Re: Prevent premature startup of pg_upgrade targets

Hi,

Here is a first version of the patch.

pg_upgrade now creates a file named pg_upgrade_in_progress in the new
cluster's data directory right after the consistency checks, before it
first modifies the new cluster (so --check never creates it), and
removes it after the last step that starts the new cluster. Both the
creation and the removal are fsynced.

checkDataDir() refuses to start the server while the file exists,
unless IsBinaryUpgrade is set. pg_upgrade always starts its servers
with -b, so its own startups are unaffected. Doing the check in
checkDataDir() means it runs before postmaster.pid is created or
anything else is written, and it also covers single-user mode.

If pg_upgrade fails or is interrupted, the file stays in place and a
startup attempt fails with:

FATAL: data directory "..." is being upgraded by pg_upgrade
DETAIL: File ".../pg_upgrade_in_progress" exists.
HINT: Wait for pg_upgrade to complete. If pg_upgrade failed, the new
cluster must be re-created with initdb.

Testing:
- The reproduction from my previous mail (suspending pg_upgrade during
"Copying user relation files" and starting the target with pg_ctl)
now fails with the error above, and the upgrade completes normally
afterwards.
- Killing pg_upgrade during file transfer leaves the marker in place,
and the new cluster cannot be started.
- 002_pg_upgrade.pl now checks that --check does not create the marker,
that a successful upgrade removes it, and that the server refuses to
start while it exists.
- check-world passes, including all transfer modes in
006_transfer_modes.pl.

Open points:
1. The marker is fsynced even with --no-sync, since it is cheap and
safety-related. Happy to change that if preferred.
2. The #define lives in access/xlog_internal.h next to
XLOG_CONTROL_FILE, since it has to be usable from frontend code.
The file name itself is of course open for discussion.
3. The rsync/standby case Nik mentioned is not handled; keeping the
marker after completion could be a follow-up option.

Regards,
Shubhra

>