/*-------------------------------------------------------------------------

 *

 * postmaster.c

 *    This program acts as a clearing house for requests to the

 *    POSTGRES system.  Frontend programs connect to the Postmaster,

 *    and postmaster forks a new backend process to handle the

 *    connection.

 *

 *    The postmaster also manages system-wide operations such as

 *    startup and shutdown. The postmaster itself doesn't do those

 *    operations, mind you --- it just forks off a subprocess to do them

 *    at the right times.  It also takes care of resetting the system

 *    if a backend crashes.

 *

 *    The postmaster process creates the shared memory and semaphore

 *    pools during startup, but as a rule does not touch them itself.

 *    In particular, it is not a member of the PGPROC array of backends

 *    and so it cannot participate in lock-manager operations.  Keeping

 *    the postmaster away from shared memory operations makes it simpler

 *    and more reliable.  The postmaster is almost always able to recover

 *    from crashes of individual backends by resetting shared memory;

 *    if it did much with shared memory then it would be prone to crashing

 *    along with the backends.

 *

 *    When a request message is received, we now fork() immediately.

 *    The child process performs authentication of the request, and

 *    then becomes a backend if successful.  This allows the auth code

 *    to be written in a simple single-threaded style (as opposed to the

 *    crufty "poor man's multitasking" code that used to be needed).

 *    More importantly, it ensures that blockages in non-multithreaded

 *    libraries like SSL or PAM cannot cause denial of service to other

 *    clients.

 *

 *

 * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group

 * Portions Copyright (c) 1994, Regents of the University of California

 *

 *

 * IDENTIFICATION

 *    src/backend/postmaster/postmaster.c

 *

 * NOTES

 *

 * Initialization:

 *    The Postmaster sets up shared memory data structures

 *    for the backends.

 *

 * Synchronization:

 *    The Postmaster shares memory with the backends but should avoid

 *    touching shared memory, so as not to become stuck if a crashing

 *    backend screws up locks or shared memory.  Likewise, the Postmaster

 *    should never block on messages from frontend clients.

 *

 * Garbage Collection:

 *    The Postmaster cleans up after backends if they have an emergency

 *    exit and/or core dump.

 *

 * Error Reporting:

 *    Use write_stderr() only for reporting "interactive" errors

 *    (essentially, bogus arguments on the command line).  Once the

 *    postmaster is launched, use ereport().

 *

 *-------------------------------------------------------------------------

 */

#include "postgres.h"

#include <unistd.h>

#include <signal.h>

#include <time.h>

#include <sys/wait.h>

#include <ctype.h>

#include <sys/stat.h>

#include <sys/socket.h>

#include <fcntl.h>

#include <sys/param.h>

#include <netdb.h>

#include <limits.h>

#ifdef USE_BONJOUR

#include <dns_sd.h>

#endif

#ifdef USE_SYSTEMD

#include <systemd/sd-daemon.h>

#endif

#ifdef HAVE_PTHREAD_IS_THREADED_NP

#include <pthread.h>

#endif

#include "access/xlog.h"

#include "access/xlog_internal.h"

#include "access/xlogrecovery.h"

#include "common/file_perm.h"

#include "common/pg_prng.h"

#include "lib/ilist.h"

#include "libpq/libpq.h"

#include "libpq/pqsignal.h"

#include "pgstat.h"

#include "port/pg_bswap.h"

#include "port/pg_getopt_ctx.h"

#include "postmaster/autovacuum.h"

#include "postmaster/bgworker_internals.h"

#include "postmaster/pgarch.h"

#include "postmaster/postmaster.h"

#include "postmaster/syslogger.h"

#include "postmaster/walsummarizer.h"

#include "replication/logicallauncher.h"

#include "replication/slotsync.h"

#include "replication/walsender.h"

#include "storage/aio_subsys.h"

#include "storage/fd.h"

#include "storage/io_worker.h"

#include "storage/ipc.h"

#include "storage/pmsignal.h"

#include "storage/proc.h"

#include "storage/shmem_internal.h"

#include "tcop/backend_startup.h"

#include "tcop/tcopprot.h"

#include "utils/datetime.h"

#include "utils/memutils.h"

#include "utils/pidfile.h"

#include "utils/timestamp.h"

#include "utils/varlena.h"

#ifdef EXEC_BACKEND

#include "common/file_utils.h"

#include "storage/pg_shmem.h"

#endif

/*

 * CountChildren and SignalChildren take a bitmask argument to represent

 * BackendTypes to count or signal.  Define a separate type and functions to

 * work with the bitmasks, to avoid accidentally passing a plain BackendType

 * in place of a bitmask or vice versa.

