Skip to content

Commit 96ef3b8

Browse files
simonat2ndQuadrantsimonat2ndQuadrant
committed
Allow I/O reliability checks using 16-bit checksums
Checksums are set immediately prior to flush out of shared buffers and checked when pages are read in again. Hint bit setting will require full page write when block is dirtied, which causes various infrastructure changes. Extensive comments, docs and README. WARNING message thrown if checksum fails on non-all zeroes page; ERROR thrown but can be disabled with ignore_checksum_failure = on. Feature enabled by an initdb option, since transition from option off to option on is long and complex and has not yet been implemented. Default is not to use checksums. Checksum used is WAL CRC-32 truncated to 16-bits. Simon Riggs, Jeff Davis, Greg Smith Wide input and assistance from many community members. Thank you.
1 parent e4a05c7 commit 96ef3b8

File tree

40 files changed

+766
-146
lines changed

40 files changed

+766
-146
lines changed

‎contrib/pg_upgrade/controldata.c

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ get_control_data(ClusterInfo *cluster, bool live_check)
5656
bool got_toast = false;
5757
bool got_date_is_int = false;
5858
bool got_float8_pass_by_value = false;
59+
bool got_data_checksums = false;
5960
char *lc_collate = NULL;
6061
char *lc_ctype = NULL;
6162
char *lc_monetary = NULL;
@@ -131,6 +132,13 @@ get_control_data(ClusterInfo *cluster, bool live_check)
131132
got_float8_pass_by_value = true;
132133
}
133134

135+
/* Only in <= 9.2 */
136+
if (GET_MAJOR_VERSION(cluster->major_version) <= 902)
137+
{
138+
cluster->controldata.data_checksums = false;
139+
got_data_checksums = true;
140+
}
141+
134142
/* we have the result of cmd in "output". so parse it line by line now */
135143
while (fgets(bufin, sizeof(bufin), output))
136144
{
@@ -393,6 +401,18 @@ get_control_data(ClusterInfo *cluster, bool live_check)
393401
cluster->controldata.float8_pass_by_value = strstr(p, "by value") != NULL;
394402
got_float8_pass_by_value = true;
395403
}
404+
else if ((p = strstr(bufin, "checksums")) != NULL)
405+
{
406+
p = strchr(p, ':');
407+
408+
if (p == NULL || strlen(p) <= 1)
409+
pg_log(PG_FATAL, "%d: controldata retrieval problem\n", __LINE__);
410+
411+
p++; /* removing ':' char */
412+
/* used later for contrib check */
413+
cluster->controldata.data_checksums = strstr(p, "enabled") != NULL;
414+
got_data_checksums = true;
415+
}
396416
/* In pre-8.4 only */
397417
else if ((p = strstr(bufin, "LC_COLLATE:")) != NULL)
398418
{
@@ -476,7 +496,7 @@ get_control_data(ClusterInfo *cluster, bool live_check)
476496
!got_tli ||
477497
!got_align || !got_blocksz || !got_largesz || !got_walsz ||
478498
!got_walseg || !got_ident || !got_index || !got_toast ||
479-
!got_date_is_int || !got_float8_pass_by_value)
499+
!got_date_is_int || !got_float8_pass_by_value || !got_data_checksums)
480500
{
481501
pg_log(PG_REPORT,
482502
"The %s cluster lacks some required control information:\n",
@@ -535,6 +555,10 @@ get_control_data(ClusterInfo *cluster, bool live_check)
535555
if (!got_float8_pass_by_value)
536556
pg_log(PG_REPORT, " float8 argument passing method\n");
537557

558+
/* value added in Postgres 9.3 */
559+
if (!got_data_checksums)
560+
pg_log(PG_REPORT, " data checksums\n");
561+
538562
pg_log(PG_FATAL,
539563
"Cannot continue without required control information, terminating\n");
540564
}
@@ -596,6 +620,12 @@ check_control_data(ControlData *oldctrl,
596620
"--disable-integer-datetimes or get server binaries built with those\n"
597621
"options.\n");
598622
}
623+
624+
if (oldctrl->data_checksums != newctrl->data_checksums)
625+
{
626+
pg_log(PG_FATAL,
627+
"old and new pg_controldata checksums settings are invalid or do not match\n");
628+
}
599629
}
600630

