217                  */
2218                 if (pid == AutoVacPID)
2219                 {
2220                         AutoVacPID = 0;
2221                         if (!EXIT_STATUS_0(exitstatus))
2222                                 HandleChildCrash(pid, exitstatus,
2223                                                                  _("autovacuum launcher process"));
2224                         continue;
2225                 }
2226
2227                 /*
2228                  * Was it the archiver?  If so, just try to start a new one; no need
2229                  * to force reset of the rest of the system.  (If fail, we'll try
2230                  * again in future cycles of the main loop.)
2231                  */
2232                 if (pid == PgArchPID)
2233                 {
2234                         PgArchPID = 0;
2235                         if (!EXIT_STATUS_0(exitstatus))
2236                                 LogChildExit(LOG, _("archiver process"),
2237                                                          pid, exitstatus);
2238                         if (XLogArchivingActive() && pmState >= PM_RUN)
2239                                 PgArchPID = pgarch_start();
2240                         continue;
2241                 }
2242
2243                 /*
2244                  * Was it the statistics collector?  If so, just try to start a new
2245                  * one; no need to force reset of the rest of the system.  (If fail,
2246                  * we'll try again in future cycles of the main loop.)
2247                  */
2248                 if (pid == PgStatPID)
2249                 {
2250                         PgStatPID = 0;
2251                         if (!EXIT_STATUS_0(exitstatus))
2252                                 LogChildExit(LOG, _("statistics collector process"),
2253                                                          pid, exitstatus);
2254                         if (pmState == PM_RUN)
2255                                 PgStatPID = pgstat_start();
2256                         continue;
2257                 }
2258
2259                 /* Was it the system logger?  If so, try to start a new one */
2260                 if (pid == SysLoggerPID)
2261                 {
2262                         SysLoggerPID = 0;
2263                         /* for safety's sake, launch new logger *first* */
2264                         SysLoggerPID = SysLogger_Start();
2265                         if (!EXIT_STATUS_0(exitstatus))
2266                                 LogChildExit(LOG, _("system logger process"),
2267                                                          pid, exitstatus);
2268                         continue;
2269                 }
2270
2271                 /*
2272                  * Else do standard backend child cleanup.
2273                  */
2274                 CleanupBackend(pid, exitstatus);
2275         }                                                       /* loop over pending child-death reports */
2276
2277         /*
2278          * After cleaning out the SIGCHLD queue, see if we have any state changes
2279          * or actions to make.
2280          */
2281         PostmasterStateMachine();
2282
2283         /* Done with signal handler */
2284         PG_SETMASK(&UnBlockSig);
2285
2286         errno = save_errno;
2287 }
2288
2289
2290 /*
2291  * CleanupBackend -- cleanup after terminated backend.
2292  *
2293  * Remove all local state associated with backend.
2294  */
2295 static void
2296 CleanupBackend(int pid,
2297                            int exitstatus)      /* child's exit status. */
2298 {
2299         Dlelem     *curr;
2300
2301         LogChildExit(DEBUG2, _("server process"), pid, exitstatus);
2302
2303         /*
2304          * If a backend dies in an ugly way then we must signal all other backends
2305          * to quickdie.  If exit status is zero (normal) or one (FATAL exit), we
2306          * assume everything is all right and simply remove the backend from the
2307          * active backend list.
2308          */
2309         if (!EXIT_STATUS_0(exitstatus) && !EXIT_STATUS_1(exitstatus))
2310         {
2311                 HandleChildCrash(pid, exitstatus, _("server process"));
2312                 return;
2313         }
2314
2315         for (curr = DLGetHead(BackendList); curr; curr = DLGetSucc(curr))
2316         {
2317                 Backend    *bp = (Backend *) DLE_VAL(curr);
2318
2319                 if (bp->pid == pid)
2320                 {
2321 #ifdef EXEC_BACKEND
2322                         if (!bp->dead_end)
2323                                 ShmemBackendArrayRemove(pid);
2324 #endif
2325                         DLRemove(curr);
2326                         free(bp);
2327                         DLFreeElem(curr);
2328                         break;
2329                 }
2330         }
2331 }
2332
2333 /*
2334  * HandleChildCrash -- cleanup after failed backend, bgwriter, walwriter,
2335  * or autovacuum.
2336  *
2337  * The objectives here are to clean up our local state about the child
2338  * process, and to signal all other remaining children to quickdie.
2339  */
2340 static void
2341 HandleChildCrash(int pid, int exitstatus, const char *procname)
2342 {
2343         Dlelem     *curr,
2344                            *next;
2345         Backend    *bp;
2346
2347         /*
2348          * Make log entry unless there was a previous crash (if so, nonzero exit
2349          * status is to be expected in SIGQUIT response; don't clutter log)
2350          */
2351         if (!FatalError)
2352         {
2353                 LogChildExit(LOG, procname, pid, exitstatus);
2354                 ereport(LOG,
2355                                 (errmsg("terminating any other active server processes")));
2356         }
2357
2358         /* Process regular backends */
2359         for (curr = DLGetHead(BackendList); curr; curr = next)
2360         {
2361                 next = DLGetSucc(curr);
2362                 bp = (Backend *) DLE_VAL(curr);
2363                 if (bp->pid == pid)
2364                 {
2365                         /*
2366                          * Found entry for freshly-dead backend, so remove it.
2367                          */
2368 #ifdef EXEC_BACKEND
2369                         if (!bp->dead_end)
2370                                 ShmemBackendArrayRemove(pid);
2371 #endif
2372                         DLRemove(curr);
2373                         free(bp);
2374                         DLFreeElem(curr);
2375                         /* Keep looping so we can signal remaining backends */
2376                 }
2377                 else
2378                 {
2379                         /*
2380                          * This backend is still alive.  Unless we did so already, tell it
2381                          * to commit hara-kiri.
2382                          *
2383                          * SIGQUIT is the special signal that says exit without proc_exit
2384                          * and let the user know what's going on. But if SendStop is set
2385                          * (-s on command line), then we send SIGSTOP instead, so that we
2386                          * can get core dumps from all backends by hand.
2387                          *
2388                          * We could exclude dead_end children here, but at least in the
2389                          * SIGSTOP case it seems better to include them.
2390                          */
2391                         if (!FatalError)
2392                         {
2393                                 ereport(DEBUG2,
2394                                                 (errmsg_internal("sending %s to process %d",
2395                                                                                  (SendStop ? "SIGSTOP" : "SIGQUIT"),
2396                                                                                  (int) bp->pid)));
2397                                 signal_child(bp->pid, (SendStop ? SIGSTOP : SIGQUIT));
2398                         }
2399                 }
2400         }
2401
2402         /* Take care of the bgwriter too */
2403         if (pid == BgWriterPID)
2404                 BgWriterPID = 0;
2405         else if (BgWriterPID != 0 && !FatalError)
2406         {
2407                 ereport(DEBUG2,
2408                                 (errmsg_internal("sending %s to process %d",
2409                                                                  (SendStop ? "SIGSTOP" : "SIGQUIT"),
2410                                                                  (int) BgWriterPID)));
2411                 signal_child(BgWriterPID, (SendStop ? SIGSTOP : SIGQUIT));
2412         }
2413
2414         /* Take care of the walwriter too */
2415         if (pid == WalWriterPID)
2416                 WalWriterPID = 0;
2417         else if (WalWriterPID != 0 && !FatalError)
2418         {
2419                 ereport(DEBUG2,
2420                                 (errmsg_internal("sending %s to process %d",
2421                                                                  (SendStop ? "SIGSTOP" : "SIGQUIT"),
2422                                                                  (int) WalWriterPID)));
2423                 signal_child(WalWriterPID, (SendStop ? SIGSTOP : SIGQUIT));
2424         }
2425
2426         /* Take care of the autovacuum launcher too */
2427         if (pid == AutoVacPID)
2428                 AutoVacPID = 0;
2429         else if (AutoVacPID != 0 && !FatalError)
2430         {
2431                 ereport(DEBUG2,
2432                                 (errmsg_internal("sending %s to process %d",
2433                                                                  (SendStop ? "SIGSTOP" : "SIGQUIT"),
2434                                                                  (int) AutoVacPID)));
2435                 signal_child(AutoVacPID, (SendStop ? SIGSTOP : SIGQUIT));
2436         }
2437
2438         /*
2439          * Force a power-cycle of the pgarch process too.  (This isn't absolutely
2440          * necessary, but it seems like a good idea for robustness, and it
2441          * simplifies the state-machine logic in the case where a shutdown request
2442          * arrives during crash processing.)
2443          */
2444         if (PgArchPID != 0 && !FatalError)
2445         {
2446                 ereport(DEBUG2,
2447                                 (errmsg_internal("sending %s to process %d",
2448                                                                  "SIGQUIT",
2449                                                                  (int) PgArchPID)));
2450                 signal_child(PgArchPID, SIGQUIT);
2451         }
2452
2453         /*
2454          * Force a power-cycle of the pgstat process too.  (This isn't absolutely
2455          * necessary, but it seems like a good idea for robustness, and it
2456          * simplifies the state-machine logic in the case where a shutdown request
2457          * arrives during crash processing.)
2458          */
2459         if (PgStatPID != 0 && !FatalError)
2460         {
2461                 ereport(DEBUG2,
2462                                 (errmsg_internal("sending %s to process %d",
2463                                                                  "SIGQUIT",
2464                                                                  (int) PgStatPID)));
2465                 signal_child(PgStatPID, SIGQUIT);
2466                 allow_immediate_pgstat_restart();
2467         }
2468
2469         /* We do NOT restart the syslogger */
2470
2471         FatalError = true;
2472         /* We now transit into a state of waiting for children to die */
2473         if (pmState == PM_RUN || pmState == PM_SHUTDOWN)
2474                 pmState = PM_WAIT_BACKENDS;
2475 }
2476
2477 /*
2478  * Log the death of a child process.