 */

typedef struct

{

  uint32    mask;

} BackendTypeMask;

StaticAssertDecl(BACKEND_NUM_TYPES < 32, "too many backend types for uint32");

static const BackendTypeMask BTYPE_MASK_ALL = {(1 << BACKEND_NUM_TYPES) - 1};

static const BackendTypeMask BTYPE_MASK_NONE = {0};

static inline BackendTypeMask

btmask(BackendType t)

{

  BackendTypeMask mask = {.mask = 1 << t};

  return mask;

}

static inline BackendTypeMask

btmask_add_n(BackendTypeMask mask, int nargs, BackendType *t)

{

  for (int i = 0; i < nargs; i++)

    mask.mask |= 1 << t[i];

  return mask;

}

#define btmask_add(mask, ...) \

  btmask_add_n(mask, \

    lengthof(((BackendType[]){__VA_ARGS__})), \

    (BackendType[]){__VA_ARGS__} \

  )

static inline BackendTypeMask

btmask_del(BackendTypeMask mask, BackendType t)

{

  mask.mask &= ~(1 << t);

  return mask;

}

static inline BackendTypeMask

btmask_all_except_n(int nargs, BackendType *t)

{

  BackendTypeMask mask = BTYPE_MASK_ALL;

  for (int i = 0; i < nargs; i++)

    mask = btmask_del(mask, t[i]);

  return mask;

}

#define btmask_all_except(...) \

  btmask_all_except_n( \

    lengthof(((BackendType[]){__VA_ARGS__})), \

    (BackendType[]){__VA_ARGS__} \

  )

static inline bool

btmask_contains(BackendTypeMask mask, BackendType t)

{

  return (mask.mask & (1 << t)) != 0;

}

BackgroundWorker *MyBgworkerEntry = NULL;

/* The socket number we are listening for connections on */

int     PostPortNumber = DEF_PGPORT;

/* The directory names for Unix socket(s) */

char     *Unix_socket_directories;

/* The TCP listen address(es) */

char     *ListenAddresses;

/*

 * SuperuserReservedConnections is the number of backends reserved for

 * superuser use, and ReservedConnections is the number of backends reserved

 * for use by roles with privileges of the pg_use_reserved_connections

 * predefined role.  These are taken out of the pool of MaxConnections backend

 * slots, so the number of backend slots available for roles that are neither

 * superuser nor have privileges of pg_use_reserved_connections is

 * (MaxConnections - SuperuserReservedConnections - ReservedConnections).

 *

 * If the number of remaining slots is less than or equal to

 * SuperuserReservedConnections, only superusers can make new connections.  If

 * the number of remaining slots is greater than SuperuserReservedConnections

 * but less than or equal to

 * (SuperuserReservedConnections + ReservedConnections), only superusers and

 * roles with privileges of pg_use_reserved_connections can make new

 * connections.  Note that pre-existing superuser and

 * pg_use_reserved_connections connections don't count against the limits.

 */

int     SuperuserReservedConnections;

int     ReservedConnections;

/* The socket(s) we're listening to. */

#define MAXLISTEN 64

static int  NumListenSockets = 0;

static pgsocket *ListenSockets = NULL;

/* still more option variables */

bool    EnableSSL = false;

int     PreAuthDelay = 0;

int     AuthenticationTimeout = 60;

bool    log_hostname;   /* for ps display and logging */

bool    enable_bonjour = false;

char     *bonjour_name;

bool    restart_after_crash = true;

bool    remove_temp_files_after_crash = true;

/*

 * When terminating child processes after fatal errors, like a crash of a

 * child process, we normally send SIGQUIT -- and most other comments in this

 * file are written on the assumption that we do -- but developers might

 * prefer to use SIGABRT to collect per-child core dumps.

