/*-------------------------------------------------------------------------

 *

 * autovacuum.c

 *

 * PostgreSQL Integrated Autovacuum Daemon

 *

 * The autovacuum system is structured in two different kinds of processes: the

 * autovacuum launcher and the autovacuum worker.  The launcher is an

 * always-running process, started by the postmaster when the autovacuum GUC

 * parameter is set.  The launcher schedules autovacuum workers to be started

 * when appropriate.  The workers are the processes which execute the actual

 * vacuuming; they connect to a database as determined in the launcher, and

 * once connected they examine the catalogs to select the tables to vacuum.

 *

 * The autovacuum launcher cannot start the worker processes by itself,

 * because doing so would cause robustness issues (namely, failure to shut

 * them down on exceptional conditions, and also, since the launcher is

 * connected to shared memory and is thus subject to corruption there, it is

 * not as robust as the postmaster).  So it leaves that task to the postmaster.

 *

 * There is an autovacuum shared memory area, where the launcher stores

 * information about the database it wants vacuumed.  When it wants a new

 * worker to start, it sets a flag in shared memory and sends a signal to the

 * postmaster.  Then postmaster knows nothing more than it must start a worker;

 * so it forks a new child, which turns into a worker.  This new process

 * connects to shared memory, and there it can inspect the information that the

 * launcher has set up.

 *

 * If the fork() call fails in the postmaster, it sets a flag in the shared

 * memory area, and sends a signal to the launcher.  The launcher, upon

 * noticing the flag, can try starting the worker again by resending the

 * signal.  Note that the failure can only be transient (fork failure due to

 * high load, memory pressure, too many processes, etc); more permanent

 * problems, like failure to connect to a database, are detected later in the

 * worker and dealt with just by having the worker exit normally.  The launcher

 * will launch a new worker again later, per schedule.

 *

 * When the worker is done vacuuming it sends SIGUSR2 to the launcher.  The

 * launcher then wakes up and is able to launch another worker, if the schedule

 * is so tight that a new worker is needed immediately.  At this time the

 * launcher can also balance the settings for the various remaining workers'

 * cost-based vacuum delay feature.

 *

 * Note that there can be more than one worker in a database concurrently.

 * They will store the table they are currently vacuuming in shared memory, so

 * that other workers avoid being blocked waiting for the vacuum lock for that

 * table.  They will also fetch the last time the table was vacuumed from

 * pgstats just before vacuuming each table, to avoid vacuuming a table that

 * was just finished being vacuumed by another worker and thus is no longer

 * noted in shared memory.  However, there is a small window (due to not yet

 * holding the relation lock) during which a worker may choose a table that was

 * already vacuumed; this is a bug in the current design.

 *

 * Portions Copyright (c) 1996-2025, PostgreSQL Global Development Group

 * Portions Copyright (c) 1994, Regents of the University of California

 *

 *

 * IDENTIFICATION

 *    src/backend/postmaster/autovacuum.c

 *

 *-------------------------------------------------------------------------

 */

#include "postgres.h"

#include <signal.h>

#include <sys/time.h>

#include <unistd.h>

#include "access/heapam.h"

#include "access/htup_details.h"

#include "access/multixact.h"

#include "access/reloptions.h"

#include "access/tableam.h"

#include "access/transam.h"

#include "access/xact.h"

#include "catalog/dependency.h"

#include "catalog/namespace.h"

#include "catalog/pg_database.h"

#include "catalog/pg_namespace.h"

#include "commands/vacuum.h"

#include "common/int.h"

#include "lib/ilist.h"

#include "libpq/pqsignal.h"

#include "miscadmin.h"

#include "nodes/makefuncs.h"

#include "pgstat.h"

#include "postmaster/autovacuum.h"

#include "postmaster/interrupt.h"

#include "postmaster/postmaster.h"

#include "storage/aio_subsys.h"

#include "storage/bufmgr.h"

#include "storage/ipc.h"

#include "storage/latch.h"

#include "storage/lmgr.h"

#include "storage/pmsignal.h"

#include "storage/proc.h"

#include "storage/procsignal.h"

#include "storage/smgr.h"

#include "tcop/tcopprot.h"

#include "utils/fmgroids.h"

#include "utils/fmgrprotos.h"

#include "utils/guc_hooks.h"

#include "utils/injection_point.h"

#include "utils/lsyscache.h"

#include "utils/memutils.h"

#include "utils/ps_status.h"

#include "utils/rel.h"

#include "utils/snapmgr.h"

#include "utils/syscache.h"

