]> git.ipfire.org Git - thirdparty/postgresql.git/commitdiff
Avoid creating archive status ".ready" files too early
authorAlvaro Herrera <alvherre@alvh.no-ip.org>
Mon, 23 Aug 2021 19:50:35 +0000 (15:50 -0400)
committerAlvaro Herrera <alvherre@alvh.no-ip.org>
Mon, 23 Aug 2021 19:50:35 +0000 (15:50 -0400)
WAL records may span multiple segments, but XLogWrite() does not
wait for the entire record to be written out to disk before
creating archive status files.  Instead, as soon as the last WAL page of
the segment is written, the archive status file is created, and the
archiver may process it.  If PostgreSQL crashes before it is able to
write and flush the rest of the record (in the next WAL segment), the
wrong version of the first segment file lingers in the archive, which
causes operations such as point-in-time restores to fail.

To fix this, keep track of records that span across segments and ensure
that segments are only marked ready-for-archival once such records have
been completely written to disk.

This has always been wrong, so backpatch all the way back.

Author: Nathan Bossart <bossartn@amazon.com>
Reviewed-by: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Reviewed-by: Ryo Matsumura <matsumura.ryo@fujitsu.com>
Reviewed-by: Andrey Borodin <x4mmm@yandex-team.ru>
Discussion: https://postgr.es/m/CBDDFA01-6E40-46BB-9F98-9340F4379505@amazon.com

src/backend/access/transam/xlog.c
src/backend/postmaster/walwriter.c
src/include/access/xlog.h
src/include/access/xlogdefs.h

index c0bb2f5c8927703f3b3615f149bd8920106d9110..42983216ca40fb717c5beb7b7b80324cc5ef0daf 100644 (file)
@@ -703,6 +703,18 @@ typedef struct XLogCtlData
        XLogRecPtr      lastFpwDisableRecPtr;
 
        slock_t         info_lck;               /* locks shared variables shown above */
+
+       /*
+        * Variables used to track segment-boundary-crossing WAL records.  See
+        * RegisterSegmentBoundary.  Protected by segtrack_lck.
+        */
+       XLogSegNo       lastNotifiedSeg;
+       XLogSegNo       earliestSegBoundary;
+       XLogRecPtr      earliestSegBoundaryEndPtr;
+       XLogSegNo       latestSegBoundary;
+       XLogRecPtr      latestSegBoundaryEndPtr;
+
+       slock_t         segtrack_lck;   /* locks shared variables shown above */
 } XLogCtlData;
 
 static XLogCtlData *XLogCtl = NULL;
@@ -895,6 +907,7 @@ static void RemoveOldXlogFiles(XLogSegNo segno, XLogRecPtr lastredoptr, XLogRecP
 static void RemoveXlogFile(const char *segname, XLogRecPtr lastredoptr, XLogRecPtr endptr);
 static void UpdateLastRemovedPtr(char *filename);
 static void ValidateXLOGDirectoryStructure(void);
+static void RegisterSegmentBoundary(XLogSegNo seg, XLogRecPtr pos);
 static void CleanupBackupHistory(void);
 static void UpdateMinRecoveryPoint(XLogRecPtr lsn, bool force);
 static XLogRecord *ReadRecord(XLogReaderState *xlogreader, XLogRecPtr RecPtr,
@@ -1125,23 +1138,56 @@ XLogInsertRecord(XLogRecData *rdata,
        END_CRIT_SECTION();
 