 */

bool    send_abort_for_crash = false;

bool    send_abort_for_kill = false;

/* special child processes; NULL when not running */

static PMChild *StartupPMChild = NULL,

       *BgWriterPMChild = NULL,

       *CheckpointerPMChild = NULL,

       *WalWriterPMChild = NULL,

       *WalReceiverPMChild = NULL,

       *WalSummarizerPMChild = NULL,

       *AutoVacLauncherPMChild = NULL,

       *PgArchPMChild = NULL,

       *SysLoggerPMChild = NULL,

       *SlotSyncWorkerPMChild = NULL;

/* Startup process's status */

typedef enum

{

  STARTUP_NOT_RUNNING,

  STARTUP_RUNNING,

  STARTUP_SIGNALED,     /* we sent it a SIGQUIT or SIGKILL */

  STARTUP_CRASHED,

} StartupStatusEnum;

static StartupStatusEnum StartupStatus = STARTUP_NOT_RUNNING;

/* Startup/shutdown state */

#define     NoShutdown    0

#define     SmartShutdown 1

#define     FastShutdown  2

#define     ImmediateShutdown 3

static int  Shutdown = NoShutdown;

static bool FatalError = false; /* T if recovering from backend crash */

/*

 * We use a simple state machine to control startup, shutdown, and

 * crash recovery (which is rather like shutdown followed by startup).

 *

 * After doing all the postmaster initialization work, we enter PM_STARTUP

 * state and the startup process is launched. The startup process begins by

 * reading the control file and other preliminary initialization steps.

 * In a normal startup, or after crash recovery, the startup process exits

 * with exit code 0 and we switch to PM_RUN state.  However, archive recovery

 * is handled specially since it takes much longer and we would like to support

 * hot standby during archive recovery.

 *

 * When the startup process is ready to start archive recovery, it signals the

 * postmaster, and we switch to PM_RECOVERY state. The background writer and

 * checkpointer are already running (as these are launched during PM_STARTUP),

 * and the startup process continues applying WAL.  If Hot Standby is enabled,

 * then, after reaching a consistent point in WAL redo, startup process

 * signals us again, and we switch to PM_HOT_STANDBY state and begin accepting

 * connections to perform read-only queries.  When archive recovery is

 * finished, the startup process exits with exit code 0 and we switch to

 * PM_RUN state.

 *

 * Normal child backends can only be launched when we are in PM_RUN or

 * PM_HOT_STANDBY state.  (connsAllowed can also restrict launching.)

 * In other states we handle connection requests by launching "dead-end"

 * child processes, which will simply send the client an error message and

 * quit.  (We track these in the ActiveChildList so that we can know when they

 * are all gone; this is important because they're still connected to shared

 * memory, and would interfere with an attempt to destroy the shmem segment,

 * possibly leading to SHMALL failure when we try to make a new one.)

 * In PM_WAIT_DEAD_END state we are waiting for all the dead-end children

 * to drain out of the system, and therefore stop accepting connection

 * requests at all until the last existing child has quit (which hopefully

 * will not be very long).

 *

 * Notice that this state variable does not distinguish *why* we entered

 * states later than PM_RUN --- Shutdown and FatalError must be consulted

 * to find that out.  FatalError is never true in PM_RECOVERY, PM_HOT_STANDBY,

 * or PM_RUN states, nor in PM_WAIT_XLOG_SHUTDOWN states (because we don't

 * enter those states when trying to recover from a crash).  It can be true in

 * PM_STARTUP state, because we don't clear it until we've successfully

 * started WAL redo.

 */

typedef enum

{

  PM_INIT,          /* postmaster starting */

  PM_STARTUP,         /* waiting for startup subprocess */

  PM_RECOVERY,        /* in archive recovery mode */

  PM_HOT_STANDBY,       /* in hot standby mode */

  PM_RUN,           /* normal "database is alive" state */

  PM_STOP_BACKENDS,     /* need to stop remaining backends */

  PM_WAIT_BACKENDS,     /* waiting for live backends to exit */

  PM_WAIT_XLOG_SHUTDOWN,    /* waiting for checkpointer to do shutdown

                 * ckpt */

  PM_WAIT_XLOG_ARCHIVAL,    /* waiting for archiver and walsenders to

                 * finish */

  PM_WAIT_IO_WORKERS,     /* waiting for io workers to exit */

  PM_WAIT_CHECKPOINTER,   /* waiting for checkpointer to shut down */

  PM_WAIT_DEAD_END,     /* waiting for dead-end children to exit */

  PM_NO_CHILDREN,       /* all important children have exited */

} PMState;

static PMState pmState = PM_INIT;

/*

 * While performing a "smart shutdown", we restrict new connections but stay

 * in PM_RUN or PM_HOT_STANDBY state until all the client backends are gone.