2479  */
2480 static void
2481 LogChildExit(int lev, const char *procname, int pid, int exitstatus)
2482 {
2483         if (WIFEXITED(exitstatus))
2484                 ereport(lev,
2485
2486                 /*------
2487                   translator: %s is a noun phrase describing a child process, such as
2488                   "server process" */
2489                                 (errmsg("%s (PID %d) exited with exit code %d",
2490                                                 procname, pid, WEXITSTATUS(exitstatus))));
2491         else if (WIFSIGNALED(exitstatus))
2492 #if defined(WIN32)
2493                 ereport(lev,
2494
2495                 /*------
2496                   translator: %s is a noun phrase describing a child process, such as
2497                   "server process" */
2498                                 (errmsg("%s (PID %d) was terminated by exception 0x%X",
2499                                                 procname, pid, WTERMSIG(exitstatus)),
2500                                  errhint("See C include file \"ntstatus.h\" for a description of the hexadecimal value.")));
2501 #elif defined(HAVE_DECL_SYS_SIGLIST) && HAVE_DECL_SYS_SIGLIST
2502         ereport(lev,
2503
2504         /*------
2505           translator: %s is a noun phrase describing a child process, such as
2506           "server process" */
2507                         (errmsg("%s (PID %d) was terminated by signal %d: %s",
2508                                         procname, pid, WTERMSIG(exitstatus),
2509                                         WTERMSIG(exitstatus) < NSIG ?
2510                                         sys_siglist[WTERMSIG(exitstatus)] : "(unknown)")));
2511 #else
2512                 ereport(lev,
2513
2514                 /*------
2515                   translator: %s is a noun phrase describing a child process, such as
2516                   "server process" */
2517                                 (errmsg("%s (PID %d) was terminated by signal %d",
2518                                                 procname, pid, WTERMSIG(exitstatus))));
2519 #endif
2520         else
2521                 ereport(lev,
2522
2523                 /*------
2524                   translator: %s is a noun phrase describing a child process, such as
2525                   "server process" */
2526                                 (errmsg("%s (PID %d) exited with unrecognized status %d",
2527                                                 procname, pid, exitstatus)));
2528 }
2529
2530 /*
2531  * Advance the postmaster's state machine and take actions as appropriate
2532  *
2533  * This is common code for pmdie() and reaper(), which receive the signals
2534  * that might mean we need to change state.
2535  */
2536 static void
2537 PostmasterStateMachine(void)
2538 {
2539         /*
2540          * If we are in a state-machine state that implies waiting for backends to
2541          * exit, see if they're all gone, and change state if so.
2542          */
2543         if (pmState == PM_WAIT_BACKENDS)
2544         {
2545                 /*
2546                  * PM_WAIT_BACKENDS state ends when we have no regular backends
2547                  * (including autovac workers) and no walwriter or autovac launcher.
2548                  * If we are doing crash recovery then we expect the bgwriter to exit
2549                  * too, otherwise not.  The archiver, stats, and syslogger processes
2550                  * are disregarded since they are not connected to shared memory; we
2551                  * also disregard dead_end children here.
2552                  */
2553                 if (CountChildren() == 0 &&
2554                         StartupPID == 0 &&
2555                         (BgWriterPID == 0 || !FatalError) &&
2556                         WalWriterPID == 0 &&
2557                         AutoVacPID == 0)
2558                 {
2559                         if (FatalError)
2560                         {
2561                                 /*
2562                                  * Start waiting for dead_end children to die.  This state
2563                                  * change causes ServerLoop to stop creating new ones.
2564                                  */
2565                                 pmState = PM_WAIT_DEAD_END;
2566                         }
2567                         else
2568                         {
2569                                 /*
2570                                  * If we get here, we are proceeding with normal shutdown. All
2571                                  * the regular children are gone, and it's time to tell the
2572                                  * bgwriter to do a shutdown checkpoint.
2573                                  */
2574                                 Assert(Shutdown > NoShutdown);
2575                                 /* Start the bgwriter if not running */
2576                                 if (BgWriterPID == 0)
2577                                         BgWriterPID = StartBackgroundWriter();
2578                                 /* And tell it to shut down */
2579                                 if (BgWriterPID != 0)
2580                                 {
2581                                         signal_child(BgWriterPID, SIGUSR2);
2582                                         pmState = PM_SHUTDOWN;
2583                                 }
2584                                 else
2585                                 {
2586                                         /*
2587                                          * If we failed to fork a bgwriter, just shut down. Any
2588                                          * required cleanup will happen at next restart. We set
2589                                          * FatalError so that an "abnormal shutdown" message gets
2590                                          * logged when we exit.
2591                                          */
2592                                         FatalError = true;
2593                                         pmState = PM_WAIT_DEAD_END;
2594                                 }
2595                                 /* Tell pgarch to shut down too; nothing left for it to do */
2596                                 if (PgArchPID != 0)
2597                                         signal_child(PgArchPID, SIGQUIT);
2598                                 /* Tell pgstat to shut down too; nothing left for it to do */
2599                                 if (PgStatPID != 0)
2600                                         signal_child(PgStatPID, SIGQUIT);
2601                         }
2602                 }
2603         }
2604
2605         if (pmState == PM_WAIT_DEAD_END)
2606         {
2607                 /*
2608                  * PM_WAIT_DEAD_END state ends when the BackendList is entirely empty
2609                  * (ie, no dead_end children remain).
2610                  */
2611                 if (!DLGetHead(BackendList))
2612                 {
2613                         /* These other guys should be dead already */
2614                         Assert(StartupPID == 0);
2615                         Assert(BgWriterPID == 0);
2616                         Assert(WalWriterPID == 0);
2617                         Assert(AutoVacPID == 0);
2618                         /* archiver, stats, and syslogger are not considered here */
2619                         pmState = PM_NO_CHILDREN;
2620                 }
2621         }
2622
2623         /*
2624          * If we've been told to shut down, we exit as soon as there are no
2625          * remaining children.  If there was a crash, cleanup will occur at the
2626          * next startup.  (Before PostgreSQL 8.3, we tried to recover from the
2627          * crash before exiting, but that seems unwise if we are quitting because
2628          * we got SIGTERM from init --- there may well not be time for recovery
2629          * before init decides to SIGKILL us.)
2630          *
2631          * Note: we do not wait around for exit of the archiver or stats
2632          * processes.  They've been sent SIGQUIT by this point (either when we
2633          * entered PM_SHUTDOWN state, or when we set FatalError, and at least one
2634          * of those must have happened by now).  In any case they contain logic to
2635          * commit hara-kiri if they notice the postmaster is gone.      Since they
2636          * aren't connected to shared memory, they pose no problem for shutdown.
2637          * The syslogger is not considered either, since it's intended to survive
2638          * till the postmaster exits.
2639          */
2640         if (Shutdown > NoShutdown && pmState == PM_NO_CHILDREN)
2641         {
2642                 if (FatalError)
2643                 {
2644                         ereport(LOG, (errmsg("abnormal database system shutdown")));
2645                         ExitPostmaster(1);
2646                 }
2647                 else
2648                 {
2649                         /* Normal exit from the postmaster is here */
2650                         ExitPostmaster(0);
2651                 }
2652         }
2653
2654         /*
2655          * If we need to recover from a crash, wait for all shmem-connected
2656          * children to exit, then reset shmem and StartupDataBase.      (We can ignore
2657          * the archiver and stats processes here since they are not connected to
2658          * shmem.)
2659          */
2660         if (FatalError && pmState == PM_NO_CHILDREN)
2661         {
2662                 ereport(LOG,
2663                                 (errmsg("all server processes terminated; reinitializing")));
2664
2665                 shmem_exit(0);
2666                 reset_shared(PostPortNumber);
2667
2668                 StartupPID = StartupDataBase();
2669                 Assert(StartupPID != 0);
2670                 pmState = PM_STARTUP;
2671         }
2672 }
2673
2674
2675 /*
2676  * Send a signal to a postmaster child process
2677  *
2678  * On systems that have setsid(), each child process sets itself up as a
2679  * process group leader.  For signals that are generally interpreted in the
2680  * appropriate fashion, we signal the entire process group not just the
2681  * direct child process.  This allows us to, for example, SIGQUIT a blocked
2682  * archive_recovery script, or SIGINT a script being run by a backend via
2683  * system().
2684  *
2685  * There is a race condition for recently-forked children: they might not
2686  * have executed setsid() yet.  So we signal the child directly as well as
2687  * the group.  We assume such a child will handle the signal before trying
2688  * to spawn any grandchild processes.  We also assume that signaling the
2689  * child twice will not cause any problems.
2690  */
2691 static void
2692 signal_child(pid_t pid, int signal)
2693 {
2694         if (kill(pid, signal) < 0)
2695                 elog(DEBUG3, "kill(%ld,%d) failed: %m", (long) pid, signal);
2696 #ifdef HAVE_SETSID
2697         switch (signal)
2698         {
2699                 case SIGINT:
2700                 case SIGTERM:
2701                 case SIGQUIT:
2702                 case SIGSTOP:
2703                         if (kill(-pid, signal) < 0)
2704                                 elog(DEBUG3, "kill(%ld,%d) failed: %m", (long) (-pid), signal);
2705                         break;
2706                 default:
2707                         break;
2708         }
2709 #endif
2710 }
2711
2712 /*
2713  * Send a signal to all backend children, including autovacuum workers
2714  * (but NOT special children; dead_end children are never signaled, either).
2715  * If only_autovac is TRUE, only the autovacuum worker processes are signalled.
2716  */
2717 static void
2718 SignalSomeChildren(int signal, bool only_autovac)
2719 {
2720         Dlelem     *curr;
2721
2722         for (curr = DLGetHead(BackendList); curr; curr = DLGetSucc(curr))
2723         {
2724                 Backend    *bp = (Backend *) DLE_VAL(curr);
2725
2726                 if (bp->dead_end)
2727                         continue;
2728                 if (only_autovac && !bp->is_autovacuum)
2729                         continue;
2730
2731                 ereport(DEBUG4,
2732                                 (errmsg_internal("sending signal %d to process %d",
2733                                                                  signal, (int) bp->pid)));
2734                 signal_child(bp->pid, signal);
2735         }
2736 }
2737
2738 /*
2739  * BackendStartup -- start backend process
2740  *
2741  * returns: STATUS_ERROR if the fork failed, STATUS_OK otherwise.
2742  *
2743  * Note: if you change this code, also consider StartAutovacuumWorker.
2744  */
2745 static int
2746 BackendStartup(Port *port)
2747 {
2748         Backend    *bn;                         /* for backend cleanup */
2749         pid_t           pid;
2750
2751         /*
2752          * Compute the cancel key that will be assigned to this backend. The
2753          * backend will have its own copy in the forked-off process' value of
2754          * MyCancelKey, so that it can transmit the key to the frontend.
2755          */
2756         MyCancelKey = PostmasterRandom();
2757
2758         /*
2759          * Make room for backend data structure.  Better before the fork() so we
2760          * can handle failure cleanly.
2761          */
2762         bn = (Backend *) malloc(sizeof(Backend));
2763         if (!bn)
2764         {
2765                 ereport(LOG,
2766                                 (errcode(ERRCODE_OUT_OF_MEMORY),
2767                                  errmsg("out of memory")));
2768                 return STATUS_ERROR;
2769         }
2770
2771         /* Pass down canAcceptConnections state (kluge for EXEC_BACKEND case) */
2772         port->canAcceptConnections = canAcceptConnections();
2773
2774 #ifdef EXEC_BACKEND
2775         pid = backend_forkexec(port);
2776 #else                                                   /* !EXEC_BACKEND */
2777         pid = fork_process();
2778         if (pid == 0)                           /* child */
2779         {
2780                 free(bn);
2781
2782                 /*
2783                  * Let's clean up ourselves as the postmaster child, and close the
2784                  * postmaster's listen sockets.  (In EXEC_BACKEND case this is all
2785                  * done in SubPostmasterMain.)