        /*
-        * Update shared LogwrtRqst.Write, if we crossed page boundary.
+        * If we crossed page boundary, update LogwrtRqst.Write; if we crossed
+        * segment boundary, register that and wake up walwriter.
         */
        if (StartPos / XLOG_BLCKSZ != EndPos / XLOG_BLCKSZ)
        {
+               XLogSegNo       StartSeg;
+               XLogSegNo       EndSeg;
+
+               XLByteToSeg(StartPos, StartSeg, wal_segment_size);
+               XLByteToSeg(EndPos, EndSeg, wal_segment_size);
+
+               /*
+                * Register our crossing the segment boundary if that occurred.
+                *
+                * Note that we did not use XLByteToPrevSeg() for determining the
+                * ending segment.  This is so that a record that fits perfectly into
+                * the end of the segment causes the latter to get marked ready for
+                * archival immediately.
+                */
+               if (StartSeg != EndSeg && XLogArchivingActive())
+                       RegisterSegmentBoundary(EndSeg, EndPos);
+
+               /*
+                * Advance LogwrtRqst.Write so that it includes new block(s).
+                *
+                * We do this after registering the segment boundary so that the
+                * comparison with the flushed pointer below can use the latest value
+                * known globally.
+                */
                SpinLockAcquire(&XLogCtl->info_lck);
-               /* advance global request to include new block(s) */
                if (XLogCtl->LogwrtRqst.Write < EndPos)
                        XLogCtl->LogwrtRqst.Write = EndPos;
                /* update local result copy while I have the chance */
                LogwrtResult = XLogCtl->LogwrtResult;
                SpinLockRelease(&XLogCtl->info_lck);
+
+               /*
+                * There's a chance that the record was already flushed to disk and we
+                * missed marking segments as ready for archive.  If this happens, we
+                * nudge the WALWriter, which will take care of notifying segments as
+                * needed.
+                */
+               if (StartSeg != EndSeg && XLogArchivingActive() &&
+                       LogwrtResult.Flush >= EndPos && ProcGlobal->walwriterLatch)
+                       SetLatch(ProcGlobal->walwriterLatch);
        }
 
        /*
         * If this was an XLOG_SWITCH record, flush the record and the empty
-        * padding space that fills the rest of the segment, and perform
-        * end-of-segment actions (eg, notifying archiver).
+        * padding space that fills the rest of the segment.
         */
        if (isLogSwitch)
        {
@@ -2384,6 +2430,7 @@ XLogWrite(XLogwrtRqst WriteRqst, bool flexible)
 
        /* We should always be inside a critical section here */
        Assert(CritSectionCount > 0);
+       Assert(LWLockHeldByMe(WALWriteLock));
 
        /*
         * Update local LogwrtResult (caller probably did this already, but...)
@@ -2535,11 +2582,12 @@ XLogWrite(XLogwrtRqst WriteRqst, bool flexible)
                         * later. Doing it here ensures that one and only one backend will
                         * perform this fsync.
                         *
-                        * This is also the right place to notify the Archiver that the
-                        * segment is ready to copy to archival storage, and to update the
-                        * timer for archive_timeout, and to signal for a checkpoint if
-                        * too many logfile segments have been used since the last
-                        * checkpoint.
+                        * If WAL archiving is active, we attempt to notify the archiver
+                        * of any segments that are now ready for archival.
+                        *
+                        * This is also the right place to update the timer for
+                        * archive_timeout and to signal for a checkpoint if too many
+                        * logfile segments have been used since the last checkpoint.
                         */
                        if (finishing_seg)
                        {
@@ -2551,7 +2599,7 @@ XLogWrite(XLogwrtRqst WriteRqst, bool flexible)
                                LogwrtResult.Flush = LogwrtResult.Write;        /* end of page */
 
                                if (XLogArchivingActive())
-                                       XLogArchiveNotifySeg(openLogSegNo);
+                                       NotifySegmentsReadyForArchive(LogwrtResult.Flush);
 
                                XLogCtl->lastSegSwitchTime = (pg_time_t) time(NULL);
                                XLogCtl->lastSegSwitchLSN = LogwrtResult.Flush;
@@ -2639,6 +2687,9 @@ XLogWrite(XLogwrtRqst WriteRqst, bool flexible)
                        XLogCtl->LogwrtRqst.Flush = LogwrtResult.Flush;
                SpinLockRelease(&XLogCtl->info_lck);
        }
+
+       if (XLogArchivingActive())
+               NotifySegmentsReadyForArchive(LogwrtResult.Flush);
 }
 
