Checkpoint Rendezvous

Bounded cross-channel synchronization for distributed vital channels. More...

Files
file	src/redundancy/checkpoint/rte_checkpoint.c
	Implementation of the bounded checkpoint rendezvous (ADR-017).

Data Structures
struct	rte_checkpoint_config_t
	Checkpoint configuration. More...

Functions
rte_status_t	rte_channel_checkpoint (rte_voter_t *voter, const rte_checkpoint_config_t *config)
	Performs one bounded checkpoint rendezvous across every channel registered with a voter.

Detailed Description

Bounded cross-channel synchronization for distributed vital channels.

REQ-CHECKPOINT-001: rte_channel_checkpoint() shall never block longer than config->max_delay_ms. REQ-CHECKPOINT-002: a checkpoint-arrival reply that fails CRC verification or carries a different checkpoint_id shall not count toward expected_node_count. REQ-CHECKPOINT-003: if fewer than expected_node_count valid replies arrive within max_delay_ms, rte_channel_checkpoint() shall call rte_safestate_enter() at RTE_SAFESTATE_LEVEL_SAFE with RTE_SAFESTATE_REASON_CHECKPOINT_TIMEOUT before returning RTE_STATUS_TIMEOUT.

Function Documentation

rte_channel_checkpoint()

rte_status_t rte_channel_checkpoint	(	rte_voter_t *	voter,
		const rte_checkpoint_config_t *	config )

Performs one bounded checkpoint rendezvous across every channel registered with a voter.

Broadcasts a checkpoint-arrival message (config->checkpoint_id) to every one of voter's registered channels (via each channel's own rte_channel_send()), then polls each channel's rte_channel_receive() bounded by config->max_delay_ms, counting only replies that pass rte_checksum_vital_message_verify() and carry the matching checkpoint_id. This is direct per-channel I/O, not a rte_voter_send()/_receive() voting round - checkpoint messages are rendezvous markers, not data to vote on.

Parameters

voter	Voter with 1+ channels already registered (rte_voter_register_channel()). Must not be NULL.
config	Checkpoint configuration. Must not be NULL.

Returns

RTE_STATUS_OK if at least config->expected_node_count valid confirmations arrived within config->max_delay_ms (the optional watchdog, if any, has been kicked at least once - once per internal retry round, plus once more on this success).

RTE_STATUS_INVALID_PARAM if voter or config is NULL, or config->expected_node_count exceeds voter's registered channel count.

RTE_STATUS_TIMEOUT if fewer than expected_node_count valid confirmations arrived in time.

Precondition

voter != NULL, config != NULL

Postcondition

On RTE_STATUS_TIMEOUT, rte_safestate_enter() has already been called at RTE_SAFESTATE_LEVEL_SAFE with RTE_SAFESTATE_REASON_CHECKPOINT_TIMEOUT before this function returns (REQ-CHECKPOINT-003) - the same "safe-state is triggered automatically by the sync/vote logic itself" pattern rte_voter_receive() already uses on a voting disagreement.

Safety:

No dynamic memory allocation. Never blocks longer than config->max_delay_ms (REQ-CHECKPOINT-001).

Definition at line 239 of file rte_checkpoint.c.