2786                  */
2787                 IsUnderPostmaster = true;               /* we are a postmaster subprocess now */
2788
2789                 MyProcPid = getpid();   /* reset MyProcPid */
2790
2791                 MyStartTime = time(NULL);
2792
2793                 /* We don't want the postmaster's proc_exit() handlers */
2794                 on_exit_reset();
2795
2796                 /* Close the postmaster's sockets */
2797                 ClosePostmasterPorts(false);
2798
2799                 /* Perform additional initialization and client authentication */
2800                 BackendInitialize(port);
2801
2802                 /* And run the backend */
2803                 proc_exit(BackendRun(port));
2804         }
2805 #endif   /* EXEC_BACKEND */
2806
2807         if (pid < 0)
2808         {
2809                 /* in parent, fork failed */
2810                 int                     save_errno = errno;
2811
2812                 free(bn);
2813                 errno = save_errno;
2814                 ereport(LOG,
2815                                 (errmsg("could not fork new process for connection: %m")));
2816                 report_fork_failure_to_client(port, save_errno);
2817                 return STATUS_ERROR;
2818         }
2819
2820         /* in parent, successful fork */
2821         ereport(DEBUG2,
2822                         (errmsg_internal("forked new backend, pid=%d socket=%d",
2823                                                          (int) pid, port->sock)));
2824
2825         /*
2826          * Everything's been successful, it's safe to add this backend to our list
2827          * of backends.
2828          */
2829         bn->pid = pid;
2830         bn->cancel_key = MyCancelKey;
2831         bn->is_autovacuum = false;
2832         bn->dead_end = (port->canAcceptConnections != CAC_OK);
2833         DLAddHead(BackendList, DLNewElem(bn));
2834 #ifdef EXEC_BACKEND
2835         if (!bn->dead_end)
2836                 ShmemBackendArrayAdd(bn);
2837 #endif
2838
2839         return STATUS_OK;
2840 }
2841
2842 /*
2843  * Try to report backend fork() failure to client before we close the
2844  * connection.  Since we do not care to risk blocking the postmaster on
2845  * this connection, we set the connection to non-blocking and try only once.
2846  *
2847  * This is grungy special-purpose code; we cannot use backend libpq since
2848  * it's not up and running.
2849  */
2850 static void
2851 report_fork_failure_to_client(Port *port, int errnum)
2852 {
2853         char            buffer[1000];
2854         int                     rc;
2855
2856         /* Format the error message packet (always V2 protocol) */
2857         snprintf(buffer, sizeof(buffer), "E%s%s\n",
2858                          _("could not fork new process for connection: "),
2859                          strerror(errnum));
2860
2861         /* Set port to non-blocking.  Don't do send() if this fails */
2862         if (!pg_set_noblock(port->sock))
2863                 return;
2864
2865         /* We'll retry after EINTR, but ignore all other failures */
2866         do
2867         {
2868                 rc = send(port->sock, buffer, strlen(buffer) + 1, 0);
2869         } while (rc < 0 && errno == EINTR);
2870 }
2871
2872
2873 /*
2874  * split_opts -- split a string of options and append it to an argv array
2875  *
2876  * NB: the string is destructively modified!
2877  *
2878  * Since no current POSTGRES arguments require any quoting characters,
2879  * we can use the simple-minded tactic of assuming each set of space-
2880  * delimited characters is a separate argv element.
2881  *
2882  * If you don't like that, well, we *used* to pass the whole option string
2883  * as ONE argument to execl(), which was even less intelligent...
2884  */
2885 static void
2886 split_opts(char **argv, int *argcp, char *s)
2887 {
2888         while (s && *s)
2889         {
2890                 while (isspace((unsigned char) *s))
2891                         ++s;
2892                 if (*s == '\0')
2893                         break;
2894                 argv[(*argcp)++] = s;
2895                 while (*s && !isspace((unsigned char) *s))
2896                         ++s;
2897                 if (*s)
2898                         *s++ = '\0';
2899         }
2900 }
2901
2902
2903 /*
2904  * BackendInitialize -- initialize an interactive (postmaster-child)
2905  *                              backend process, and perform client authentication.
2906  *
2907  * returns: nothing.  Will not return at all if there's any failure.
2908  *
2909  * Note: this code does not depend on having any access to shared memory.
2910  * In the EXEC_BACKEND case, we are physically attached to shared memory
2911  * but have not yet set up most of our local pointers to shmem structures.
2912  */
2913 static void
2914 BackendInitialize(Port *port)
2915 {
2916         int                     status;
2917         char            remote_host[NI_MAXHOST];
2918         char            remote_port[NI_MAXSERV];
2919         char            remote_ps_data[NI_MAXHOST];
2920
2921         /* Save port etc. for ps status */
2922         MyProcPort = port;
2923
2924         /*
2925          * PreAuthDelay is a debugging aid for investigating problems in the
2926          * authentication cycle: it can be set in postgresql.conf to allow time to
2927          * attach to the newly-forked backend with a debugger. (See also the -W
2928          * backend switch, which we allow clients to pass through PGOPTIONS, but
2929          * it is not honored until after authentication.)
2930          */
2931         if (PreAuthDelay > 0)
2932                 pg_usleep(PreAuthDelay * 1000000L);
2933
2934         ClientAuthInProgress = true;    /* limit visibility of log messages */
2935
2936         /* save process start time */
2937         port->SessionStartTime = GetCurrentTimestamp();
2938         MyStartTime = timestamptz_to_time_t(port->SessionStartTime);
2939
2940         /* set these to empty in case they are needed before we set them up */
2941         port->remote_host = "";
2942         port->remote_port = "";
2943
2944         /*
2945          * Initialize libpq and enable reporting of ereport errors to the client.
2946          * Must do this now because authentication uses libpq to send messages.
2947          */
2948         pq_init();                                      /* initialize libpq to talk to client */
2949         whereToSendOutput = DestRemote;         /* now safe to ereport to client */
2950
2951         /*
2952          * If possible, make this process a group leader, so that the postmaster
2953          * can signal any child processes too.  (We do this now on the off chance
2954          * that something might spawn a child process during authentication.)
2955          */
2956 #ifdef HAVE_SETSID
2957         if (setsid() < 0)
2958                 elog(FATAL, "setsid() failed: %m");
2959 #endif
2960
2961         /*
2962          * We arrange for a simple exit(1) if we receive SIGTERM or SIGQUIT during
2963          * any client authentication related communication. Otherwise the
2964          * postmaster cannot shutdown the database FAST or IMMED cleanly if a
2965          * buggy client blocks a backend during authentication.
2966          */
2967         pqsignal(SIGTERM, authdie);
2968         pqsignal(SIGQUIT, authdie);
2969         pqsignal(SIGALRM, authdie);
2970         PG_SETMASK(&AuthBlockSig);
2971
2972         /*
2973          * Get the remote host name and port for logging and status display.
2974          */
2975         remote_host[0] = '\0';
2976         remote_port[0] = '\0';
2977         if (pg_getnameinfo_all(&port->raddr.addr, port->raddr.salen,
2978                                                    remote_host, sizeof(remote_host),
2979                                                    remote_port, sizeof(remote_port),
2980                                            (log_hostname ? 0 : NI_NUMERICHOST) | NI_NUMERICSERV))
2981         {
2982                 int                     ret = pg_getnameinfo_all(&port->raddr.addr, port->raddr.salen,
2983                                                                                          remote_host, sizeof(remote_host),
2984                                                                                          remote_port, sizeof(remote_port),
2985                                                                                          NI_NUMERICHOST | NI_NUMERICSERV);
2986
2987                 if (ret)
2988                         ereport(WARNING,
2989                                         (errmsg_internal("pg_getnameinfo_all() failed: %s",
2990                                                                          gai_strerror(ret))));
2991         }
2992         snprintf(remote_ps_data, sizeof(remote_ps_data),
2993                          remote_port[0] == '\0' ? "%s" : "%s(%s)",
2994                          remote_host, remote_port);
2995
2996         if (Log_connections)
2997                 ereport(LOG,
2998                                 (errmsg("connection received: host=%s%s%s",
2999                                                 remote_host, remote_port[0] ? " port=" : "",
3000                                                 remote_port)));
3001
3002         /*
3003          * save remote_host and remote_port in port structure
3004          */
3005         port->remote_host = strdup(remote_host);
3006         port->remote_port = strdup(remote_port);
3007
3008         /*
3009          * In EXEC_BACKEND case, we didn't inherit the contents of pg_hba.conf
3010          * etcetera from the postmaster, and have to load them ourselves. Build
3011          * the PostmasterContext (which didn't exist before, in this process) to
3012          * contain the data.
3013          *
3014          * FIXME: [fork/exec] Ugh.      Is there a way around this overhead?
3015          */
3016 #ifdef EXEC_BACKEND
3017         Assert(PostmasterContext == NULL);
3018         PostmasterContext = AllocSetContextCreate(TopMemoryContext,
3019                                                                                           "Postmaster",
3020                                                                                           ALLOCSET_DEFAULT_MINSIZE,
3021                                                                                           ALLOCSET_DEFAULT_INITSIZE,
3022                                                                                           ALLOCSET_DEFAULT_MAXSIZE);
3023         MemoryContextSwitchTo(PostmasterContext);
3024
3025         load_hba();
3026         load_ident();
3027         load_role();
3028 #endif
3029
3030         /*
3031          * Ready to begin client interaction.  We will give up and exit(0) after a
3032          * time delay, so that a broken client can't hog a connection
3033          * indefinitely.  PreAuthDelay doesn't count against the time limit.
3034          */
3035         if (!enable_sig_alarm(AuthenticationTimeout * 1000, false))
3036                 elog(FATAL, "could not set timer for authorization timeout");
3037
3038         /*
3039          * Receive the startup packet (which might turn out to be a cancel request
3040          * packet).
3041          */
3042         status = ProcessStartupPacket(port, false);
3043
3044         if (status != STATUS_OK)
3045                 proc_exit(0);
3046
3047         /*
3048          * Now that we have the user and database name, we can set the process
3049          * title for ps.  It's good to do this as early as possible in startup.
3050          */
3051         init_ps_display(port->user_name, port->database_name, remote_ps_data,
3052                                         update_process_title ? "authentication" : "");
3053
3054         /*
3055          * Now perform authentication exchange.
3056          */
3057         ClientAuthentication(port); /* might not return, if failure */
3058
3059         /*
3060          * Done with authentication.  Disable timeout, and prevent SIGTERM/SIGQUIT
3061          * again until backend startup is complete.