601631

‎contrib/pg_upgrade/pg_upgrade.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,7 @@ typedef struct
202202
uint32 toast;
203203
bool date_is_int;
204204
bool float8_pass_by_value;
205+
bool data_checksums;
205206
char *lc_collate;
206207
char *lc_ctype;
207208
char *encoding;

‎doc/src/sgml/config.sgml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6629,6 +6629,30 @@ LOG: CleanUpLock: deleting: lock(0xb7acd844) id(24688,24696,0,0,0,1)
66296629
</listitem>
66306630
</varlistentry>
66316631

6632+
<varlistentry id="guc-ignore-checksum-failure" xreflabel="ignore_checksum_failure">
6633+
<term><varname>ignore_checksum_failure</varname> (<type>boolean</type>)</term>
6634+
<indexterm>
6635+
<primary><varname>ignore_checksum_failure</> configuration parameter</primary>
6636+
</indexterm>
6637+
<listitem>
6638+
<para>
6639+
Only has effect if <xref linkend="app-initdb-data-checksums"> are enabled.
6640+
</para>
6641+
<para>
6642+
Detection of a checksum failure during a read normally causes
6643+
<productname>PostgreSQL</> to report an error, aborting the current
6644+
transaction. Setting <varname>ignore_checksum_failure</> to on causes
6645+
the system to ignore the failure (but still report a warning), and
6646+
continue processing. This behavior may <emphasis>cause crashes, propagate
6647+
or hide corruption, or other serious problems</>. However, it may allow
6648+
you to get past the error and retrieve undamaged tuples that might still be
6649+
present in the table if the block header is still sane. If the header is
6650+
corrupt an error will be reported even if this option is enabled. The
6651+
default setting is <literal>off</>, and it can only be changed by a superuser.
6652+
</para>
6653+
</listitem>
6654+
</varlistentry>
6655+
66326656
<varlistentry id="guc-zero-damaged-pages" xreflabel="zero_damaged_pages">
66336657
<term><varname>zero_damaged_pages</varname> (<type>boolean</type>)</term>
66346658
<indexterm>

‎doc/src/sgml/ref/initdb.sgml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,20 @@ PostgreSQL documentation
182182
</listitem>
183183
</varlistentry>
184184

185+
<varlistentry id="app-initdb-data-checksums" xreflabel="data checksums">
186+
<term><option>-k</option></term>
187+
<term><option>--data-checksums</option></term>
188+
<listitem>
189+
<para>
190+
Use checksums on data pages to help detect corruption by the
191+
I/O system that would otherwise be silent. Enabling checksums
192+
may incur a noticeable performance penalty. This option can only
193+
be set during initialization, and cannot be changed later. If
194+
set, checksums are calculated for all objects, in all databases.
195+
</para>
196+
</listitem>
197+
</varlistentry>
198+
185199
<varlistentry>
186200
<term><option>--locale=<replaceable>locale</replaceable></option></term>
187201
<listitem>

‎src/backend/access/gist/gistget.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -362,8 +362,12 @@ gistScanPage(IndexScanDesc scan, GISTSearchItem *pageItem, double *myDistances,
362362
{
363363
/* Creating index-page GISTSearchItem */
364364
item->blkno = ItemPointerGetBlockNumber(&it->t_tid);
365-
/* lsn of current page is lsn of parent page for child */
366-
item->data.parentlsn = PageGetLSN(page);
365+
366+
/*
367+
* LSN of current page is lsn of parent page for child. We only
368+
* have a shared lock, so we need to get the LSN atomically.
369+
*/
370+
item->data.parentlsn = BufferGetLSNAtomic(buffer);
367371
}
368372

369373
/* Insert it into the queue using new distance data */

‎src/backend/access/hash/hash.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -285,11 +285,9 @@ hashgettuple(PG_FUNCTION_ARGS)
285285
ItemIdMarkDead(PageGetItemId(page, offnum));
286286

287287
/*
288-
* Since this can be redone later if needed, it's treated the same
289-
* as a commit-hint-bit status update for heap tuples: we mark the
290-
* buffer dirty but don't make a WAL log entry.
288+
* Since this can be redone later if needed, mark as a hint.
291289
*/
292-
SetBufferCommitInfoNeedsSave(buf);
290+
MarkBufferDirtyHint(buf);
293291
}
294292