 * connsAllowed is a sub-state indicator showing the active restriction.

 * It is of no interest unless pmState is PM_RUN or PM_HOT_STANDBY.

 */

static bool connsAllowed = true;

/* Start time of SIGKILL timeout during immediate shutdown or child crash */

/* Zero means timeout is not running */

static time_t AbortStartTime = 0;

/* Length of said timeout */

#define SIGKILL_CHILDREN_AFTER_SECS   5

static bool ReachedNormalRunning = false; /* T if we've reached PM_RUN */

bool    ClientAuthInProgress = false; /* T during new-client

                       * authentication */

bool    redirection_done = false; /* stderr redirected for syslogger? */

/* received START_AUTOVAC_LAUNCHER signal */

static bool start_autovac_launcher = false;

/* the launcher needs to be signaled to communicate some condition */

static bool avlauncher_needs_signal = false;

/* received START_WALRECEIVER signal */

static bool WalReceiverRequested = false;

/* set when there's a worker that needs to be started up */

static bool StartWorkerNeeded = true;

static bool HaveCrashedWorker = false;

/* set when signals arrive */

static volatile sig_atomic_t pending_pm_pmsignal;

static volatile sig_atomic_t pending_pm_child_exit;

static volatile sig_atomic_t pending_pm_reload_request;

static volatile sig_atomic_t pending_pm_shutdown_request;

static volatile sig_atomic_t pending_pm_fast_shutdown_request;

static volatile sig_atomic_t pending_pm_immediate_shutdown_request;

/* event multiplexing object */

static WaitEventSet *pm_wait_set;

#ifdef USE_SSL

/* Set when and if SSL has been initialized properly */

bool    LoadedSSL = false;

#endif

#ifdef USE_BONJOUR

static DNSServiceRef bonjour_sdref = NULL;

#endif

/* State for IO worker management. */

static TimestampTz io_worker_launch_next_time = 0;

static int  io_worker_count = 0;

static PMChild *io_worker_children[MAX_IO_WORKERS];

/*

 * postmaster.c - function prototypes

 */

static void CloseServerPorts(int status, Datum arg);

static void unlink_external_pid_file(int status, Datum arg);

static void getInstallationPaths(const char *argv0);

static void checkControlFile(void);

static void handle_pm_pmsignal_signal(SIGNAL_ARGS);

static void handle_pm_child_exit_signal(SIGNAL_ARGS);

static void handle_pm_reload_request_signal(SIGNAL_ARGS);

static void handle_pm_shutdown_request_signal(SIGNAL_ARGS);

static void process_pm_pmsignal(void);

static void process_pm_child_exit(void);

static void process_pm_reload_request(void);

static void process_pm_shutdown_request(void);

static void dummy_handler(SIGNAL_ARGS);

static void CleanupBackend(PMChild *bp, int exitstatus);

static void HandleChildCrash(int pid, int exitstatus, const char *procname);

static void LogChildExit(int lev, const char *procname,

             int pid, int exitstatus);

static void PostmasterStateMachine(void);

static void UpdatePMState(PMState newState);

pg_noreturn static void ExitPostmaster(int status);

static int  ServerLoop(void);

static int  BackendStartup(ClientSocket *client_sock);

static void report_fork_failure_to_client(ClientSocket *client_sock, int errnum);

static CAC_state canAcceptConnections(BackendType backend_type);

static void signal_child(PMChild *pmchild, int signal);

static bool SignalChildren(int signal, BackendTypeMask targetMask);

static void TerminateChildren(int signal);

static int  CountChildren(BackendTypeMask targetMask);

static void LaunchMissingBackgroundProcesses(void);

static void maybe_start_bgworkers(void);

static bool maybe_reap_io_worker(int pid);

static void maybe_start_io_workers(void);

static TimestampTz maybe_start_io_workers_scheduled_at(void);

static bool CreateOptsFile(int argc, char *argv[], char *fullprogname);

static PMChild *StartChildProcess(BackendType type);

static void StartSysLogger(void);

static void StartAutovacuumWorker(void);

static bool StartBackgroundWorker(RegisteredBgWorker *rw);

static void InitPostmasterDeathWatchHandle(void);

