app_main_common.c

Go to the documentation of this file.

/* _POSIX_C_SOURCE 200809L: nanosleep() below is POSIX.1-2001, not base
 * ISO C99; must be defined before any header is included. */
#define _POSIX_C_SOURCE 200809L

#include "app_main_common.h"
 
#include <stdio.h>
#include <stdlib.h> /* getenv */
#include <time.h>
 
#include "rte/app/appmanager/rte_appmanager.h"
#include "rte/redundancy/checksum/rte_checksum.h"
#include "rte/oal/log/rte_log.h"
#include "rte/oal/platform/rte_platform.h"
#include "rte/posix_osadapter/rte_posix_osadapter.h"
#include "rte/oal/reboot/rte_reboot.h"
#include "rte/utils/safestate/rte_safestate.h"
#include "rte/redundancy/watchdog/rte_watchdog.h"
 
#include "common_config.h"





static void reboot_safestate_handler(rte_safestate_level_t level, rte_safestate_reason_t reason, const char *file,
                                      int32_t line, const char *message);
static void safe_safestate_handler(rte_safestate_level_t level, rte_safestate_reason_t reason, const char *file,
                                    int32_t line, const char *message);
static void degraded_safestate_handler(rte_safestate_level_t level, rte_safestate_reason_t reason, const char *file,
                                        int32_t line, const char *message);
 

rte_status_t app_main_common_init(int argc, char **argv)
{
    rte_status_t status;
 
    /* Unbuffered: this app's stdout is diagnostic console output from
     * several threads/processes racing in real time - buffering would
     * make the interleaving misleading (or, worse, lose output entirely
     * if a process is ever killed by a signal instead of returning from
     * main()). Not a hot path, so the extra syscalls are fine here. */
    (void)setvbuf(stdout, NULL, _IONBF, 0);
 
    status = rte_posix_osadapter_register_all();
    if (status != RTE_STATUS_OK)
    {
        /* The one deliberate exception to "every module uses rte_log":
         * this call is what registers the log OSAdapter in the first
         * place (rte_osadapter_log_register() is one of the registrations
         * inside it) - if it failed, rte_log_write() cannot be trusted
         * to reach anywhere, so this stays a raw fprintf(). Every other
         * failure path in this file runs after this call has already
         * succeeded and is a real rte_log_write() call. */
        (void)fprintf(stderr, "rte_posix_osadapter_register_all() failed: %s\n", rte_status_to_string(status));
        return status;
    }
 
    /* Configure real-time platform capabilities (mlockall, SCHED_FIFO on a
     * PREEMPT_RT host) through the framework's OAL, not the OSAdapter
     * directly - the concrete behavior is whatever
     * rte_posix_osadapter_register_all() above registered (ADR-035).
     * Best-effort: a (void)-cast NOT_SUPPORTED/partial result is expected
     * on an unprivileged or non-RT host. */
    (void)rte_platform_realtime_init(80U);
 
    /* Optional diagnostic log verbosity: RTE_RBC_LOG_LEVEL=DEBUG|INFO|
     * WARNING|ERROR raises rte_log's threshold for this process. Purely
     * non-safety (rte_log, ADR-001 section 4); an unset or unrecognised
     * value leaves the framework default. The C/Gateway role additionally
     * accepts a runtime change and fans it to A and B (gateway_c_logctl.c),
     * so the whole RBC pair can be re-levelled from one place. */
    {
        const char      *lvl_env = getenv("RTE_RBC_LOG_LEVEL");
        rte_log_level_t  lvl;
 
        if ((lvl_env != NULL) && (rte_log_level_from_string(lvl_env, &lvl) == RTE_STATUS_OK))
        {
            rte_log_write_event(RTE_LOG_LEVEL_INFO, "-", 0U, "MAIN", "-", "LOG_LEVEL",
                                  "set from RTE_RBC_LOG_LEVEL", lvl_env);
            rte_log_set_level(lvl);
        }
    }
 
    /* Registered as early as possible (right after the OSAdapter that will
     * use it is registered), so any later REBOOT re-execs with this same
     * argv and this process resumes as the SAME role/site rather than
     * losing that to a placeholder command line. See
     * rte_posix_osadapter.h's own doc. */
    rte_posix_osadapter_reboot_set_argv(argc, argv);
 
    /* Required once before any rte_checksum_crc64() call (ab_gp_channel.c's
     * A<->B peer-link integrity check). Harmless for roles that never call
     * into rte_checksum - initializing unconditionally here keeps every
     * main() simple and matches how OSAdapter registration above is
     * likewise done once regardless of role. */
    status = rte_checksum_crc64_init(RTE_EXAMPLE_CRC64_POLYNOMIAL);
    if (status != RTE_STATUS_OK)
    {
        char msg[64];
 