#include "utils/timeout.h"

#include "utils/timestamp.h"

/*

 * GUC parameters

 */

bool    autovacuum_start_daemon = false;

int     autovacuum_worker_slots;

int     autovacuum_max_workers;

int     autovacuum_work_mem = -1;

int     autovacuum_naptime;

int     autovacuum_vac_thresh;

int     autovacuum_vac_max_thresh;

double    autovacuum_vac_scale;

int     autovacuum_vac_ins_thresh;

double    autovacuum_vac_ins_scale;

int     autovacuum_anl_thresh;

double    autovacuum_anl_scale;

int     autovacuum_freeze_max_age;

int     autovacuum_multixact_freeze_max_age;

double    autovacuum_vac_cost_delay;

int     autovacuum_vac_cost_limit;

int     Log_autovacuum_min_duration = 600000;

/* the minimum allowed time between two awakenings of the launcher */

#define MIN_AUTOVAC_SLEEPTIME 100.0 /* milliseconds */

#define MAX_AUTOVAC_SLEEPTIME 300  /* seconds */

/*

 * Variables to save the cost-related storage parameters for the current

 * relation being vacuumed by this autovacuum worker. Using these, we can

 * ensure we don't overwrite the values of vacuum_cost_delay and

 * vacuum_cost_limit after reloading the configuration file. They are

 * initialized to "invalid" values to indicate that no cost-related storage

 * parameters were specified and will be set in do_autovacuum() after checking

 * the storage parameters in table_recheck_autovac().

 */

static double av_storage_param_cost_delay = -1;

static int  av_storage_param_cost_limit = -1;

/* Flags set by signal handlers */

static volatile sig_atomic_t got_SIGUSR2 = false;

/* Comparison points for determining whether freeze_max_age is exceeded */

static TransactionId recentXid;

static MultiXactId recentMulti;

/* Default freeze ages to use for autovacuum (varies by database) */

static int  default_freeze_min_age;

static int  default_freeze_table_age;

static int  default_multixact_freeze_min_age;

static int  default_multixact_freeze_table_age;

/* Memory context for long-lived data */

static MemoryContext AutovacMemCxt;

/* struct to keep track of databases in launcher */

typedef struct avl_dbase

{

  Oid     adl_datid;    /* hash key -- must be first */

  TimestampTz adl_next_worker;

  int     adl_score;

  dlist_node  adl_node;

} avl_dbase;

/* struct to keep track of databases in worker */

typedef struct avw_dbase

{

  Oid     adw_datid;

  char     *adw_name;

  TransactionId adw_frozenxid;

  MultiXactId adw_minmulti;

  PgStat_StatDBEntry *adw_entry;

} avw_dbase;

/* struct to keep track of tables to vacuum and/or analyze, in 1st pass */

typedef struct av_relation

{

  Oid     ar_toastrelid;  /* hash key - must be first */

  Oid     ar_relid;

  bool    ar_hasrelopts;

  AutoVacOpts ar_reloptions;  /* copy of AutoVacOpts from the main table's

                 * reloptions, or NULL if none */

} av_relation;

/* struct to keep track of tables to vacuum and/or analyze, after rechecking */

typedef struct autovac_table

{

  Oid     at_relid;

  VacuumParams at_params;

  double    at_storage_param_vac_cost_delay;

  int     at_storage_param_vac_cost_limit;

  bool    at_dobalance;

  bool    at_sharedrel;

  char     *at_relname;

  char     *at_nspname;

  char     *at_datname;

} autovac_table;

/*-------------

 * This struct holds information about a single worker's whereabouts.  We keep

 * an array of these in shared memory, sized according to

 * autovacuum_worker_slots.

 *

 * wi_links   entry into free list or running list

 * wi_dboid   OID of the database this worker is supposed to work on

 * wi_tableoid  OID of the table currently being vacuumed, if any

 * wi_sharedrel flag indicating whether table is marked relisshared

 * wi_proc    pointer to PGPROC of the running worker, NULL if not started

 * wi_launchtime Time at which this worker was launched

 * wi_dobalance Whether this worker should be included in balance calculations

 *

 * All fields are protected by AutovacuumLock, except for wi_tableoid and

 * wi_sharedrel which are protected by AutovacuumScheduleLock (note these

 * two fields are read-only for everyone except that worker itself).