#ifdef WIN32

#define WNOHANG 0       /* ignored, so any integer value will do */

static pid_t waitpid(pid_t pid, int *exitstatus, int options);

static void WINAPI pgwin32_deadchild_callback(PVOID lpParameter, BOOLEAN TimerOrWaitFired);

static HANDLE win32ChildQueue;

typedef struct

{

  HANDLE    waitHandle;

  HANDLE    procHandle;

  DWORD   procId;

} win32_deadchild_waitinfo;

#endif              /* WIN32 */

/* Macros to check exit status of a child process */

#define EXIT_STATUS_0(st)  ((st) == 0)

#define EXIT_STATUS_1(st)  (WIFEXITED(st) && WEXITSTATUS(st) == 1)

#define EXIT_STATUS_3(st)  (WIFEXITED(st) && WEXITSTATUS(st) == 3)

#ifndef WIN32

/*

 * File descriptors for pipe used to monitor if postmaster is alive.

 * First is POSTMASTER_FD_WATCH, second is POSTMASTER_FD_OWN.

 */

int     postmaster_alive_fds[2] = {-1, -1};

#else

/* Process handle of postmaster used for the same purpose on Windows */

HANDLE    PostmasterHandle;

#endif

/*

 * Postmaster main entry point

 */

void

PostmasterMain(int argc, char *argv[])

{

  pg_getopt_ctx optctx;

  int     opt;

  int     status;

  char     *userDoption = NULL;

  bool    listen_addr_saved = false;

  char     *output_config_variable = NULL;

  InitProcessGlobals();

  PostmasterPid = MyProcPid;

  IsPostmasterEnvironment = true;

  /*

   * Start our win32 signal implementation

   */

#ifdef WIN32

  pgwin32_signal_initialize();

#endif

  /*

   * We should not be creating any files or directories before we check the

   * data directory (see checkDataDir()), but just in case set the umask to

   * the most restrictive (owner-only) permissions.

   *

   * checkDataDir() will reset the umask based on the data directory

   * permissions.

   */

  umask(PG_MODE_MASK_OWNER);

  /*

   * By default, palloc() requests in the postmaster will be allocated in

   * the PostmasterContext, which is space that can be recycled by backends.

   * Allocated data that needs to be available to backends should be

   * allocated in TopMemoryContext.

   */

  PostmasterContext = AllocSetContextCreate(TopMemoryContext,

                        "Postmaster",

                        ALLOCSET_DEFAULT_SIZES);

  MemoryContextSwitchTo(PostmasterContext);

  /* Initialize paths to installation files */

  getInstallationPaths(argv[0]);

  /*

   * Set up signal handlers for the postmaster process.

   *

   * CAUTION: when changing this list, check for side-effects on the signal

   * handling setup of child processes.  See tcop/postgres.c,

   * bootstrap/bootstrap.c, postmaster/bgwriter.c, postmaster/walwriter.c,

   * postmaster/autovacuum.c, postmaster/pgarch.c, postmaster/syslogger.c,

   * postmaster/bgworker.c and postmaster/checkpointer.c.

   */

  pqinitmask();

  sigprocmask(SIG_SETMASK, &BlockSig, NULL);

  pqsignal(SIGHUP, handle_pm_reload_request_signal);

  pqsignal(SIGINT, handle_pm_shutdown_request_signal);

  pqsignal(SIGQUIT, handle_pm_shutdown_request_signal);

  pqsignal(SIGTERM, handle_pm_shutdown_request_signal);

  pqsignal(SIGALRM, PG_SIG_IGN);  /* ignored */

  pqsignal(SIGPIPE, PG_SIG_IGN);  /* ignored */

  pqsignal(SIGUSR1, handle_pm_pmsignal_signal);

  pqsignal(SIGUSR2, dummy_handler);  /* unused, reserve for children */

  pqsignal(SIGCHLD, handle_pm_child_exit_signal);

  /* This may configure SIGURG, depending on platform. */

  InitializeWaitEventSupport();

  InitProcessLocalLatch();

  /*

   * No other place in Postgres should touch SIGTTIN/SIGTTOU handling.  We

   * ignore those signals in a postmaster environment, so that there is no

   * risk of a child process freezing up due to writing to stderr.  But for

   * a standalone backend, their default handling is reasonable.  Hence, all

   * child processes should just allow the inherited settings to stand.

