rte_safestate.h File Reference

Safe-state transitions and checked assertions (ADR-004). More...

#include "rte/utils/status/rte_status.h"
#include "rte/utils/types/rte_types.h"

Include dependency graph for rte_safestate.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Macros
#define	RTE_SAFESTATE_REASON_UNSPECIFIED   ((rte_safestate_reason_t)0U)
#define	RTE_SAFESTATE_REASON_ASSERT_FAILED   ((rte_safestate_reason_t)1U)
#define	RTE_SAFESTATE_REASON_CHECKPOINT_TIMEOUT   ((rte_safestate_reason_t)2U)
#define	RTE_SAFESTATE_REASON_SETUP_AFTER_INIT   ((rte_safestate_reason_t)3U)
#define	RTE_SAFESTATE_REASON_OSA_RT_ATTRIBUTE   ((rte_safestate_reason_t)4U)
#define	RTE_SAFESTATE_REASON_CLOCK_FAILED   ((rte_safestate_reason_t)5U)
#define	RTE_SAFESTATE_REASON_APPLICATION_BASE   ((rte_safestate_reason_t)4096U)
#define	RTE_ASSERT(cond)
	Checked assertion. Always active in every build configuration, including production (ADR-004 section 2.5) - unlike standard assert(), which CLAUDE.md prohibits in production paths. On failure, enters RTE_SAFESTATE_LEVEL_SAFE with reason RTE_SAFESTATE_REASON_ASSERT_FAILED.
#define	RTE_SAFESTATE(level, reason)
	Explicitly enters the given safe-state level with a reason code, capturing the call site automatically.
#define	RTE_REBOOT(reason)
	Enters RTE_SAFESTATE_LEVEL_REBOOT with the given reason code. Equivalent to RTE_SAFESTATE(RTE_SAFESTATE_LEVEL_REBOOT, reason).

Typedefs
typedef uint16_t	rte_safestate_reason_t
	Diagnostic reason code accompanying a safe-state transition.
typedef void(*)	rte_safestate_handler_t(rte_safestate_level_t level, rte_safestate_reason_t reason, const char *file, int32_t line, const char *message)
	Application-supplied reaction for one safe-state level.

Enumerations
enum	rte_safestate_level_t { RTE_SAFESTATE_LEVEL_DEGRADED = 0 , RTE_SAFESTATE_LEVEL_SAFE = 1 , RTE_SAFESTATE_LEVEL_REBOOT = 2 }
	Safe-state severity levels (ADR-004 section 2.1). More...

Functions
rte_status_t	rte_safestate_register_handler (rte_safestate_level_t level, rte_safestate_handler_t handler)
	Registers the reaction handler for one safe-state level. This is how an integrator supplies their own implementation of "what happens when this level is entered" (ADR-004 section 2.2).
void	rte_safestate_enter (rte_safestate_level_t level, rte_safestate_reason_t reason, const char *file, int32_t line, const char *message)
	Enters a safe-state level: invokes the registered handler (if any), then, for RTE_SAFESTATE_LEVEL_SAFE and RTE_SAFESTATE_LEVEL_REBOOT, guarantees the call never returns (REQ-COMMON-SAFESTATE-002) even if no handler was registered or the handler itself returns.

Detailed Description

Safe-state transitions and checked assertions (ADR-004).

A layer-agnostic fault-reaction facility usable from any layer (OAL, the future L1, and L2 RBC core): RTE_ASSERT() replaces the production-banned standard assert(); RTE_SAFESTATE()/RTE_REBOOT() let any code explicitly declare "this fault requires the system to leave normal operation."

This module has no OS dependency (see ADR-002 section 4, ADR-004 section 2.3): the actual fail-safe reaction is supplied by the integrator via rte_safestate_register_handler(), not by this module calling into src/os itself.

REQ-COMMON-SAFESTATE-001: no dynamic allocation; handler storage is a fixed array of 3 slots (one per level). REQ-COMMON-SAFESTATE-002: RTE_SAFESTATE_LEVEL_SAFE and RTE_SAFESTATE_LEVEL_REBOOT shall never return control to the caller, even if no handler is registered or the registered handler itself returns (see rte_safestate_enter()).

Definition in file rte_safestate.h.