 *-------------

 */

typedef struct WorkerInfoData

{

  dlist_node  wi_links;

  Oid     wi_dboid;

  Oid     wi_tableoid;

  PGPROC     *wi_proc;

  TimestampTz wi_launchtime;

  pg_atomic_flag wi_dobalance;

  bool    wi_sharedrel;

} WorkerInfoData;

typedef struct WorkerInfoData *WorkerInfo;

/*

 * Possible signals received by the launcher from remote processes.  These are

 * stored atomically in shared memory so that other processes can set them

 * without locking.

 */

typedef enum

{

  AutoVacForkFailed,      /* failed trying to start a worker */

  AutoVacRebalance,     /* rebalance the cost limits */

}     AutoVacuumSignal;

#define AutoVacNumSignals (AutoVacRebalance + 1)

/*

 * Autovacuum workitem array, stored in AutoVacuumShmem->av_workItems.  This

 * list is mostly protected by AutovacuumLock, except that if an item is

 * marked 'active' other processes must not modify the work-identifying

 * members.

 */

typedef struct AutoVacuumWorkItem

{

  AutoVacuumWorkItemType avw_type;

  bool    avw_used;   /* below data is valid */

  bool    avw_active;   /* being processed */

  Oid     avw_database;

  Oid     avw_relation;

  BlockNumber avw_blockNumber;

} AutoVacuumWorkItem;

#define NUM_WORKITEMS 256

/*-------------

 * The main autovacuum shmem struct.  On shared memory we store this main

 * struct and the array of WorkerInfo structs.  This struct keeps:

 *

 * av_signal    set by other processes to indicate various conditions

 * av_launcherpid the PID of the autovacuum launcher

 * av_freeWorkers the WorkerInfo freelist

 * av_runningWorkers the WorkerInfo non-free queue

 * av_startingWorker pointer to WorkerInfo currently being started (cleared by

 *          the worker itself as soon as it's up and running)

 * av_workItems   work item array

 * av_nworkersForBalance the number of autovacuum workers to use when

 *          calculating the per worker cost limit

 *

 * This struct is protected by AutovacuumLock, except for av_signal and parts

 * of the worker list (see above).

 *-------------

 */

typedef struct

{

  sig_atomic_t av_signal[AutoVacNumSignals];

  pid_t   av_launcherpid;

  dclist_head av_freeWorkers;

  dlist_head  av_runningWorkers;

  WorkerInfo  av_startingWorker;

  AutoVacuumWorkItem av_workItems[NUM_WORKITEMS];

  pg_atomic_uint32 av_nworkersForBalance;

} AutoVacuumShmemStruct;

static AutoVacuumShmemStruct *AutoVacuumShmem;

/*

 * the database list (of avl_dbase elements) in the launcher, and the context

 * that contains it

 */

static dlist_head DatabaseList = DLIST_STATIC_INIT(DatabaseList);

static MemoryContext DatabaseListCxt = NULL;

/*

 * Dummy pointer to persuade Valgrind that we've not leaked the array of

 * avl_dbase structs.  Make it global to ensure the compiler doesn't

 * optimize it away.

 */

#ifdef USE_VALGRIND

extern avl_dbase *avl_dbase_array;

avl_dbase  *avl_dbase_array;

#endif

/* Pointer to my own WorkerInfo, valid on each worker */

static WorkerInfo MyWorkerInfo = NULL;

/* PID of launcher, valid only in worker while shutting down */

int     AutovacuumLauncherPid = 0;

static Oid  do_start_worker(void);

static void ProcessAutoVacLauncherInterrupts(void);

pg_noreturn static void AutoVacLauncherShutdown(void);

static void launcher_determine_sleep(bool canlaunch, bool recursing,

                   struct timeval *nap);

static void launch_worker(TimestampTz now);

static List *get_database_list(void);

static void rebuild_database_list(Oid newdb);

static int  db_comparator(const void *a, const void *b);

static void autovac_recalculate_workers_for_balance(void);

static void do_autovacuum(void);

static void FreeWorkerInfo(int code, Datum arg);

static autovac_table *table_recheck_autovac(Oid relid, HTAB *table_toast_map,

                      TupleDesc pg_class_desc,

                      int effective_multixact_freeze_max_age);

static void recheck_relation_needs_vacanalyze(Oid relid, AutoVacOpts *avopts,

                        Form_pg_class classForm,

                        int effective_multixact_freeze_max_age,

                        bool *dovacuum, bool *doanalyze, bool *wraparound);

static void relation_needs_vacanalyze(Oid relid, AutoVacOpts *relopts,

                    Form_pg_class classForm,

                    PgStat_StatTabEntry *tabentry,

                    int effective_multixact_freeze_max_age,

                    bool *dovacuum, bool *doanalyze, bool *wraparound);