   */

#ifdef SIGTTIN

  pqsignal(SIGTTIN, PG_SIG_IGN);  /* ignored */

#endif

#ifdef SIGTTOU

  pqsignal(SIGTTOU, PG_SIG_IGN);  /* ignored */

#endif

  /* ignore SIGXFSZ, so that ulimit violations work like disk full */

#ifdef SIGXFSZ

  pqsignal(SIGXFSZ, PG_SIG_IGN);  /* ignored */

#endif

  /* Begin accepting signals. */

  sigprocmask(SIG_SETMASK, &UnBlockSig, NULL);

  /*

   * Options setup

   */

  InitializeGUCOptions();

  /*

   * Parse command-line options.  CAUTION: keep this in sync with

   * tcop/postgres.c (the option sets should not conflict) and with the

   * common help() function in main/main.c.

   */

  pg_getopt_start(&optctx, argc, argv, "B:bC:c:D:d:EeFf:h:ijk:lN:OPp:r:S:sTt:W:-:");

  optctx.opterr = 1;

  while ((opt = pg_getopt_next(&optctx)) != -1)

  {

    switch (opt)

    {

      case 'B':

        SetConfigOption("shared_buffers", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'b':

        /* Undocumented flag used for binary upgrades */

        IsBinaryUpgrade = true;

        break;

      case 'C':

        output_config_variable = strdup(optctx.optarg);

        break;

      case '-':

        /*

         * Error if the user misplaced a special must-be-first option

         * for dispatching to a subprogram.  parse_dispatch_option()

         * returns DISPATCH_POSTMASTER if it doesn't find a match, so

         * error for anything else.

         */

        if (parse_dispatch_option(optctx.optarg) != DISPATCH_POSTMASTER)

          ereport(ERROR,

              (errcode(ERRCODE_SYNTAX_ERROR),

               errmsg("--%s must be first argument", optctx.optarg)));

        pg_fallthrough;

      case 'c':

        {

          char     *name,

                 *value;

          ParseLongOption(optctx.optarg, &name, &value);

          if (!value)

          {

            if (opt == '-')

              ereport(ERROR,

                  (errcode(ERRCODE_SYNTAX_ERROR),

                   errmsg("--%s requires a value",

                      optctx.optarg)));

            else

              ereport(ERROR,

                  (errcode(ERRCODE_SYNTAX_ERROR),

                   errmsg("-c %s requires a value",

                      optctx.optarg)));

          }

          SetConfigOption(name, value, PGC_POSTMASTER, PGC_S_ARGV);

          pfree(name);

          pfree(value);

          break;

        }

      case 'D':

        userDoption = strdup(optctx.optarg);

        break;

      case 'd':

        set_debug_options(atoi(optctx.optarg), PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'E':

        SetConfigOption("log_statement", "all", PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'e':

        SetConfigOption("datestyle", "euro", PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'F':

        SetConfigOption("fsync", "false", PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'f':

        if (!set_plan_disabling_options(optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV))

        {

          write_stderr("%s: invalid argument for option -f: \"%s\"\n",

                 progname, optctx.optarg);

          ExitPostmaster(1);

        }

        break;

      case 'h':

        SetConfigOption("listen_addresses", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'i':

        SetConfigOption("listen_addresses", "*", PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'j':

        /* only used by interactive backend */

        break;

      case 'k':

        SetConfigOption("unix_socket_directories", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'l':

        SetConfigOption("ssl", "true", PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'N':

        SetConfigOption("max_connections", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'O':

        SetConfigOption("allow_system_table_mods", "true", PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'P':

        SetConfigOption("ignore_system_indexes", "true", PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'p':

        SetConfigOption("port", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'r':

        /* only used by single-user backend */

        break;

      case 'S':

        SetConfigOption("work_mem", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 's':

        SetConfigOption("log_statement_stats", "true", PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 'T':

        /*

         * This option used to be defined as sending SIGSTOP after a

         * backend crash, but sending SIGABRT seems more useful.