3062          */
3063         if (!disable_sig_alarm(false))
3064                 elog(FATAL, "could not disable timer for authorization timeout");
3065         PG_SETMASK(&BlockSig);
3066
3067         if (Log_connections)
3068                 ereport(LOG,
3069                                 (errmsg("connection authorized: user=%s database=%s",
3070                                                 port->user_name, port->database_name)));
3071 }
3072
3073
3074 /*
3075  * BackendRun -- set up the backend's argument list and invoke PostgresMain()
3076  *
3077  * returns:
3078  *              Shouldn't return at all.
3079  *              If PostgresMain() fails, return status.
3080  */
3081 static int
3082 BackendRun(Port *port)
3083 {
3084         char      **av;
3085         int                     maxac;
3086         int                     ac;
3087         long            secs;
3088         int                     usecs;
3089         char            protobuf[32];
3090         int                     i;
3091
3092         /*
3093          * Don't want backend to be able to see the postmaster random number
3094          * generator state.  We have to clobber the static random_seed *and* start
3095          * a new random sequence in the random() library function.
3096          */
3097         random_seed = 0;
3098         random_start_time.tv_usec = 0;
3099         /* slightly hacky way to get integer microseconds part of timestamptz */
3100         TimestampDifference(0, port->SessionStartTime, &secs, &usecs);
3101         srandom((unsigned int) (MyProcPid ^ usecs));
3102
3103         /* ----------------
3104          * Now, build the argv vector that will be given to PostgresMain.
3105          *
3106          * The layout of the command line is
3107          *              postgres [secure switches] -y databasename [insecure switches]
3108          * where the switches after -y come from the client request.
3109          *
3110          * The maximum possible number of commandline arguments that could come
3111          * from ExtraOptions or port->cmdline_options is (strlen + 1) / 2; see
3112          * split_opts().
3113          * ----------------
3114          */
3115         maxac = 10;                                     /* for fixed args supplied below */
3116         maxac += (strlen(ExtraOptions) + 1) / 2;
3117         if (port->cmdline_options)
3118                 maxac += (strlen(port->cmdline_options) + 1) / 2;
3119
3120         av = (char **) MemoryContextAlloc(TopMemoryContext,
3121                                                                           maxac * sizeof(char *));
3122         ac = 0;
3123
3124         av[ac++] = "postgres";
3125
3126         /*
3127          * Pass any backend switches specified with -o in the postmaster's own
3128          * command line.  We assume these are secure.  (It's OK to mangle
3129          * ExtraOptions now, since we're safely inside a subprocess.)
3130          */
3131         split_opts(av, &ac, ExtraOptions);
3132
3133         /* Tell the backend what protocol the frontend is using. */
3134         snprintf(protobuf, sizeof(protobuf), "-v%u", port->proto);
3135         av[ac++] = protobuf;
3136
3137         /*
3138          * Tell the backend it is being called from the postmaster, and which
3139          * database to use.  -y marks the end of secure switches.
3140          */
3141         av[ac++] = "-y";
3142         av[ac++] = port->database_name;
3143
3144         /*
3145          * Pass the (insecure) option switches from the connection request. (It's
3146          * OK to mangle port->cmdline_options now.)
3147          */
3148         if (port->cmdline_options)
3149                 split_opts(av, &ac, port->cmdline_options);
3150
3151         av[ac] = NULL;
3152
3153         Assert(ac < maxac);
3154
3155         /*
3156          * Release postmaster's working memory context so that backend can recycle
3157          * the space.  Note this does not trash *MyProcPort, because ConnCreate()
3158          * allocated that space with malloc() ... else we'd need to copy the Port
3159          * data here.  Also, subsidiary data such as the username isn't lost
3160          * either; see ProcessStartupPacket().
3161          */
3162         MemoryContextSwitchTo(TopMemoryContext);
3163         MemoryContextDelete(PostmasterContext);
3164         PostmasterContext = NULL;
3165
3166         /*
3167          * Debug: print arguments being passed to backend
3168          */
3169         ereport(DEBUG3,
3170                         (errmsg_internal("%s child[%d]: starting with (",
3171                                                          progname, (int) getpid())));
3172         for (i = 0; i < ac; ++i)
3173                 ereport(DEBUG3,
3174                                 (errmsg_internal("\t%s", av[i])));
3175         ereport(DEBUG3,
3176                         (errmsg_internal(")")));
3177
3178         ClientAuthInProgress = false;           /* client_min_messages is active now */
3179
3180         return (PostgresMain(ac, av, port->user_name));
3181 }
3182
3183
3184 #ifdef EXEC_BACKEND
3185
3186 /*
3187  * postmaster_forkexec -- fork and exec a postmaster subprocess
3188  *
3189  * The caller must have set up the argv array already, except for argv[2]
3190  * which will be filled with the name of the temp variable file.
3191  *
3192  * Returns the child process PID, or -1 on fork failure (a suitable error
3193  * message has been logged on failure).
3194  *
3195  * All uses of this routine will dispatch to SubPostmasterMain in the
3196  * child process.
3197  */
3198 pid_t
3199 postmaster_forkexec(int argc, char *argv[])
3200 {
3201         Port            port;
3202
3203         /* This entry point passes dummy values for the Port variables */
3204         memset(&port, 0, sizeof(port));
3205         return internal_forkexec(argc, argv, &port);
3206 }
3207
3208 /*
3209  * backend_forkexec -- fork/exec off a backend process
3210  *
3211  * returns the pid of the fork/exec'd process, or -1 on failure
3212  */
3213 static pid_t
3214 backend_forkexec(Port *port)
3215 {
3216         char       *av[4];
3217         int                     ac = 0;
3218
3219         av[ac++] = "postgres";
3220         av[ac++] = "--forkbackend";
3221         av[ac++] = NULL;                        /* filled in by internal_forkexec */
3222
3223         av[ac] = NULL;
3224         Assert(ac < lengthof(av));
3225
3226         return internal_forkexec(ac, av, port);
3227 }
3228
3229 #ifndef WIN32
3230
3231 /*
3232  * internal_forkexec non-win32 implementation
3233  *
3234  * - writes out backend variables to the parameter file
3235  * - fork():s, and then exec():s the child process
3236  */
3237 static pid_t
3238 internal_forkexec(int argc, char *argv[], Port *port)
3239 {
3240         static unsigned long tmpBackendFileNum = 0;
3241         pid_t           pid;
3242         char            tmpfilename[MAXPGPATH];
3243         BackendParameters param;
3244         FILE       *fp;
3245
3246         if (!save_backend_variables(&param, port))
3247                 return -1;                              /* log made by save_backend_variables */
3248
3249         /* Calculate name for temp file */
3250         snprintf(tmpfilename, MAXPGPATH, "%s/%s.backend_var.%d.%lu",
3251                          PG_TEMP_FILES_DIR, PG_TEMP_FILE_PREFIX,
3252                          MyProcPid, ++tmpBackendFileNum);
3253
3254         /* Open file */
3255         fp = AllocateFile(tmpfilename, PG_BINARY_W);
3256         if (!fp)
3257         {
3258                 /* As in OpenTemporaryFile, try to make the temp-file directory */
3259                 mkdir(PG_TEMP_FILES_DIR, S_IRWXU);
3260
3261                 fp = AllocateFile(tmpfilename, PG_BINARY_W);
3262                 if (!fp)
3263                 {
3264                         ereport(LOG,
3265                                         (errcode_for_file_access(),
3266                                          errmsg("could not create file \"%s\": %m",
3267                                                         tmpfilename)));
3268                         return -1;
3269                 }
3270         }
3271
3272         if (fwrite(&param, sizeof(param), 1, fp) != 1)
3273         {
3274                 ereport(LOG,
3275                                 (errcode_for_file_access(),
3276                                  errmsg("could not write to file \"%s\": %m", tmpfilename)));
3277                 FreeFile(fp);
3278                 return -1;
3279         }
3280
3281         /* Release file */
3282         if (FreeFile(fp))
3283         {
3284                 ereport(LOG,
3285                                 (errcode_for_file_access(),
3286                                  errmsg("could not write to file \"%s\": %m", tmpfilename)));
3287                 return -1;
3288         }
3289
3290         /* Make sure caller set up argv properly */
3291         Assert(argc >= 3);
3292         Assert(argv[argc] == NULL);
3293         Assert(strncmp(argv[1], "--fork", 6) == 0);
3294         Assert(argv[2] == NULL);
3295
3296         /* Insert temp file name after --fork argument */
3297         argv[2] = tmpfilename;
3298
3299         /* Fire off execv in child */
3300         if ((pid = fork_process()) == 0)
3301         {
3302                 if (execv(postgres_exec_path, argv) < 0)
3303                 {
3304                         ereport(LOG,
3305                                         (errmsg("could not execute server process \"%s\": %m",
3306                                                         postgres_exec_path)));
3307                         /* We're already in the child process here, can't return */
3308                         exit(1);
3309                 }
3310         }
3311
3312         return pid;                                     /* Parent returns pid, or -1 on fork failure */
3313 }
3314 #else                                                   /* WIN32 */
3315
3316 /*
3317  * internal_forkexec win32 implementation
3318  *
3319  * - starts backend using CreateProcess(), in suspended state
3320  * - writes out backend variables to the parameter file
3321  *      - during this, duplicates handles and sockets required for
3322  *        inheritance into the new process
3323  * - resumes execution of the new process once the backend parameter
3324  *       file is complete.