static void autovacuum_do_vac_analyze(autovac_table *tab,

                    BufferAccessStrategy bstrategy);

static AutoVacOpts *extract_autovac_opts(HeapTuple tup,

                     TupleDesc pg_class_desc);

static void perform_work_item(AutoVacuumWorkItem *workitem);

static void autovac_report_activity(autovac_table *tab);

static void autovac_report_workitem(AutoVacuumWorkItem *workitem,

                  const char *nspname, const char *relname);

static void avl_sigusr2_handler(SIGNAL_ARGS);

static bool av_worker_available(void);

static void check_av_worker_gucs(void);

/********************************************************************

 *            AUTOVACUUM LAUNCHER CODE

 ********************************************************************/

/*

 * Main entry point for the autovacuum launcher process.

 */

void

AutoVacLauncherMain(const void *startup_data, size_t startup_data_len)

{

  sigjmp_buf  local_sigjmp_buf;

  Assert(startup_data_len == 0);

  /* Release postmaster's working memory context */

  if (PostmasterContext)

  {

    MemoryContextDelete(PostmasterContext);

    PostmasterContext = NULL;

  }

  MyBackendType = B_AUTOVAC_LAUNCHER;

  init_ps_display(NULL);

  ereport(DEBUG1,

      (errmsg_internal("autovacuum launcher started")));

  if (PostAuthDelay)

    pg_usleep(PostAuthDelay * 1000000L);

  Assert(GetProcessingMode() == InitProcessing);

  /*

   * Set up signal handlers.  We operate on databases much like a regular

   * backend, so we use the same signal handling.  See equivalent code in

   * tcop/postgres.c.

   */

  pqsignal(SIGHUP, SignalHandlerForConfigReload);

  pqsignal(SIGINT, StatementCancelHandler);

  pqsignal(SIGTERM, SignalHandlerForShutdownRequest);

  /* SIGQUIT handler was already set up by InitPostmasterChild */

  InitializeTimeouts();   /* establishes SIGALRM handler */

  pqsignal(SIGPIPE, SIG_IGN);

  pqsignal(SIGUSR1, procsignal_sigusr1_handler);

  pqsignal(SIGUSR2, avl_sigusr2_handler);

  pqsignal(SIGFPE, FloatExceptionHandler);

  pqsignal(SIGCHLD, SIG_DFL);

  /*

   * Create a per-backend PGPROC struct in shared memory.  We must do this

   * before we can use LWLocks or access any shared memory.

   */

  InitProcess();

  /* Early initialization */

  BaseInit();

  InitPostgres(NULL, InvalidOid, NULL, InvalidOid, 0, NULL);

  SetProcessingMode(NormalProcessing);

  /*

   * Create a memory context that we will do all our work in.  We do this so

   * that we can reset the context during error recovery and thereby avoid

   * possible memory leaks.

   */

  AutovacMemCxt = AllocSetContextCreate(TopMemoryContext,

                      "Autovacuum Launcher",

                      ALLOCSET_DEFAULT_SIZES);

  MemoryContextSwitchTo(AutovacMemCxt);

  /*

   * If an exception is encountered, processing resumes here.

   *

   * This code is a stripped down version of PostgresMain error recovery.

   *

   * Note that we use sigsetjmp(..., 1), so that the prevailing signal mask

   * (to wit, BlockSig) will be restored when longjmp'ing to here.  Thus,

   * signals other than SIGQUIT will be blocked until we complete error

   * recovery.  It might seem that this policy makes the HOLD_INTERRUPTS()

   * call redundant, but it is not since InterruptPending might be set

   * already.

   */

  if (sigsetjmp(local_sigjmp_buf, 1) != 0)

  {

    /* since not using PG_TRY, must reset error stack by hand */

    error_context_stack = NULL;

    /* Prevents interrupts while cleaning up */

    HOLD_INTERRUPTS();

    /* Forget any pending QueryCancel or timeout request */

    disable_all_timeouts(false);

    QueryCancelPending = false; /* second to avoid race condition */

    /* Report the error to the server log */

    EmitErrorReport();

    /* Abort the current transaction in order to recover */

    AbortCurrentTransaction();

    /*

     * Release any other resources, for the case where we were not in a

     * transaction.