295293
/*

‎src/backend/access/heap/heapam.c

Lines changed: 64 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -5754,17 +5754,23 @@ log_heap_freeze(Relation reln, Buffer buffer,
57545754
* being marked all-visible, and vm_buffer is the buffer containing the
57555755
* corresponding visibility map block. Both should have already been modified
57565756
* and dirtied.
5757+
*
5758+
* If checksums are enabled, we also add the heap_buffer to the chain to
5759+
* protect it from being torn.
57575760
*/
57585761
XLogRecPtr
5759-
log_heap_visible(RelFileNode rnode, BlockNumber block, Buffer vm_buffer,
5762+
log_heap_visible(RelFileNode rnode, Buffer heap_buffer, Buffer vm_buffer,
57605763
TransactionId cutoff_xid)
57615764
{
57625765
xl_heap_visible xlrec;
57635766
XLogRecPtr recptr;
5764-
XLogRecData rdata[2];
5767+
XLogRecData rdata[3];
5768+
5769+
Assert(BufferIsValid(heap_buffer));
5770+
Assert(BufferIsValid(vm_buffer));
57655771

57665772
xlrec.node = rnode;
5767-
xlrec.block = block;
5773+
xlrec.block = BufferGetBlockNumber(heap_buffer);
57685774
xlrec.cutoff_xid = cutoff_xid;
57695775

57705776
rdata[0].data = (char *) &xlrec;
@@ -5778,6 +5784,17 @@ log_heap_visible(RelFileNode rnode, BlockNumber block, Buffer vm_buffer,
57785784
rdata[1].buffer_std = false;
57795785
rdata[1].next = NULL;
57805786

5787+
if (DataChecksumsEnabled())
5788+
{
5789+
rdata[1].next = &(rdata[2]);
5790+
5791+
rdata[2].data = NULL;
5792+
rdata[2].len = 0;
5793+
rdata[2].buffer = heap_buffer;
5794+
rdata[2].buffer_std = true;
5795+
rdata[2].next = NULL;
5796+
}
5797+
57815798
recptr = XLogInsert(RM_HEAP2_ID, XLOG_HEAP2_VISIBLE, rdata);
57825799

57835800
return recptr;
@@ -6139,8 +6156,6 @@ static void
61396156
heap_xlog_visible(XLogRecPtr lsn, XLogRecord *record)
61406157
{
61416158
xl_heap_visible *xlrec = (xl_heap_visible *) XLogRecGetData(record);
6142-
Buffer buffer;
6143-
Page page;
61446159

61456160
/*
61466161
* If there are any Hot Standby transactions running that have an xmin
@@ -6155,39 +6170,56 @@ heap_xlog_visible(XLogRecPtr lsn, XLogRecord *record)
61556170
ResolveRecoveryConflictWithSnapshot(xlrec->cutoff_xid, xlrec->node);
61566171

61576172
/*
6158-
* Read the heap page, if it still exists. If the heap file has been
6159-
* dropped or truncated later in recovery, we don't need to update the
6160-
* page, but we'd better still update the visibility map.
6173+
* If heap block was backed up, restore it. This can only happen with
6174+
* checksums enabled.
61616175
*/
6162-
buffer = XLogReadBufferExtended(xlrec->node, MAIN_FORKNUM, xlrec->block,
6163-
RBM_NORMAL);
6164-
if (BufferIsValid(buffer))
6176+
if (record->xl_info & XLR_BKP_BLOCK(1))
61656177
{
6166-
LockBuffer(buffer, BUFFER_LOCK_EXCLUSIVE);
6167-
6168-
page = (Page) BufferGetPage(buffer);
6178+
Assert(DataChecksumsEnabled());
6179+
(void) RestoreBackupBlock(lsn, record, 1, false, false);
6180+
}
6181+
else
6182+
{
6183+
Buffer buffer;
6184+
Page page;
61696185