3325  */
3326 static pid_t
3327 internal_forkexec(int argc, char *argv[], Port *port)
3328 {
3329         STARTUPINFO si;
3330         PROCESS_INFORMATION pi;
3331         int                     i;
3332         int                     j;
3333         char            cmdLine[MAXPGPATH * 2];
3334         HANDLE          paramHandle;
3335         BackendParameters *param;
3336         SECURITY_ATTRIBUTES sa;
3337         char            paramHandleStr[32];
3338         win32_deadchild_waitinfo *childinfo;
3339
3340         /* Make sure caller set up argv properly */
3341         Assert(argc >= 3);
3342         Assert(argv[argc] == NULL);
3343         Assert(strncmp(argv[1], "--fork", 6) == 0);
3344         Assert(argv[2] == NULL);
3345
3346         /* Set up shared memory for parameter passing */
3347         ZeroMemory(&sa, sizeof(sa));
3348         sa.nLength = sizeof(sa);
3349         sa.bInheritHandle = TRUE;
3350         paramHandle = CreateFileMapping(INVALID_HANDLE_VALUE,
3351                                                                         &sa,
3352                                                                         PAGE_READWRITE,
3353                                                                         0,
3354                                                                         sizeof(BackendParameters),
3355                                                                         NULL);
3356         if (paramHandle == INVALID_HANDLE_VALUE)
3357         {
3358                 elog(LOG, "could not create backend parameter file mapping: error code %d",
3359                          (int) GetLastError());
3360                 return -1;
3361         }
3362
3363         param = MapViewOfFile(paramHandle, FILE_MAP_WRITE, 0, 0, sizeof(BackendParameters));
3364         if (!param)
3365         {
3366                 elog(LOG, "could not map backend parameter memory: error code %d",
3367                          (int) GetLastError());
3368                 CloseHandle(paramHandle);
3369                 return -1;
3370         }
3371
3372         /* Insert temp file name after --fork argument */
3373         sprintf(paramHandleStr, "%lu", (DWORD) paramHandle);
3374         argv[2] = paramHandleStr;
3375
3376         /* Format the cmd line */
3377         cmdLine[sizeof(cmdLine) - 1] = '\0';
3378         cmdLine[sizeof(cmdLine) - 2] = '\0';
3379         snprintf(cmdLine, sizeof(cmdLine) - 1, "\"%s\"", postgres_exec_path);
3380         i = 0;
3381         while (argv[++i] != NULL)
3382         {
3383                 j = strlen(cmdLine);
3384                 snprintf(cmdLine + j, sizeof(cmdLine) - 1 - j, " \"%s\"", argv[i]);
3385         }
3386         if (cmdLine[sizeof(cmdLine) - 2] != '\0')
3387         {
3388                 elog(LOG, "subprocess command line too long");
3389                 return -1;
3390         }
3391
3392         memset(&pi, 0, sizeof(pi));
3393         memset(&si, 0, sizeof(si));
3394         si.cb = sizeof(si);
3395
3396         /*
3397          * Create the subprocess in a suspended state. This will be resumed later,
3398          * once we have written out the parameter file.
3399          */
3400         if (!CreateProcess(NULL, cmdLine, NULL, NULL, TRUE, CREATE_SUSPENDED,
3401                                            NULL, NULL, &si, &pi))
3402         {
3403                 elog(LOG, "CreateProcess call failed: %m (error code %d)",
3404                          (int) GetLastError());
3405                 return -1;
3406         }
3407
3408         if (!save_backend_variables(param, port, pi.hProcess, pi.dwProcessId))
3409         {
3410                 /*
3411                  * log made by save_backend_variables, but we have to clean up the
3412                  * mess with the half-started process
3413                  */
3414                 if (!TerminateProcess(pi.hProcess, 255))
3415                         ereport(ERROR,
3416                                         (errmsg_internal("could not terminate unstarted process: error code %d",
3417                                                                          (int) GetLastError())));
3418                 CloseHandle(pi.hProcess);
3419                 CloseHandle(pi.hThread);
3420                 return -1;                              /* log made by save_backend_variables */
3421         }
3422
3423         /* Drop the shared memory that is now inherited to the backend */
3424         if (!UnmapViewOfFile(param))
3425                 elog(LOG, "could not unmap view of backend parameter file: error code %d",
3426                          (int) GetLastError());
3427         if (!CloseHandle(paramHandle))
3428                 elog(LOG, "could not close handle to backend parameter file: error code %d",
3429                          (int) GetLastError());
3430
3431         /*
3432          * Now that the backend variables are written out, we start the child
3433          * thread so it can start initializing while we set up the rest of the
3434          * parent state.
3435          */
3436         if (ResumeThread(pi.hThread) == -1)
3437         {
3438                 if (!TerminateProcess(pi.hProcess, 255))
3439                 {
3440                         ereport(ERROR,
3441                                         (errmsg_internal("could not terminate unstartable process: error code %d",
3442                                                                          (int) GetLastError())));
3443                         CloseHandle(pi.hProcess);
3444                         CloseHandle(pi.hThread);
3445                         return -1;
3446                 }
3447                 CloseHandle(pi.hProcess);
3448                 CloseHandle(pi.hThread);
3449                 ereport(ERROR,
3450                                 (errmsg_internal("could not resume thread of unstarted process: error code %d",
3451                                                                  (int) GetLastError())));
3452                 return -1;
3453         }
3454
3455         /*
3456          * Queue a waiter for to signal when this child dies. The wait will be
3457          * handled automatically by an operating system thread pool.
3458          *
3459          * Note: use malloc instead of palloc, since it needs to be thread-safe.
3460          * Struct will be free():d from the callback function that runs on a
3461          * different thread.
3462          */
3463         childinfo = malloc(sizeof(win32_deadchild_waitinfo));
3464         if (!childinfo)
3465                 ereport(FATAL,
3466                                 (errcode(ERRCODE_OUT_OF_MEMORY),
3467                                  errmsg("out of memory")));
3468
3469         childinfo->procHandle = pi.hProcess;
3470         childinfo->procId = pi.dwProcessId;
3471
3472         if (!RegisterWaitForSingleObject(&childinfo->waitHandle,
3473                                                                          pi.hProcess,
3474                                                                          pgwin32_deadchild_callback,
3475                                                                          childinfo,
3476                                                                          INFINITE,
3477                                                                 WT_EXECUTEONLYONCE | WT_EXECUTEINWAITTHREAD))
3478                 ereport(FATAL,
3479                 (errmsg_internal("could not register process for wait: error code %d",
3480                                                  (int) GetLastError())));
3481
3482         /* Don't close pi.hProcess here - the wait thread needs access to it */
3483
3484         CloseHandle(pi.hThread);
3485
3486         return pi.dwProcessId;
3487 }
3488 #endif   /* WIN32 */
3489
3490
3491 /*
3492  * SubPostmasterMain -- Get the fork/exec'd process into a state equivalent
3493  *                      to what it would be if we'd simply forked on Unix, and then
3494  *                      dispatch to the appropriate place.
3495  *
3496  * The first two command line arguments are expected to be "--forkFOO"
3497  * (where FOO indicates which postmaster child we are to become), and
3498  * the name of a variables file that we can read to load data that would
3499  * have been inherited by fork() on Unix.  Remaining arguments go to the
3500  * subprocess FooMain() routine.
3501  */
3502 int
3503 SubPostmasterMain(int argc, char *argv[])
3504 {
3505         Port            port;
3506
3507         /* Do this sooner rather than later... */
3508         IsUnderPostmaster = true;       /* we are a postmaster subprocess now */
3509
3510         MyProcPid = getpid();           /* reset MyProcPid */
3511
3512         MyStartTime = time(NULL);
3513
3514         /*
3515          * make sure stderr is in binary mode before anything can possibly be
3516          * written to it, in case it's actually the syslogger pipe, so the pipe
3517          * chunking protocol isn't disturbed. Non-logpipe data gets translated on
3518          * redirection (e.g. via pg_ctl -l) anyway.
3519          */
3520 #ifdef WIN32
3521         _setmode(fileno(stderr), _O_BINARY);
3522 #endif
3523
3524         /* Lose the postmaster's on-exit routines (really a no-op) */
3525         on_exit_reset();
3526
3527         /* In EXEC_BACKEND case we will not have inherited these settings */
3528         IsPostmasterEnvironment = true;
3529         whereToSendOutput = DestNone;
3530
3531         /* Setup essential subsystems (to ensure elog() behaves sanely) */
3532         MemoryContextInit();
3533         InitializeGUCOptions();
3534
3535         /* Read in the variables file */
3536         memset(&port, 0, sizeof(Port));
3537         read_backend_variables(argv[2], &port);
3538
3539         /*
3540          * Set up memory area for GSS information. Mirrors the code in ConnCreate
3541          * for the non-exec case.
3542          */
3543 #if defined(ENABLE_GSS) || defined(ENABLE_SSPI)
3544         port.gss = (pg_gssinfo *) calloc(1, sizeof(pg_gssinfo));
3545         if (!port.gss)
3546                 ereport(FATAL,
3547                                 (errcode(ERRCODE_OUT_OF_MEMORY),
3548                                  errmsg("out of memory")));
3549 #endif
3550
3551
3552         /* Check we got appropriate args */
3553         if (argc < 3)
3554                 elog(FATAL, "invalid subpostmaster invocation");
3555
3556         /*
3557          * If appropriate, physically re-attach to shared memory segment. We want
3558          * to do this before going any further to ensure that we can attach at the
3559          * same address the postmaster used.
3560          */
3561         if (strcmp(argv[1], "--forkbackend") == 0 ||
3562                 strcmp(argv[1], "--forkavlauncher") == 0 ||
3563                 strcmp(argv[1], "--forkavworker") == 0 ||
3564                 strcmp(argv[1], "--forkboot") == 0)
3565                 PGSharedMemoryReAttach();
3566
3567         /* autovacuum needs this set before calling InitProcess */
3568         if (strcmp(argv[1], "--forkavlauncher") == 0)
3569                 AutovacuumLauncherIAm();
3570         if (strcmp(argv[1], "--forkavworker") == 0)
3571                 AutovacuumWorkerIAm();
3572
3573         /*
3574          * Start our win32 signal implementation. This has to be done after we
3575          * read the backend variables, because we need to pick up the signal pipe
3576          * from the parent process.
3577          */
3578 #ifdef WIN32
3579         pgwin32_signal_initialize();
3580 #endif
3581
3582         /* In EXEC_BACKEND case we will not have inherited these settings */
3583         pqinitmask();
3584         PG_SETMASK(&BlockSig);
3585
3586         /* Read in remaining GUC variables */
3587         read_nondefault_variables();
3588
3589         /* Run backend or appropriate child */
3590         if (strcmp(argv[1], "--forkbackend") == 0)
3591         {
3592                 Assert(argc == 3);              /* shouldn't be any more args */
3593
3594                 /* Close the postmaster's sockets */
3595                 ClosePostmasterPorts(false);
3596
3597                 /*
3598                  * Need to reinitialize the SSL library in the backend, since the
3599                  * context structures contain function pointers and cannot be passed
3600                  * through the parameter file.
3601                  */
3602 #ifdef USE_SSL
3603                 if (EnableSSL)
3604                         secure_initialize();
3605 #endif
3606
3607                 /*
3608                  * process any libraries that should be preloaded at postmaster start
3609                  *
3610                  * NOTE: we have to re-load the shared_preload_libraries here because
3611                  * this backend is not fork()ed so we can't inherit any shared
3612                  * libraries / DLL's from our parent (the postmaster).
3613                  */
3614                 process_shared_preload_libraries();
3615
3616                 /*
3617                  * Perform additional initialization and client authentication.
3618                  *
3619                  * We want to do this before InitProcess() for a couple of reasons: 1.
3620                  * so that we aren't eating up a PGPROC slot while waiting on the
3621                  * client. 2. so that if InitProcess() fails due to being out of
3622                  * PGPROC slots, we have already initialized libpq and are able to
3623                  * report the error to the client.