     */

    LWLockReleaseAll();

    pgstat_report_wait_end();

    pgaio_error_cleanup();

    UnlockBuffers();

    /* this is probably dead code, but let's be safe: */

    if (AuxProcessResourceOwner)

      ReleaseAuxProcessResources(false);

    AtEOXact_Buffers(false);

    AtEOXact_SMgr();

    AtEOXact_Files(false);

    AtEOXact_HashTables(false);

    /*

     * Now return to normal top-level context and clear ErrorContext for

     * next time.

     */

    MemoryContextSwitchTo(AutovacMemCxt);

    FlushErrorState();

    /* Flush any leaked data in the top-level context */

    MemoryContextReset(AutovacMemCxt);

    /* don't leave dangling pointers to freed memory */

    DatabaseListCxt = NULL;

    dlist_init(&DatabaseList);

    /* Now we can allow interrupts again */

    RESUME_INTERRUPTS();

    /* if in shutdown mode, no need for anything further; just go away */

    if (ShutdownRequestPending)

      AutoVacLauncherShutdown();

    /*

     * Sleep at least 1 second after any error.  We don't want to be

     * filling the error logs as fast as we can.

     */

    pg_usleep(1000000L);

  }

  /* We can now handle ereport(ERROR) */

  PG_exception_stack = &local_sigjmp_buf;

  /* must unblock signals before calling rebuild_database_list */

  sigprocmask(SIG_SETMASK, &UnBlockSig, NULL);

  /*

   * Set always-secure search path.  Launcher doesn't connect to a database,

   * so this has no effect.

   */

  SetConfigOption("search_path", "", PGC_SUSET, PGC_S_OVERRIDE);

  /*

   * Force zero_damaged_pages OFF in the autovac process, even if it is set

   * in postgresql.conf.  We don't really want such a dangerous option being

   * applied non-interactively.

   */

  SetConfigOption("zero_damaged_pages", "false", PGC_SUSET, PGC_S_OVERRIDE);

  /*

   * Force settable timeouts off to avoid letting these settings prevent

   * regular maintenance from being executed.

   */

  SetConfigOption("statement_timeout", "0", PGC_SUSET, PGC_S_OVERRIDE);

  SetConfigOption("transaction_timeout", "0", PGC_SUSET, PGC_S_OVERRIDE);

  SetConfigOption("lock_timeout", "0", PGC_SUSET, PGC_S_OVERRIDE);

  SetConfigOption("idle_in_transaction_session_timeout", "0",

          PGC_SUSET, PGC_S_OVERRIDE);

  /*

   * Force default_transaction_isolation to READ COMMITTED.  We don't want

   * to pay the overhead of serializable mode, nor add any risk of causing

   * deadlocks or delaying other transactions.

   */

  SetConfigOption("default_transaction_isolation", "read committed",

          PGC_SUSET, PGC_S_OVERRIDE);

  /*

   * Even when system is configured to use a different fetch consistency,

   * for autovac we always want fresh stats.

   */

  SetConfigOption("stats_fetch_consistency", "none", PGC_SUSET, PGC_S_OVERRIDE);

  /*

   * In emergency mode, just start a worker (unless shutdown was requested)

   * and go away.

   */

  if (!AutoVacuumingActive())

  {

    if (!ShutdownRequestPending)

      do_start_worker();

    proc_exit(0);     /* done */

  }

  AutoVacuumShmem->av_launcherpid = MyProcPid;

  /*

   * Create the initial database list.  The invariant we want this list to

   * keep is that it's ordered by decreasing next_worker.  As soon as an

   * entry is updated to a higher time, it will be moved to the front (which

   * is correct because the only operation is to add autovacuum_naptime to

   * the entry, and time always increases).

   */

  rebuild_database_list(InvalidOid);

  /* loop until shutdown request */

  while (!ShutdownRequestPending)

  {

    struct timeval nap;

    TimestampTz current_time = 0;

    bool    can_launch;

    /*

     * This loop is a bit different from the normal use of WaitLatch,

     * because we'd like to sleep before the first launch of a child

     * process.  So it's WaitLatch, then ResetLatch, then check for

     * wakening conditions.

     */

    launcher_determine_sleep(av_worker_available(), false, &nap);

    /*

     * Wait until naptime expires or we get some type of signal (all the

     * signal handlers will wake us by calling SetLatch).