61706186
/*
6171-
* We don't bump the LSN of the heap page when setting the visibility
6172-
* map bit, because that would generate an unworkable volume of
6173-
* full-page writes. This exposes us to torn page hazards, but since
6174-
* we're not inspecting the existing page contents in any way, we
6175-
* don't care.
6176-
*
6177-
* However, all operations that clear the visibility map bit *do* bump
6178-
* the LSN, and those operations will only be replayed if the XLOG LSN
6179-
* follows the page LSN. Thus, if the page LSN has advanced past our
6180-
* XLOG record's LSN, we mustn't mark the page all-visible, because
6181-
* the subsequent update won't be replayed to clear the flag.
6187+
* Read the heap page, if it still exists. If the heap file has been
6188+
* dropped or truncated later in recovery, we don't need to update the
6189+
* page, but we'd better still update the visibility map.
61826190
*/
6183-
if (lsn > PageGetLSN(page))
6191+
buffer = XLogReadBufferExtended(xlrec->node, MAIN_FORKNUM,
6192+
xlrec->block, RBM_NORMAL);
6193+
if (BufferIsValid(buffer))
61846194
{
6185-
PageSetAllVisible(page);
6186-
MarkBufferDirty(buffer);
6187-
}
6195+
LockBuffer(buffer, BUFFER_LOCK_EXCLUSIVE);
61886196

6189-
/* Done with heap page. */
6190-
UnlockReleaseBuffer(buffer);
6197+
page = (Page) BufferGetPage(buffer);
6198+
6199+
/*
6200+
* We don't bump the LSN of the heap page when setting the
6201+
* visibility map bit (unless checksums are enabled, in which case
6202+
* we must), because that would generate an unworkable volume of
6203+
* full-page writes. This exposes us to torn page hazards, but
6204+
* since we're not inspecting the existing page contents in any
6205+
* way, we don't care.
6206+
*
6207+
* However, all operations that clear the visibility map bit *do*
6208+
* bump the LSN, and those operations will only be replayed if the
6209+
* XLOG LSN follows the page LSN. Thus, if the page LSN has
6210+
* advanced past our XLOG record's LSN, we mustn't mark the page
6211+
* all-visible, because the subsequent update won't be replayed to
6212+
* clear the flag.
6213+
*/
6214+
if (lsn > PageGetLSN(page))
6215+
{
6216+
PageSetAllVisible(page);
6217+
MarkBufferDirty(buffer);
6218+
}
6219+
6220+
/* Done with heap page. */
6221+
UnlockReleaseBuffer(buffer);
6222+
}
61916223
}
61926224

61936225
/*
@@ -6218,7 +6250,7 @@ heap_xlog_visible(XLogRecPtr lsn, XLogRecord *record)
62186250
* real harm is done; and the next VACUUM will fix it.
62196251
*/
62206252
if (lsn > PageGetLSN(BufferGetPage(vmbuffer)))
6221-
visibilitymap_set(reln, xlrec->block, lsn, vmbuffer,
6253+
visibilitymap_set(reln, xlrec->block, InvalidBuffer, lsn, vmbuffer,
62226254
xlrec->cutoff_xid);
62236255

62246256
ReleaseBuffer(vmbuffer);

‎src/backend/access/heap/pruneheap.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,7 @@ heap_page_prune(Relation relation, Buffer buffer, TransactionId OldestXmin,
262262
{
263263
((PageHeader) page)->pd_prune_xid = prstate.new_prune_xid;
264264
PageClearFull(page);
265-
SetBufferCommitInfoNeedsSave(buffer);
265+
MarkBufferDirtyHint(buffer);
266266
}
267267
}
268268

‎src/backend/access/heap/rewriteheap.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,8 @@ end_heap_rewrite(RewriteState state)
273273
/* Write the last page, if any */
274274
if (state->rs_buffer_valid)
275275
{
276+
PageSetChecksumInplace(state->rs_buffer, state->rs_blockno);
277+
276278
if (state->rs_use_wal)
277279
log_newpage(&state->rs_new_rel->rd_node,
278280
MAIN_FORKNUM,
@@ -614,6 +616,8 @@ raw_heap_insert(RewriteState state, HeapTuple tup)
614616
{
615617
/* Doesn't fit, so write out the existing page */
616618

619+
PageSetChecksumInplace(page, state->rs_blockno);
620+
617621
/* XLOG stuff */
618622
if (state->rs_use_wal)
619623
log_newpage(&state->rs_new_rel->rd_node,

0 commit comments

Comments
 (0)