         */

        SetConfigOption("send_abort_for_crash", "true", PGC_POSTMASTER, PGC_S_ARGV);

        break;

      case 't':

        {

          const char *tmp = get_stats_option_name(optctx.optarg);

          if (tmp)

          {

            SetConfigOption(tmp, "true", PGC_POSTMASTER, PGC_S_ARGV);

          }

          else

          {

            write_stderr("%s: invalid argument for option -t: \"%s\"\n",

                   progname, optctx.optarg);

            ExitPostmaster(1);

          }

          break;

        }

      case 'W':

        SetConfigOption("post_auth_delay", optctx.optarg, PGC_POSTMASTER, PGC_S_ARGV);

        break;

      default:

        write_stderr("Try \"%s --help\" for more information.\n",

               progname);

        ExitPostmaster(1);

    }

  }

  /*

   * Postmaster accepts no non-option switch arguments.

   */

  if (optctx.optind < argc)

  {

    write_stderr("%s: invalid argument: \"%s\"\n",

           progname, argv[optctx.optind]);

    write_stderr("Try \"%s --help\" for more information.\n",

           progname);

    ExitPostmaster(1);

  }

  /*

   * Locate the proper configuration files and data directory, and read

   * postgresql.conf for the first time.

   */

  if (!SelectConfigFiles(userDoption, progname))

    ExitPostmaster(2);

  if (output_config_variable != NULL)

  {

    /*

     * If this is a runtime-computed GUC, it hasn't yet been initialized,

     * and the present value is not useful.  However, this is a convenient

     * place to print the value for most GUCs because it is safe to run

     * postmaster startup to this point even if the server is already

     * running.  For the handful of runtime-computed GUCs that we cannot

     * provide meaningful values for yet, we wait until later in

     * postmaster startup to print the value.  We won't be able to use -C

     * on running servers for those GUCs, but using this option now would

     * lead to incorrect results for them.

     */

    int     flags = GetConfigOptionFlags(output_config_variable, true);

    if ((flags & GUC_RUNTIME_COMPUTED) == 0)

    {

      /*

       * "-C guc" was specified, so print GUC's value and exit.  No

       * extra permission check is needed because the user is reading

       * inside the data dir.

       */

      const char *config_val = GetConfigOption(output_config_variable,

                           false, false);

      puts(config_val ? config_val : "");

      ExitPostmaster(0);

    }

    /*

     * A runtime-computed GUC will be printed later on.  As we initialize

     * a server startup sequence, silence any log messages that may show

     * up in the output generated.  FATAL and more severe messages are

     * useful to show, even if one would only expect at least PANIC.  LOG

     * entries are hidden.

     */

    SetConfigOption("log_min_messages", "FATAL", PGC_SUSET,

            PGC_S_OVERRIDE);

  }

  /* Verify that DataDir looks reasonable */

  checkDataDir();

  /* Check that pg_control exists */

  checkControlFile();

  /* And switch working directory into it */

  ChangeToDataDir();

  /*

   * Check for invalid combinations of GUC settings.

   */

  if (SuperuserReservedConnections + ReservedConnections >= MaxConnections)

  {

    write_stderr("%s: \"superuser_reserved_connections\" (%d) plus \"reserved_connections\" (%d) must be less than \"max_connections\" (%d)\n",

           progname,

           SuperuserReservedConnections, ReservedConnections,

           MaxConnections);

    ExitPostmaster(1);

  }

  if (XLogArchiveMode > ARCHIVE_MODE_OFF && wal_level == WAL_LEVEL_MINIMAL)

    ereport(ERROR,

        (errmsg("WAL archival cannot be enabled when \"wal_level\" is \"minimal\"")));

  if (max_wal_senders > 0 && wal_level == WAL_LEVEL_MINIMAL)

    ereport(ERROR,

        (errmsg("WAL streaming (\"max_wal_senders\" > 0) requires \"wal_level\" to be \"replica\" or \"logical\"")));

  if (summarize_wal && wal_level == WAL_LEVEL_MINIMAL)

    ereport(ERROR,

        (errmsg("WAL cannot be summarized when \"wal_level\" is \"minimal\"")));

  if (sync_replication_slots && wal_level == WAL_LEVEL_MINIMAL)

    ereport(ERROR,

        (errmsg("replication slot synchronization (\"sync_replication_slots\" = on) requires \"wal_level\" to be \"replica\" or \"logical\"")));

  /*

   * Other one-time internal sanity checks can go here, if they are fast.

   * (Put any slow processing further down, after postmaster.pid creation.)