     */

    (void) WaitLatch(MyLatch,

             WL_LATCH_SET | WL_TIMEOUT | WL_EXIT_ON_PM_DEATH,

             (nap.tv_sec * 1000L) + (nap.tv_usec / 1000L),

             WAIT_EVENT_AUTOVACUUM_MAIN);

    ResetLatch(MyLatch);

    ProcessAutoVacLauncherInterrupts();

    /*

     * a worker finished, or postmaster signaled failure to start a worker

     */

    if (got_SIGUSR2)

    {

      got_SIGUSR2 = false;

      /* rebalance cost limits, if needed */

      if (AutoVacuumShmem->av_signal[AutoVacRebalance])

      {

        LWLockAcquire(AutovacuumLock, LW_EXCLUSIVE);

        AutoVacuumShmem->av_signal[AutoVacRebalance] = false;

        autovac_recalculate_workers_for_balance();

        LWLockRelease(AutovacuumLock);

      }

      if (AutoVacuumShmem->av_signal[AutoVacForkFailed])

      {

        /*

         * If the postmaster failed to start a new worker, we sleep

         * for a little while and resend the signal.  The new worker's

         * state is still in memory, so this is sufficient.  After

         * that, we restart the main loop.

         *

         * XXX should we put a limit to the number of times we retry?

         * I don't think it makes much sense, because a future start

         * of a worker will continue to fail in the same way.

         */

        AutoVacuumShmem->av_signal[AutoVacForkFailed] = false;

        pg_usleep(1000000L);  /* 1s */

        SendPostmasterSignal(PMSIGNAL_START_AUTOVAC_WORKER);

        continue;

      }

    }

    /*

     * There are some conditions that we need to check before trying to

     * start a worker.  First, we need to make sure that there is a worker

     * slot available.  Second, we need to make sure that no other worker

     * failed while starting up.

     */

    current_time = GetCurrentTimestamp();

    LWLockAcquire(AutovacuumLock, LW_SHARED);

    can_launch = av_worker_available();

    if (AutoVacuumShmem->av_startingWorker != NULL)

    {

      int     waittime;

      WorkerInfo  worker = AutoVacuumShmem->av_startingWorker;

      /*

       * We can't launch another worker when another one is still

       * starting up (or failed while doing so), so just sleep for a bit

       * more; that worker will wake us up again as soon as it's ready.

       * We will only wait autovacuum_naptime seconds (up to a maximum

       * of 60 seconds) for this to happen however.  Note that failure

       * to connect to a particular database is not a problem here,

       * because the worker removes itself from the startingWorker

       * pointer before trying to connect.  Problems detected by the

       * postmaster (like fork() failure) are also reported and handled

       * differently.  The only problems that may cause this code to

       * fire are errors in the earlier sections of AutoVacWorkerMain,

       * before the worker removes the WorkerInfo from the

       * startingWorker pointer.

       */

      waittime = Min(autovacuum_naptime, 60) * 1000;

      if (TimestampDifferenceExceeds(worker->wi_launchtime, current_time,

                       waittime))

      {

        LWLockRelease(AutovacuumLock);

        LWLockAcquire(AutovacuumLock, LW_EXCLUSIVE);

        /*

         * No other process can put a worker in starting mode, so if

         * startingWorker is still INVALID after exchanging our lock,

         * we assume it's the same one we saw above (so we don't

         * recheck the launch time).

         */

        if (AutoVacuumShmem->av_startingWorker != NULL)

        {

          worker = AutoVacuumShmem->av_startingWorker;

          worker->wi_dboid = InvalidOid;

          worker->wi_tableoid = InvalidOid;

          worker->wi_sharedrel = false;

          worker->wi_proc = NULL;

          worker->wi_launchtime = 0;

          dclist_push_head(&AutoVacuumShmem->av_freeWorkers,

                   &worker->wi_links);

          AutoVacuumShmem->av_startingWorker = NULL;

          ereport(WARNING,

              errmsg("autovacuum worker took too long to start; canceled"));

        }

      }

      else

        can_launch = false;

    }

    LWLockRelease(AutovacuumLock);  /* either shared or exclusive */

    /* if we can't do anything, just go back to sleep */

    if (!can_launch)

      continue;

    /* We're OK to start a new worker */

    if (dlist_is_empty(&DatabaseList))

    {

      /*

       * Special case when the list is empty: start a worker right away.

       * This covers the initial case, when no database is in pgstats

       * (thus the list is empty).  Note that the constraints in

       * launcher_determine_sleep keep us from starting workers too

       * quickly (at most once every autovacuum_naptime when the list is

       * empty).

       */

      launch_worker(current_time);

    }

    else

    {

      /*

       * because rebuild_database_list constructs a list with most

       * distant adl_next_worker first, we obtain our database from the

       * tail of the list.