 /*
@@ -4175,6 +4226,129 @@ ValidateXLOGDirectoryStructure(void)
        }
 }
 
+/*
+ * RegisterSegmentBoundary
+ *
+ * WAL records that are split across a segment boundary require special
+ * treatment for archiving: the initial segment must not be archived until
+ * the end segment has been flushed, in case we crash before we have
+ * the chance to flush the end segment (because after recovery we would
+ * overwrite that WAL record with a different one, and so the file we
+ * archived no longer represents truth.)  This also applies to streaming
+ * physical replication.
+ *
+ * To handle this, we keep track of the LSN of WAL records that cross
+ * segment boundaries.  Two such are sufficient: the ones with the
+ * earliest and the latest end pointers we know about, since the flush
+ * position advances monotonically.  WAL record writers register
+ * boundary-crossing records here, which is used by .ready file creation
+ * to delay until the end segment is known flushed.
+ */
+static void
+RegisterSegmentBoundary(XLogSegNo seg, XLogRecPtr endpos)
+{
+       XLogSegNo       segno PG_USED_FOR_ASSERTS_ONLY;
+
+       /* verify caller computed segment number correctly */
+       AssertArg((XLByteToSeg(endpos, segno, wal_segment_size), segno == seg));
+
+       SpinLockAcquire(&XLogCtl->segtrack_lck);
+
+       /*
+        * If no segment boundaries are registered, store the new segment boundary
+        * in earliestSegBoundary.  Otherwise, store the greater segment
+        * boundaries in latestSegBoundary.
+        */
+       if (XLogCtl->earliestSegBoundary == MaxXLogSegNo)
+       {
+               XLogCtl->earliestSegBoundary = seg;
+               XLogCtl->earliestSegBoundaryEndPtr = endpos;
+       }
+       else if (seg > XLogCtl->earliestSegBoundary &&
+                        (XLogCtl->latestSegBoundary == MaxXLogSegNo ||
+                         seg > XLogCtl->latestSegBoundary))
+       {
+               XLogCtl->latestSegBoundary = seg;
+               XLogCtl->latestSegBoundaryEndPtr = endpos;
+       }
+
+       SpinLockRelease(&XLogCtl->segtrack_lck);
+}
+
+/*
+ * NotifySegmentsReadyForArchive
+ *
+ * Mark segments as ready for archival, given that it is safe to do so.
+ * This function is idempotent.
+ */
+void
+NotifySegmentsReadyForArchive(XLogRecPtr flushRecPtr)
+{
+       XLogSegNo       latest_boundary_seg;
+       XLogSegNo       last_notified;
+       XLogSegNo       flushed_seg;
+       XLogSegNo       seg;
+       bool            keep_latest;
+
+       XLByteToSeg(flushRecPtr, flushed_seg, wal_segment_size);
+
+       SpinLockAcquire(&XLogCtl->segtrack_lck);
+
+       if (XLogCtl->latestSegBoundary <= flushed_seg &&
+               XLogCtl->latestSegBoundaryEndPtr <= flushRecPtr)
+       {
+               latest_boundary_seg = XLogCtl->latestSegBoundary;
+               keep_latest = false;
+       }
+       else if (XLogCtl->earliestSegBoundary <= flushed_seg &&
+                        XLogCtl->earliestSegBoundaryEndPtr <= flushRecPtr)
+       {
+               latest_boundary_seg = XLogCtl->earliestSegBoundary;
+               keep_latest = true;
+       }
+       else
+       {
+               SpinLockRelease(&XLogCtl->segtrack_lck);
+               return;
+       }
+
+       last_notified = XLogCtl->lastNotifiedSeg;
+
+       /*
+        * Update shared memory and discard segment boundaries that are no longer
+        * needed.
+        *
+        * It is safe to update shared memory before we attempt to create the
+        * .ready files.  If our calls to XLogArchiveNotifySeg() fail,
+        * RemoveOldXlogFiles() will retry it as needed.
+        */
+       if (last_notified < latest_boundary_seg - 1)
+               XLogCtl->lastNotifiedSeg = latest_boundary_seg - 1;
+
+       if (keep_latest)
+       {
+               XLogCtl->earliestSegBoundary = XLogCtl->latestSegBoundary;
+               XLogCtl->earliestSegBoundaryEndPtr = XLogCtl->latestSegBoundaryEndPtr;
+       }
+       else
+       {
+               XLogCtl->earliestSegBoundary = MaxXLogSegNo;
+               XLogCtl->earliestSegBoundaryEndPtr = InvalidXLogRecPtr;
+       }
+
+       XLogCtl->latestSegBoundary = MaxXLogSegNo;
+       XLogCtl->latestSegBoundaryEndPtr = InvalidXLogRecPtr;
+
+       SpinLockRelease(&XLogCtl->segtrack_lck);
+
+       /*
+        * Notify archiver about segments that are ready for archival (by creating
+        * the corresponding .ready files).
+        */
+       for (seg = last_notified + 1; seg < latest_boundary_seg; seg++)
+               XLogArchiveNotifySeg(seg);
+}
+
 /*
  * Remove previous backup history files.  This also retries creation of
  * .ready files for any backup history files for which XLogArchiveNotify
@@ -5092,8 +5266,16 @@ XLOGShmemInit(void)
 