   */

  if (!CheckDateTokenTables())

  {

    write_stderr("%s: invalid datetoken tables, please fix\n", progname);

    ExitPostmaster(1);

  }

  /* For debugging: display postmaster environment */

  if (message_level_is_interesting(DEBUG3))

  {

#if !defined(WIN32)

    extern char **environ;

#endif

    char    **p;

    StringInfoData si;

    initStringInfo(&si);

    appendStringInfoString(&si, "initial environment dump:");

    for (p = environ; *p; ++p)

      appendStringInfo(&si, "\n%s", *p);

    ereport(DEBUG3, errmsg_internal("%s", si.data));

    pfree(si.data);

  }

  /*

   * Create lockfile for data directory.

   *

   * We want to do this before we try to grab the input sockets, because the

   * data directory interlock is more reliable than the socket-file

   * interlock (thanks to whoever decided to put socket files in /tmp :-().

   * For the same reason, it's best to grab the TCP socket(s) before the

   * Unix socket(s).

   *

   * Also note that this internally sets up the on_proc_exit function that

   * is responsible for removing both data directory and socket lockfiles;

   * so it must happen before opening sockets so that at exit, the socket

   * lockfiles go away after CloseServerPorts runs.

   */

  CreateDataDirLockFile(true);

  /*

   * Read the control file (for error checking and config info).

   *

   * Since we verify the control file's CRC, this has a useful side effect

   * on machines where we need a run-time test for CRC support instructions.

   * The postmaster will do the test once at startup, and then its child

   * processes will inherit the correct function pointer and not need to

   * repeat the test.

   */

  LocalProcessControlFile(false);

  /*

   * Register the apply launcher.  It's probably a good idea to call this

   * before any modules had a chance to take the background worker slots.

   */

  ApplyLauncherRegister();

  /*

   * Register the shared memory needs of all core subsystems.

   */

  RegisterBuiltinShmemCallbacks();

  /*

   * process any libraries that should be preloaded at postmaster start

   */

  process_shared_preload_libraries();

  /*

   * Initialize SSL library, if specified.

   */

#ifdef USE_SSL

  if (EnableSSL)

  {

    (void) secure_initialize(true);

    LoadedSSL = true;

  }

#endif

  /*

   * Now that loadable modules have had their chance to alter any GUCs,

   * calculate MaxBackends and initialize the machinery to track child

   * processes.

   */

  InitializeMaxBackends();

  InitPostmasterChildSlots();

  /*

   * Calculate the size of the PGPROC fast-path lock arrays.

   */

  InitializeFastPathLocks();

  /*

   * Also call any legacy shmem request hooks that might've been installed

   * by preloaded libraries.

   *

   * Note: this must be done before ShmemCallRequestCallbacks(), because the

   * hooks may request LWLocks with RequestNamedLWLockTranche(), which in

   * turn affects the size of the LWLock array calculated in lwlock.c.

   */

  process_shmem_requests();

  /*

   * Ask all subsystems, including preloaded libraries, to register their

   * shared memory needs.

   */

  ShmemCallRequestCallbacks();

  /*

   * Now that loadable modules have had their chance to request additional

   * shared memory, determine the value of any runtime-computed GUCs that

   * depend on the amount of shared memory required.

   */

  InitializeShmemGUCs();

  /*

   * Now that modules have been loaded, we can process any custom resource

   * managers specified in the wal_consistency_checking GUC.

   */

  InitializeWalConsistencyChecking();

  /*

   * If -C was specified with a runtime-computed GUC, we held off printing

   * the value earlier, as the GUC was not yet initialized.  We handle -C

   * for most GUCs before we lock the data directory so that the option may

   * be used on a running server.  However, a handful of GUCs are runtime-

   * computed and do not have meaningful values until after locking the data

   * directory, and we cannot safely calculate their values earlier on a

   * running server.  At this point, such GUCs should be properly

   * initialized, and we haven't yet set up shared memory, so this is a good

   * time to handle the -C option for these special GUCs.

   */

  if (output_config_variable != NULL)

  {

    const char *config_val = GetConfigOption(output_config_variable,

                         false, false);

    puts(config_val ? config_val : "");

    ExitPostmaster(0);

  }

  /*

   * Set up shared memory and semaphores.

   *

   * Note: if using SysV shmem and/or semas, each postmaster startup will

   * normally choose the same IPC keys.  This helps ensure that we will

   * clean up dead IPC objects if the postmaster crashes and is restarted.

   */

  CreateSharedMemoryAndSemaphores();