       */

      avl_dbase  *avdb;

      avdb = dlist_tail_element(avl_dbase, adl_node, &DatabaseList);

      /*

       * launch a worker if next_worker is right now or it is in the

       * past

       */

      if (TimestampDifferenceExceeds(avdb->adl_next_worker,

                       current_time, 0))

        launch_worker(current_time);

    }

  }

  AutoVacLauncherShutdown();

}

/*

 * Process any new interrupts.

 */

static void

ProcessAutoVacLauncherInterrupts(void)

{

  /* the normal shutdown case */

  if (ShutdownRequestPending)

    AutoVacLauncherShutdown();

  if (ConfigReloadPending)

  {

    int     autovacuum_max_workers_prev = autovacuum_max_workers;

    ConfigReloadPending = false;

    ProcessConfigFile(PGC_SIGHUP);

    /* shutdown requested in config file? */

    if (!AutoVacuumingActive())

      AutoVacLauncherShutdown();

    /*

     * If autovacuum_max_workers changed, emit a WARNING if

     * autovacuum_worker_slots < autovacuum_max_workers.  If it didn't

     * change, skip this to avoid too many repeated log messages.

     */

    if (autovacuum_max_workers_prev != autovacuum_max_workers)

      check_av_worker_gucs();

    /* rebuild the list in case the naptime changed */

    rebuild_database_list(InvalidOid);

  }

  /* Process barrier events */

  if (ProcSignalBarrierPending)

    ProcessProcSignalBarrier();

  /* Perform logging of memory contexts of this process */

  if (LogMemoryContextPending)

    ProcessLogMemoryContextInterrupt();

  /* Process sinval catchup interrupts that happened while sleeping */

  ProcessCatchupInterrupt();

}

/*

 * Perform a normal exit from the autovac launcher.

 */

static void

AutoVacLauncherShutdown(void)

{

  ereport(DEBUG1,

      (errmsg_internal("autovacuum launcher shutting down")));

  AutoVacuumShmem->av_launcherpid = 0;

  proc_exit(0);       /* done */

}

/*

 * Determine the time to sleep, based on the database list.

 *

 * The "canlaunch" parameter indicates whether we can start a worker right now,

 * for example due to the workers being all busy.  If this is false, we will

 * cause a long sleep, which will be interrupted when a worker exits.

 */

static void

launcher_determine_sleep(bool canlaunch, bool recursing, struct timeval *nap)

{

  /*

   * We sleep until the next scheduled vacuum.  We trust that when the

   * database list was built, care was taken so that no entries have times

   * in the past; if the first entry has too close a next_worker value, or a

   * time in the past, we will sleep a small nominal time.

   */

  if (!canlaunch)

  {

    nap->tv_sec = autovacuum_naptime;

    nap->tv_usec = 0;

  }

  else if (!dlist_is_empty(&DatabaseList))

  {

    TimestampTz current_time = GetCurrentTimestamp();

    TimestampTz next_wakeup;

    avl_dbase  *avdb;

    long    secs;

    int     usecs;

    avdb = dlist_tail_element(avl_dbase, adl_node, &DatabaseList);

    next_wakeup = avdb->adl_next_worker;

    TimestampDifference(current_time, next_wakeup, &secs, &usecs);

    nap->tv_sec = secs;

    nap->tv_usec = usecs;

  }

  else

  {

    /* list is empty, sleep for whole autovacuum_naptime seconds  */

    nap->tv_sec = autovacuum_naptime;

    nap->tv_usec = 0;

  }

  /*

   * If the result is exactly zero, it means a database had an entry with

   * time in the past.  Rebuild the list so that the databases are evenly

   * distributed again, and recalculate the time to sleep.  This can happen

   * if there are more tables needing vacuum than workers, and they all take

   * longer to vacuum than autovacuum_naptime.

   *

   * We only recurse once.  rebuild_database_list should always return times

   * in the future, but it seems best not to trust too much on that.

   */

  if (nap->tv_sec == 0 && nap->tv_usec == 0 && !recursing)

  {

    rebuild_database_list(InvalidOid);

    launcher_determine_sleep(canlaunch, true, nap);

    return;

  }

  /* The smallest time we'll allow the launcher to sleep. */

  if (nap->tv_sec <= 0 && nap->tv_usec <= MIN_AUTOVAC_SLEEPTIME * 1000)

  {

    nap->tv_sec = 0;

    nap->tv_usec = MIN_AUTOVAC_SLEEPTIME * 1000;

  }

  /*

   * If the sleep time is too large, clamp it to an arbitrary maximum (plus

   * any fractional seconds, for simplicity).  This avoids an essentially

   * infinite sleep in strange cases like the system clock going backwards a

   * few years.