3624                  */
3625                 BackendInitialize(&port);
3626
3627                 /* Restore basic shared memory pointers */
3628                 InitShmemAccess(UsedShmemSegAddr);
3629
3630                 /* Need a PGPROC to run CreateSharedMemoryAndSemaphores */
3631                 InitProcess();
3632
3633                 /*
3634                  * Attach process to shared data structures.  If testing EXEC_BACKEND
3635                  * on Linux, you must run this as root before starting the postmaster:
3636                  *
3637                  * echo 0 >/proc/sys/kernel/randomize_va_space
3638                  *
3639                  * This prevents a randomized stack base address that causes child
3640                  * shared memory to be at a different address than the parent, making
3641                  * it impossible to attached to shared memory.  Return the value to
3642                  * '1' when finished.
3643                  */
3644                 CreateSharedMemoryAndSemaphores(false, 0);
3645
3646                 /* And run the backend */
3647                 proc_exit(BackendRun(&port));
3648         }
3649         if (strcmp(argv[1], "--forkboot") == 0)
3650         {
3651                 /* Close the postmaster's sockets */
3652                 ClosePostmasterPorts(false);
3653
3654                 /* Restore basic shared memory pointers */
3655                 InitShmemAccess(UsedShmemSegAddr);
3656
3657                 /* Need a PGPROC to run CreateSharedMemoryAndSemaphores */
3658                 InitAuxiliaryProcess();
3659
3660                 /* Attach process to shared data structures */
3661                 CreateSharedMemoryAndSemaphores(false, 0);
3662
3663                 AuxiliaryProcessMain(argc - 2, argv + 2);
3664                 proc_exit(0);
3665         }
3666         if (strcmp(argv[1], "--forkavlauncher") == 0)
3667         {
3668                 /* Close the postmaster's sockets */
3669                 ClosePostmasterPorts(false);
3670
3671                 /* Restore basic shared memory pointers */
3672                 InitShmemAccess(UsedShmemSegAddr);
3673
3674                 /* Need a PGPROC to run CreateSharedMemoryAndSemaphores */
3675                 InitAuxiliaryProcess();
3676
3677                 /* Attach process to shared data structures */
3678                 CreateSharedMemoryAndSemaphores(false, 0);
3679
3680                 AutoVacLauncherMain(argc - 2, argv + 2);
3681                 proc_exit(0);
3682         }
3683         if (strcmp(argv[1], "--forkavworker") == 0)
3684         {
3685                 /* Close the postmaster's sockets */
3686                 ClosePostmasterPorts(false);
3687
3688                 /* Restore basic shared memory pointers */
3689                 InitShmemAccess(UsedShmemSegAddr);
3690
3691                 /* Need a PGPROC to run CreateSharedMemoryAndSemaphores */
3692                 InitProcess();
3693
3694                 /* Attach process to shared data structures */
3695                 CreateSharedMemoryAndSemaphores(false, 0);
3696
3697                 AutoVacWorkerMain(argc - 2, argv + 2);
3698                 proc_exit(0);
3699         }
3700         if (strcmp(argv[1], "--forkarch") == 0)
3701         {
3702                 /* Close the postmaster's sockets */
3703                 ClosePostmasterPorts(false);
3704
3705                 /* Do not want to attach to shared memory */
3706
3707                 PgArchiverMain(argc, argv);
3708                 proc_exit(0);
3709         }
3710         if (strcmp(argv[1], "--forkcol") == 0)
3711         {
3712                 /* Close the postmaster's sockets */
3713                 ClosePostmasterPorts(false);
3714
3715                 /* Do not want to attach to shared memory */
3716
3717                 PgstatCollectorMain(argc, argv);
3718                 proc_exit(0);
3719         }
3720         if (strcmp(argv[1], "--forklog") == 0)
3721         {
3722                 /* Close the postmaster's sockets */
3723                 ClosePostmasterPorts(true);
3724
3725                 /* Do not want to attach to shared memory */
3726
3727                 SysLoggerMain(argc, argv);
3728                 proc_exit(0);
3729         }
3730
3731         return 1;                                       /* shouldn't get here */
3732 }
3733 #endif   /* EXEC_BACKEND */
3734
3735
3736 /*
3737  * ExitPostmaster -- cleanup
3738  *
3739  * Do NOT call exit() directly --- always go through here!
3740  */
3741 static void
3742 ExitPostmaster(int status)
3743 {
3744         /* should cleanup shared memory and kill all backends */
3745
3746         /*
3747          * Not sure of the semantics here.      When the Postmaster dies, should the
3748          * backends all be killed? probably not.
3749          *
3750          * MUST         -- vadim 05-10-1999
3751          */
3752
3753         proc_exit(status);
3754 }
3755
3756 /*
3757  * sigusr1_handler - handle signal conditions from child processes
3758  */
3759 static void
3760 sigusr1_handler(SIGNAL_ARGS)
3761 {
3762         int                     save_errno = errno;
3763
3764         PG_SETMASK(&BlockSig);
3765
3766         if (CheckPostmasterSignal(PMSIGNAL_PASSWORD_CHANGE))
3767         {
3768                 /*
3769                  * Authorization file has changed.
3770                  */
3771                 load_role();
3772         }
3773
3774         if (CheckPostmasterSignal(PMSIGNAL_WAKEN_CHILDREN))
3775         {
3776                 /*
3777                  * Send SIGUSR1 to all children (triggers CatchupInterruptHandler).
3778                  * See storage/ipc/sinval[adt].c for the use of this.
3779                  */
3780                 if (Shutdown <= SmartShutdown)
3781                         SignalChildren(SIGUSR1);
3782         }
3783
3784         if (CheckPostmasterSignal(PMSIGNAL_WAKEN_ARCHIVER) &&
3785                 PgArchPID != 0 && Shutdown <= SmartShutdown)
3786         {
3787                 /*
3788                  * Send SIGUSR1 to archiver process, to wake it up and begin archiving
3789                  * next transaction log file.
3790                  */
3791                 signal_child(PgArchPID, SIGUSR1);
3792         }
3793
3794         if (CheckPostmasterSignal(PMSIGNAL_ROTATE_LOGFILE) &&
3795                 SysLoggerPID != 0)
3796         {
3797                 /* Tell syslogger to rotate logfile */
3798                 signal_child(SysLoggerPID, SIGUSR1);
3799         }
3800
3801         if (CheckPostmasterSignal(PMSIGNAL_START_AUTOVAC_LAUNCHER))
3802         {
3803                 /*
3804                  * Start one iteration of the autovacuum daemon, even if autovacuuming
3805                  * is nominally not enabled.  This is so we can have an active defense
3806                  * against transaction ID wraparound.  We set a flag for the main loop
3807                  * to do it rather than trying to do it here --- this is because the
3808                  * autovac process itself may send the signal, and we want to handle
3809                  * that by launching another iteration as soon as the current one
3810                  * completes.
3811                  */
3812                 start_autovac_launcher = true;
3813         }
3814
3815         if (CheckPostmasterSignal(PMSIGNAL_START_AUTOVAC_WORKER))
3816         {
3817                 /* The autovacuum launcher wants us to start a worker process. */
3818                 StartAutovacuumWorker();
3819         }
3820
3821         PG_SETMASK(&UnBlockSig);
3822
3823         errno = save_errno;
3824 }
3825
3826
3827 /*
3828  * Dummy signal handler
3829  *
3830  * We use this for signals that we don't actually use in the postmaster,
3831  * but we do use in backends.  If we were to SIG_IGN such signals in the
3832  * postmaster, then a newly started backend might drop a signal that arrives
3833  * before it's able to reconfigure its signal processing.  (See notes in
3834  * tcop/postgres.c.)
3835  */
3836 static void
3837 dummy_handler(SIGNAL_ARGS)
3838 {
3839 }
3840
3841
3842 /*
3843  * CharRemap: given an int in range 0..61, produce textual encoding of it
3844  * per crypt(3) conventions.
3845  */
3846 static char
3847 CharRemap(long ch)
3848 {
3849         if (ch < 0)
3850                 ch = -ch;
3851         ch = ch % 62;
3852
3853         if (ch < 26)
3854                 return 'A' + ch;
3855
3856         ch -= 26;
3857         if (ch < 26)
3858                 return 'a' + ch;
3859
3860         ch -= 26;
3861         return '0' + ch;
3862 }
3863
3864 /*
3865  * RandomSalt
3866  */
3867 static void
3868 RandomSalt(char *cryptSalt, char *md5Salt)
3869 {
3870         long            rand = PostmasterRandom();
3871
3872         cryptSalt[0] = CharRemap(rand % 62);
3873         cryptSalt[1] = CharRemap(rand / 62);
3874
3875         /*
3876          * It's okay to reuse the first random value for one of the MD5 salt
3877          * bytes, since only one of the two salts will be sent to the client.
3878          * After that we need to compute more random bits.
3879          *
3880          * We use % 255, sacrificing one possible byte value, so as to ensure that
3881          * all bits of the random() value participate in the result. While at it,
3882          * add one to avoid generating any null bytes.
3883          */
3884         md5Salt[0] = (rand % 255) + 1;
3885         rand = PostmasterRandom();
3886         md5Salt[1] = (rand % 255) + 1;
3887         rand = PostmasterRandom();
3888         md5Salt[2] = (rand % 255) + 1;
3889         rand = PostmasterRandom();
3890         md5Salt[3] = (rand % 255) + 1;
3891 }
3892
3893 /*
3894  * PostmasterRandom
3895  */
3896 static long
3897 PostmasterRandom(void)
3898 {
3899         /*
3900          * Select a random seed at the time of first receiving a request.
3901          */
3902         if (random_seed == 0)
3903         {
3904                 do
3905                 {
3906                         struct timeval random_stop_time;
3907
3908                         gettimeofday(&random_stop_time, NULL);
3909
3910                         /*
3911                          * We are not sure how much precision is in tv_usec, so we swap
3912                          * the high and low 16 bits of 'random_stop_time' and XOR them
3913                          * with 'random_start_time'. On the off chance that the result is
3914                          * 0, we loop until it isn't.
3915                          */
3916                         random_seed = random_start_time.tv_usec ^
3917                                 ((random_stop_time.tv_usec << 16) |
3918                                  ((random_stop_time.tv_usec >> 16) & 0xffff));
3919                 }
3920                 while (random_seed == 0);
3921
3922                 srandom(random_seed);
3923         }
3924
3925         return random();
3926 }
3927
3928 /*
3929  * Count up number of child processes (excluding special children and
3930  * dead_end children)
3931  */
3932 static int
3933 CountChildren(void)
3934 {
3935         Dlelem     *curr;
3936         int                     cnt = 0;
3937
3938         for (curr = DLGetHead(BackendList); curr; curr = DLGetSucc(curr))
3939         {
3940                 Backend    *bp = (Backend *) DLE_VAL(curr);
3941
3942                 if (!bp->dead_end)
3943                         cnt++;
3944         }
3945         return cnt;
3946 }
3947
3948
3949 /*
3950  * StartChildProcess -- start an auxiliary process for the postmaster
3951  *
3952  * xlop determines what kind of child will be started.  All child types
3953  * initially go to AuxiliaryProcessMain, which will handle common setup.