        SpinLockInit(&XLogCtl->Insert.insertpos_lck);
        SpinLockInit(&XLogCtl->info_lck);
+       SpinLockInit(&XLogCtl->segtrack_lck);
        SpinLockInit(&XLogCtl->ulsn_lck);
        InitSharedLatch(&XLogCtl->recoveryWakeupLatch);
+
+       /* Initialize stuff for marking segments as ready for archival. */
+       XLogCtl->lastNotifiedSeg = MaxXLogSegNo;
+       XLogCtl->earliestSegBoundary = MaxXLogSegNo;
+       XLogCtl->earliestSegBoundaryEndPtr = InvalidXLogRecPtr;
+       XLogCtl->latestSegBoundary = MaxXLogSegNo;
+       XLogCtl->latestSegBoundaryEndPtr = InvalidXLogRecPtr;
 }
 
 /*
@@ -7718,6 +7900,20 @@ StartupXLOG(void)
        XLogCtl->LogwrtRqst.Write = EndOfLog;
        XLogCtl->LogwrtRqst.Flush = EndOfLog;
 
+       /*
+        * Initialize XLogCtl->lastNotifiedSeg to the previous WAL file.
+        */
+       if (XLogArchivingActive())
+       {
+               XLogSegNo       EndOfLogSeg;
+
+               XLByteToSeg(EndOfLog, EndOfLogSeg, wal_segment_size);
+
+               SpinLockAcquire(&XLogCtl->segtrack_lck);
+               XLogCtl->lastNotifiedSeg = EndOfLogSeg - 1;
+               SpinLockRelease(&XLogCtl->segtrack_lck);
+       }
+
        /*
         * Update full_page_writes in shared memory and write an XLOG_FPW_CHANGE
         * record before resource manager writes cleanup WAL records or checkpoint
index 33bbb539fe0e92a019deda80cc133492915f5d9e..e8ecb77f344788625fdb714a4f86269009690914 100644 (file)
@@ -271,6 +271,13 @@ WalWriterMain(void)
                        proc_exit(0);           /* done */
                }
 
+               /*
+                * Notify the archiver of any WAL segments that are ready.  We do this
+                * here to handle a race condition where WAL is flushed to disk prior
+                * to registering the segment boundary.
+                */
+               NotifySegmentsReadyForArchive(GetFlushRecPtr());
+
                /*
                 * Do what we're here for; then, if XLogBackgroundFlush() found useful
                 * work to do, reset hibernation counter.
index e422a9dc8bd26b96d997fe6288c15eef4e4b32b5..a84d32ba0b7ab91e536d767b8227f8e01d2bef36 100644 (file)
@@ -289,6 +289,7 @@ extern XLogRecPtr GetFlushRecPtr(void);
 extern XLogRecPtr GetLastImportantRecPtr(void);
 extern void GetNextXidAndEpoch(TransactionId *xid, uint32 *epoch);
 extern void RemovePromoteSignalFiles(void);
+extern void NotifySegmentsReadyForArchive(XLogRecPtr flushRecPtr);
 
 extern bool CheckPromoteSignal(void);
 extern void WakeupRecovery(void);
index 0a48d1cfb40ea72a7a9c8ca001386baa0de682eb..89bf15edc4a10c31012a67252f7e4f06ff6c95e1 100644 (file)
@@ -32,6 +32,7 @@ typedef uint64 XLogRecPtr;
  * XLogSegNo - physical log file sequence number.
  */
 typedef uint64 XLogSegNo;
+#define MaxXLogSegNo   ((XLogSegNo) 0xFFFFFFFFFFFFFFFF)
 
 /*
  * TimeLineID (TLI) - identifies different database histories to prevent