   */

  if (nap->tv_sec > MAX_AUTOVAC_SLEEPTIME)

    nap->tv_sec = MAX_AUTOVAC_SLEEPTIME;

}

/*

 * Build an updated DatabaseList.  It must only contain databases that appear

 * in pgstats, and must be sorted by next_worker from highest to lowest,

 * distributed regularly across the next autovacuum_naptime interval.

 *

 * Receives the Oid of the database that made this list be generated (we call

 * this the "new" database, because when the database was already present on

 * the list, we expect that this function is not called at all).  The

 * preexisting list, if any, will be used to preserve the order of the

 * databases in the autovacuum_naptime period.  The new database is put at the

 * end of the interval.  The actual values are not saved, which should not be

 * much of a problem.

 */

static void

rebuild_database_list(Oid newdb)

{

  List     *dblist;

  ListCell   *cell;

  MemoryContext newcxt;

  MemoryContext oldcxt;

  MemoryContext tmpcxt;

  HASHCTL   hctl;

  int     score;

  int     nelems;

  HTAB     *dbhash;

  dlist_iter  iter;

  newcxt = AllocSetContextCreate(AutovacMemCxt,

                   "Autovacuum database list",

                   ALLOCSET_DEFAULT_SIZES);

  tmpcxt = AllocSetContextCreate(newcxt,

                   "Autovacuum database list (tmp)",

                   ALLOCSET_DEFAULT_SIZES);

  oldcxt = MemoryContextSwitchTo(tmpcxt);

  /*

   * Implementing this is not as simple as it sounds, because we need to put

   * the new database at the end of the list; next the databases that were

   * already on the list, and finally (at the tail of the list) all the

   * other databases that are not on the existing list.

   *

   * To do this, we build an empty hash table of scored databases.  We will

   * start with the lowest score (zero) for the new database, then

   * increasing scores for the databases in the existing list, in order, and

   * lastly increasing scores for all databases gotten via

   * get_database_list() that are not already on the hash.

   *

   * Then we will put all the hash elements into an array, sort the array by

   * score, and finally put the array elements into the new doubly linked

   * list.

   */

  hctl.keysize = sizeof(Oid);

  hctl.entrysize = sizeof(avl_dbase);

  hctl.hcxt = tmpcxt;

  dbhash = hash_create("autovacuum db hash", 20, &hctl, /* magic number here

                               * FIXME */

             HASH_ELEM | HASH_BLOBS | HASH_CONTEXT);

  /* start by inserting the new database */

  score = 0;

  if (OidIsValid(newdb))

  {

    avl_dbase  *db;

    PgStat_StatDBEntry *entry;

    /* only consider this database if it has a pgstat entry */

    entry = pgstat_fetch_stat_dbentry(newdb);

    if (entry != NULL)

    {

      /* we assume it isn't found because the hash was just created */

      db = hash_search(dbhash, &newdb, HASH_ENTER, NULL);

      /* hash_search already filled in the key */

      db->adl_score = score++;

      /* next_worker is filled in later */

    }

  }

  /* Now insert the databases from the existing list */

  dlist_foreach(iter, &DatabaseList)

  {

    avl_dbase  *avdb = dlist_container(avl_dbase, adl_node, iter.cur);

    avl_dbase  *db;

    bool    found;

    PgStat_StatDBEntry *entry;

    /*

     * skip databases with no stat entries -- in particular, this gets rid

     * of dropped databases

     */

    entry = pgstat_fetch_stat_dbentry(avdb->adl_datid);

    if (entry == NULL)

      continue;

    db = hash_search(dbhash, &(avdb->adl_datid), HASH_ENTER, &found);

    if (!found)

    {

      /* hash_search already filled in the key */

      db->adl_score = score++;

      /* next_worker is filled in later */

    }

  }

  /* finally, insert all qualifying databases not previously inserted */

  dblist = get_database_list();

  foreach(cell, dblist)

  {

    avw_dbase  *avdb = lfirst(cell);

    avl_dbase  *db;

    bool    found;

    PgStat_StatDBEntry *entry;

    /* only consider databases with a pgstat entry */

    entry = pgstat_fetch_stat_dbentry(avdb->adw_datid);

    if (entry == NULL)

      continue;

    db = hash_search(dbhash, &(avdb->adw_datid), HASH_ENTER, &found);

    /* only update the score if the database was not already on the hash */

    if (!found)