3954  *
3955  * Return value of StartChildProcess is subprocess' PID, or 0 if failed
3956  * to start subprocess.
3957  */
3958 static pid_t
3959 StartChildProcess(AuxProcType type)
3960 {
3961         pid_t           pid;
3962         char       *av[10];
3963         int                     ac = 0;
3964         char            typebuf[32];
3965
3966         /*
3967          * Set up command-line arguments for subprocess
3968          */
3969         av[ac++] = "postgres";
3970
3971 #ifdef EXEC_BACKEND
3972         av[ac++] = "--forkboot";
3973         av[ac++] = NULL;                        /* filled in by postmaster_forkexec */
3974 #endif
3975
3976         snprintf(typebuf, sizeof(typebuf), "-x%d", type);
3977         av[ac++] = typebuf;
3978
3979         av[ac] = NULL;
3980         Assert(ac < lengthof(av));
3981
3982 #ifdef EXEC_BACKEND
3983         pid = postmaster_forkexec(ac, av);
3984 #else                                                   /* !EXEC_BACKEND */
3985         pid = fork_process();
3986
3987         if (pid == 0)                           /* child */
3988         {
3989                 IsUnderPostmaster = true;               /* we are a postmaster subprocess now */
3990
3991                 /* Close the postmaster's sockets */
3992                 ClosePostmasterPorts(false);
3993
3994                 /* Lose the postmaster's on-exit routines and port connections */
3995                 on_exit_reset();
3996
3997                 /* Release postmaster's working memory context */
3998                 MemoryContextSwitchTo(TopMemoryContext);
3999                 MemoryContextDelete(PostmasterContext);
4000                 PostmasterContext = NULL;
4001
4002                 AuxiliaryProcessMain(ac, av);
4003                 ExitPostmaster(0);
4004         }
4005 #endif   /* EXEC_BACKEND */
4006
4007         if (pid < 0)
4008         {
4009                 /* in parent, fork failed */
4010                 int                     save_errno = errno;
4011
4012                 errno = save_errno;
4013                 switch (type)
4014                 {
4015                         case StartupProcess:
4016                                 ereport(LOG,
4017                                                 (errmsg("could not fork startup process: %m")));
4018                                 break;
4019                         case BgWriterProcess:
4020                                 ereport(LOG,
4021                                    (errmsg("could not fork background writer process: %m")));
4022                                 break;
4023                         case WalWriterProcess:
4024                                 ereport(LOG,
4025                                                 (errmsg("could not fork WAL writer process: %m")));
4026                                 break;
4027                         default:
4028                                 ereport(LOG,
4029                                                 (errmsg("could not fork process: %m")));
4030                                 break;
4031                 }
4032
4033                 /*
4034                  * fork failure is fatal during startup, but there's no need to choke
4035                  * immediately if starting other child types fails.
4036                  */
4037                 if (type == StartupProcess)
4038                         ExitPostmaster(1);
4039                 return 0;
4040         }
4041
4042         /*
4043          * in parent, successful fork
4044          */
4045         return pid;
4046 }
4047
4048 /*
4049  * StartAutovacuumWorker
4050  *              Start an autovac worker process.
4051  *
4052  * This function is here because it enters the resulting PID into the
4053  * postmaster's private backends list.
4054  *
4055  * NB -- this code very roughly matches BackendStartup.
4056  */
4057 static void
4058 StartAutovacuumWorker(void)
4059 {
4060         Backend    *bn;
4061
4062         /*
4063          * If not in condition to run a process, don't try, but handle it like a
4064          * fork failure.  This does not normally happen, since the signal is only
4065          * supposed to be sent by autovacuum launcher when it's OK to do it, but
4066          * we have to check to avoid race-condition problems during DB state
4067          * changes.
4068          */
4069         if (canAcceptConnections() == CAC_OK)
4070         {
4071                 /*
4072                  * Compute the cancel key that will be assigned to this session. We
4073                  * probably don't need cancel keys for autovac workers, but we'd
4074                  * better have something random in the field to prevent unfriendly
4075                  * people from sending cancels to them.
4076                  */
4077                 MyCancelKey = PostmasterRandom();
4078
4079                 bn = (Backend *) malloc(sizeof(Backend));
4080                 if (bn)
4081                 {
4082                         bn->pid = StartAutoVacWorker();
4083                         if (bn->pid > 0)
4084                         {
4085                                 bn->cancel_key = MyCancelKey;
4086                                 bn->is_autovacuum = true;
4087                                 bn->dead_end = false;
4088                                 DLAddHead(BackendList, DLNewElem(bn));
4089 #ifdef EXEC_BACKEND
4090                                 ShmemBackendArrayAdd(bn);
4091 #endif
4092                                 /* all OK */
4093                                 return;
4094                         }
4095
4096                         /*
4097                          * fork failed, fall through to report -- actual error message was
4098                          * logged by StartAutoVacWorker
4099                          */
4100                         free(bn);
4101                 }
4102                 else
4103                         ereport(LOG,
4104                                         (errcode(ERRCODE_OUT_OF_MEMORY),
4105                                          errmsg("out of memory")));
4106         }
4107
4108         /*
4109          * Report the failure to the launcher, if it's running.  (If it's not, we
4110          * might not even be connected to shared memory, so don't try to call
4111          * AutoVacWorkerFailed.)
4112          */
4113         if (AutoVacPID != 0)
4114         {
4115                 AutoVacWorkerFailed();
4116                 kill(AutoVacPID, SIGUSR1);
4117         }
4118 }
4119
4120 /*
4121  * Create the opts file
4122  */
4123 static bool
4124 CreateOptsFile(int argc, char *argv[], char *fullprogname)
4125 {
4126         FILE       *fp;
4127         int                     i;
4128
4129 #define OPTS_FILE       "postmaster.opts"
4130
4131         if ((fp = fopen(OPTS_FILE, "w")) == NULL)
4132         {
4133                 elog(LOG, "could not create file \"%s\": %m", OPTS_FILE);
4134                 return false;
4135         }
4136
4137         fprintf(fp, "%s", fullprogname);
4138         for (i = 1; i < argc; i++)
4139                 fprintf(fp, " %s%s%s", SYSTEMQUOTE, argv[i], SYSTEMQUOTE);
4140         fputs("\n", fp);
4141
4142         if (fclose(fp))
4143         {
4144                 elog(LOG, "could not write file \"%s\": %m", OPTS_FILE);
4145                 return false;
4146         }
4147
4148         return true;
4149 }
4150
4151
4152 #ifdef EXEC_BACKEND
4153
4154 /*
4155  * The following need to be available to the save/restore_backend_variables
4156  * functions
4157  */
4158 extern slock_t *ShmemLock;
4159 extern LWLock *LWLockArray;
4160 extern slock_t *ProcStructLock;
4161 extern PROC_HDR *ProcGlobal;
4162 extern PGPROC *AuxiliaryProcs;
4163 extern int      pgStatSock;
4164
4165 #ifndef WIN32
4166 #define write_inheritable_socket(dest, src, childpid) (*(dest) = (src))
4167 #define read_inheritable_socket(dest, src) (*(dest) = *(src))
4168 #else
4169 static void write_duplicated_handle(HANDLE * dest, HANDLE src, HANDLE child);
4170 static void write_inheritable_socket(InheritableSocket * dest, SOCKET src,
4171                                                  pid_t childPid);
4172 static void read_inheritable_socket(SOCKET * dest, InheritableSocket * src);
4173 #endif
4174
4175
4176 /* Save critical backend variables into the BackendParameters struct */
4177 #ifndef WIN32
4178 static bool
4179 save_backend_variables(BackendParameters * param, Port *port)
4180 #else
4181 static bool
4182 save_backend_variables(BackendParameters * param, Port *port,
4183                                            HANDLE childProcess, pid_t childPid)
4184 #endif
4185 {
4186         memcpy(&param->port, port, sizeof(Port));
4187         write_inheritable_socket(&param->portsocket, port->sock, childPid);
4188
4189         strlcpy(param->DataDir, DataDir, MAXPGPATH);
4190
4191         memcpy(&param->ListenSocket, &ListenSocket, sizeof(ListenSocket));
4192
4193         param->MyCancelKey = MyCancelKey;
4194
4195         param->UsedShmemSegID = UsedShmemSegID;
4196         param->UsedShmemSegAddr = UsedShmemSegAddr;
4197
4198         param->ShmemLock = ShmemLock;
4199         param->ShmemVariableCache = ShmemVariableCache;
4200         param->ShmemBackendArray = ShmemBackendArray;
4201
4202         param->LWLockArray = LWLockArray;
4203         param->ProcStructLock = ProcStructLock;
4204         param->ProcGlobal = ProcGlobal;
4205         param->AuxiliaryProcs = AuxiliaryProcs;
4206         write_inheritable_socket(&param->pgStatSock, pgStatSock, childPid);
4207
4208         param->PostmasterPid = PostmasterPid;
4209         param->PgStartTime = PgStartTime;
4210
4211         param->redirection_done = redirection_done;
4212
4213 #ifdef WIN32
4214         param->PostmasterHandle = PostmasterHandle;
4215         write_duplicated_handle(&param->initial_signal_pipe,
4216                                                         pgwin32_create_signal_listener(childPid),
4217                                                         childProcess);
4218 #endif
4219
4220         memcpy(&param->syslogPipe, &syslogPipe, sizeof(syslogPipe));
4221
4222         strlcpy(param->my_exec_path, my_exec_path, MAXPGPATH);
4223
4224         strlcpy(param->pkglib_path, pkglib_path, MAXPGPATH);
4225
4226         strlcpy(param->ExtraOptions, ExtraOptions, MAXPGPATH);
4227
4228         strlcpy(param->lc_collate, setlocale(LC_COLLATE, NULL), LOCALE_NAME_BUFLEN);
4229         strlcpy(param->lc_ctype, setlocale(LC_CTYPE, NULL), LOCALE_NAME_BUFLEN);
4230
4231         return true;
4232 }
4233
4234
4235 #ifdef WIN32
4236 /*
4237  * Duplicate a handle for usage in a child process, and write the child
4238  * process instance of the handle to the parameter file.
4239  */
4240 static void
4241 write_duplicated_handle(HANDLE * dest, HANDLE src, HANDLE childProcess)
4242 {
4243         HANDLE          hChild = INVALID_HANDLE_VALUE;
4244
4245         if (!DuplicateHandle(GetCurrentProcess(),
4246                                                  src,
4247                                                  childProcess,
4248                                                  &hChild,
4249                                                  0,
4250                                                  TRUE,
4251                                                  DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS))
4252                 ereport(ERROR,
4253                                 (errmsg_internal("could not duplicate handle to be written to backend parameter file: error code %d",
4254                                                                  (int) GetLastError())));
4255
4256         *dest = hChild;
4257 }
4258
4259 /*
4260  * Duplicate a socket for usage in a child process, and write the resulting
4261  * structure to the parameter file.
4262  * This is required because a number of LSPs (Layered Service Providers) very
4263  * common on Windows (antivirus, firewalls, download managers etc) break
4264  * straight socket inheritance.
4265  */
4266 static void
4267 write_inheritable_socket(InheritableSocket * dest, SOCKET src, pid_t childpid)
4268 {
4269         dest->origsocket = src;
4270         if (src != 0 && src != -1)
4271         {
4272                 /* Actual socket */
4273                 if (WSADuplicateSocket(src, childpid, &dest->wsainfo) != 0)
4274                         ereport(ERROR,
4275                                         (errmsg("could not duplicate socket %d for use in backend: error code %d",
4276                                                         src, WSAGetLastError())));
4277         }
4278 }
4279
4280 /*
4281  * Read a duplicate socket structure back, and get the socket descriptor.
4282  */
4283 static void
4284 read_inheritable_socket(SOCKET * dest, InheritableSocket * src)
4285 {
4286         SOCKET          s;
4287
4288         if (src->origsocket == -1 || src->origsocket == 0)
4289         {
4290                 /* Not a real socket! */
4291                 *dest = src->origsocket;
4292         }
4293         else
4294         {
4295                 /* Actual socket, so create from structure */
4296                 s = WSASocket(FROM_PROTOCOL_INFO,
4297                                           FROM_PROTOCOL_INFO,
4298                                           FROM_PROTOCOL_INFO,
4299                                           &src->wsainfo,
4300                                           0,
4301                                           0);
4302                 if (s == INVALID_SOCKET)
4303                 {
4304                         write_stderr("could not create inherited socket: error code %d\n",
4305                                                  WSAGetLastError());
4306                         exit(1);
4307                 }
4308                 *dest = s;
4309
4310                 /*
4311                  * To make sure we don't get two references to the same socket, close
4312                  * the original one. (This would happen when inheritance actually
4313                  * works..
4314                  */
4315                 closesocket(src->origsocket);
4316         }
4317 }
4318 #endif
4319
4320 static void
4321 read_backend_variables(char *id, Port *port)
4322 {
4323         BackendParameters param;
4324
4325 #ifndef WIN32
4326         /* Non-win32 implementation reads from file */
4327         FILE       *fp;
4328
4329         /* Open file */
4330         fp = AllocateFile(id, PG_BINARY_R);
4331         if (!fp)
4332         {
4333                 write_stderr("could not read from backend variables file \"%s\": %s\n",
4334                                          id, strerror(errno));
4335                 exit(1);
4336         }
4337
4338         if (fread(&param, sizeof(param), 1, fp) != 1)
4339         {
4340                 write_stderr("could not read from backend variables file \"%s\": %s\n",
4341                                          id, strerror(errno));
4342                 exit(1);
4343         }
4344
4345         /* Release file */
4346         FreeFile(fp);
4347         if (unlink(id) != 0)
4348         {
4349                 write_stderr("could not remove file \"%s\": %s\n",
4350                                          id, strerror(errno));
4351                 exit(1);
4352         }
4353 #else
4354         /* Win32 version uses mapped file */
4355         HANDLE          paramHandle;
4356         BackendParameters *paramp;
4357
4358         paramHandle = (HANDLE) atol(id);
4359         paramp = MapViewOfFile(paramHandle, FILE_MAP_READ, 0, 0, 0);
4360         if (!paramp)
4361         {
4362                 write_stderr("could not map view of backend variables: error code %d\n",
4363                                          (int) GetLastError());
4364                 exit(1);
4365         }
4366
4367         memcpy(&param, paramp, sizeof(BackendParameters));
4368
4369         if (!UnmapViewOfFile(paramp))
4370         {
4371                 write_stderr("could not unmap view of backend variables: error code %d\n",
4372                                          (int) GetLastError());
4373                 exit(1);
4374         }
4375
4376         if (!CloseHandle(paramHandle))
4377         {
4378                 write_stderr("could not close handle to backend parameter variables: error code %d\n",
4379                                          (int) GetLastError());
4380                 exit(1);
4381         }
4382 #endif
4383
4384         restore_backend_variables(&param, port);
4385 }
4386
4387 /* Restore critical backend variables from the BackendParameters struct */
4388 static void
4389 restore_backend_variables(BackendParameters * param, Port *port)
4390 {
4391         memcpy(port, &param->port, sizeof(Port));
4392         read_inheritable_socket(&port->sock, &param->portsocket);
4393
4394         SetDataDir(param->DataDir);
4395
4396         memcpy(&ListenSocket, &param->ListenSocket, sizeof(ListenSocket));
4397
4398         MyCancelKey = param->MyCancelKey;
4399
4400         UsedShmemSegID = param->UsedShmemSegID;
4401         UsedShmemSegAddr = param->UsedShmemSegAddr;
4402
4403         ShmemLock = param->ShmemLock;
4404         ShmemVariableCache = param->ShmemVariableCache;
4405         ShmemBackendArray = param->ShmemBackendArray;
4406
4407         LWLockArray = param->LWLockArray;
4408         ProcStructLock = param->ProcStructLock;
4409         ProcGlobal = param->ProcGlobal;
4410         AuxiliaryProcs = param->AuxiliaryProcs;
4411         read_inheritable_socket(&pgStatSock, &param->pgStatSock);
4412
4413         PostmasterPid = param->PostmasterPid;
4414         PgStartTime = param->PgStartTime;
4415
4416         redirection_done = param->redirection_done;
4417
4418 #ifdef WIN32
4419         PostmasterHandle = param->PostmasterHandle;
4420         pgwin32_initial_signal_pipe = param->initial_signal_pipe;
4421 #endif
4422
4423         memcpy(&syslogPipe, &param->syslogPipe, sizeof(syslogPipe));
4424
4425         strlcpy(my_exec_path, param->my_exec_path, MAXPGPATH);
4426
4427         strlcpy(pkglib_path, param->pkglib_path, MAXPGPATH);
4428
4429         strlcpy(ExtraOptions, param->ExtraOptions, MAXPGPATH);
4430
4431         setlocale(LC_COLLATE, param->lc_collate);
4432         setlocale(LC_CTYPE, param->lc_ctype);
4433 }
4434
4435
4436 Size
4437 ShmemBackendArraySize(void)
4438 {
4439         return mul_size(NUM_BACKENDARRAY_ELEMS, sizeof(Backend));
4440 }
4441
4442 void
4443 ShmemBackendArrayAllocation(void)
4444 {
4445         Size            size = ShmemBackendArraySize();
4446
4447         ShmemBackendArray = (Backend *) ShmemAlloc(size);
4448         /* Mark all slots as empty */
4449         memset(ShmemBackendArray, 0, size);
4450 }
4451
4452 static void
4453 ShmemBackendArrayAdd(Backend *bn)
4454 {
4455         int                     i;
4456
4457         /* Find an empty slot */
4458         for (i = 0; i < NUM_BACKENDARRAY_ELEMS; i++)
4459         {
4460                 if (ShmemBackendArray[i].pid == 0)
4461                 {
4462                         ShmemBackendArray[i] = *bn;
4463                         return;
4464                 }
4465         }
4466
4467         ereport(FATAL,
4468                         (errmsg_internal("no free slots in shmem backend array")));
4469 }
4470
4471 static void
4472 ShmemBackendArrayRemove(pid_t pid)
4473 {
4474         int                     i;
4475
4476         for (i = 0; i < NUM_BACKENDARRAY_ELEMS; i++)
4477         {
4478                 if (ShmemBackendArray[i].pid == pid)
4479                 {
4480                         /* Mark the slot as empty */
4481                         ShmemBackendArray[i].pid = 0;
4482                         return;
4483                 }
4484         }
4485
4486         ereport(WARNING,
4487                         (errmsg_internal("could not find backend entry with pid %d",
4488                                                          (int) pid)));
4489 }
4490 #endif   /* EXEC_BACKEND */
4491
4492
4493 #ifdef WIN32
4494
4495 static pid_t
4496 win32_waitpid(int *exitstatus)
4497 {
4498         DWORD           dwd;
4499         ULONG_PTR       key;
4500         OVERLAPPED *ovl;
4501
4502         /*
4503          * Check if there are any dead children. If there are, return the pid of
4504          * the first one that died.
4505          */
4506         if (GetQueuedCompletionStatus(win32ChildQueue, &dwd, &key, &ovl, 0))
4507         {
4508                 *exitstatus = (int) key;
4509                 return dwd;
4510         }
4511
4512         return -1;
4513 }
4514
4515 /*
4516  * Note! Code below executes on a thread pool! All operations must
4517  * be thread safe! Note that elog() and friends must *not* be used.
4518  */
4519 static void WINAPI
4520 pgwin32_deadchild_callback(PVOID lpParameter, BOOLEAN TimerOrWaitFired)
4521 {
4522         win32_deadchild_waitinfo *childinfo = (win32_deadchild_waitinfo *) lpParameter;
4523         DWORD           exitcode;
4524
4525         if (TimerOrWaitFired)
4526                 return;                                 /* timeout. Should never happen, since we use
4527                                                                  * INFINITE as timeout value. */
4528
4529         /*
4530          * Remove handle from wait - required even though it's set to wait only
4531          * once
4532          */
4533         UnregisterWaitEx(childinfo->waitHandle, NULL);
4534
4535         if (!GetExitCodeProcess(childinfo->procHandle, &exitcode))
4536         {
4537                 /*
4538                  * Should never happen. Inform user and set a fixed exitcode.
4539                  */
4540                 write_stderr("could not read exit code for process\n");
4541                 exitcode = 255;
4542         }
4543
4544         if (!PostQueuedCompletionStatus(win32ChildQueue, childinfo->procId, (ULONG_PTR) exitcode, NULL))
4545                 write_stderr("could not post child completion status\n");
4546
4547         /*
4548          * Handle is per-process, so we close it here instead of in the
4549          * originating thread
4550          */
4551         CloseHandle(childinfo->procHandle);
4552
4553         /*
4554          * Free struct that was allocated before the call to
4555          * RegisterWaitForSingleObject()
4556          */
4557         free(childinfo);
4558
4559         /* Queue SIGCHLD signal */
4560         pg_queue_signal(SIGCHLD);
4561 }
4562
4563 #endif   /* WIN32 */