        (void)snprintf(msg, sizeof(msg), "rte_checksum_crc64_init() failed: %s", rte_status_to_string(status));
        rte_log_write(RTE_LOG_LEVEL_ERROR, "MAIN", msg);
        return status;
    }
 
    /* Idempotent (safe even though every one of this example's processes
     * calls it independently - each process gets its own in-process
     * watchdog pool, there is no cross-process sharing here). Harmless for
     * roles that don't arm a watchdog of their own. */
    status = rte_watchdog_manager_initialize();
    if (status != RTE_STATUS_OK)
    {
        char msg[64];
 
        (void)snprintf(msg, sizeof(msg), "rte_watchdog_manager_initialize() failed: %s",
                        rte_status_to_string(status));
        rte_log_write(RTE_LOG_LEVEL_ERROR, "MAIN", msg);
        return status;
    }
 
    /* rte_posix_osadapter_register_all() above already registered the log
     * OSAdapter (rte_osadapter_log_register() inside it) - rte_log_write()/
     * rte_log_write_event() are live from that point on, not from this
     * call: the POSIX OSAdapter's own osadapter_init() is a pure no-op and
     * osadapter_write() is stateless (see safeAPIBackendPosix's
     * rte_posix_osadapter_log.c), so nothing here actually depends on
     * rte_log_init() having run first. This call remains best-effort
     * (REQ-OAL-LOG-001: a no-op if somehow no OSAdapter were registered) -
     * every module in this application uses rte_log exclusively now,
     * there is no parallel printf trail left to fall back on. */
    (void)rte_log_init();
 
    /* Non-fatal if this ever returns non-OK: on this project's only actual
     * target (a real POSIX host, via src/posix_osadapter/) it always
     * succeeds, but failing to install a convenience stop handler should
     * not itself prevent the demo from running - it would just mean
     * Ctrl+C/SIGTERM falls back to the OS default (which for A/B/C's
     * now-infinite loops is still a clean process exit, just not a
     * graceful rte_appmanager shutdown). */
    status = rte_appmanager_install_default_signal_handlers();
    if (status != RTE_STATUS_OK)
    {
        char msg[96];
 
        (void)snprintf(msg, sizeof(msg), "rte_appmanager_install_default_signal_handlers(): %s - continuing anyway",
                        rte_status_to_string(status));
        rte_log_write(RTE_LOG_LEVEL_WARNING, "MAIN", msg);
    }
 
    /* Only ab_gp_channel_crosscompare.c/ab_gp_channel_negotiate.c (A/B roles)
     * ever call RTE_SAFESTATE_LEVEL_REBOOT in this demo, but registering
     * the handler unconditionally here is harmless for C and keeps this
     * the one place every role's REBOOT reaction is wired up, same
     * rationale as the signal handler install above. */
    status = rte_safestate_register_handler(RTE_SAFESTATE_LEVEL_REBOOT, reboot_safestate_handler);
    if (status != RTE_STATUS_OK)
    {
        char msg[96];
 
        (void)snprintf(msg, sizeof(msg), "rte_safestate_register_handler(REBOOT): %s - continuing anyway",
                        rte_status_to_string(status));
        rte_log_write(RTE_LOG_LEVEL_WARNING, "MAIN", msg);
    }
 
    status = rte_safestate_register_handler(RTE_SAFESTATE_LEVEL_DEGRADED, degraded_safestate_handler);
    if (status != RTE_STATUS_OK)
    {
        char msg[96];
 
        (void)snprintf(msg, sizeof(msg), "rte_safestate_register_handler(DEGRADED): %s - continuing anyway",
                        rte_status_to_string(status));
        rte_log_write(RTE_LOG_LEVEL_WARNING, "MAIN", msg);
    }
 
    /* See safe_safestate_handler's own doc: registering this is what
     * turns a SAFE-level halt from a silent, undiagnosable freeze into
     * one that at least logs why before it stops responding. */
    status = rte_safestate_register_handler(RTE_SAFESTATE_LEVEL_SAFE, safe_safestate_handler);
    if (status != RTE_STATUS_OK)
    {
        char msg[96];
 
        (void)snprintf(msg, sizeof(msg), "rte_safestate_register_handler(SAFE): %s - continuing anyway",
                        rte_status_to_string(status));
        rte_log_write(RTE_LOG_LEVEL_WARNING, "MAIN", msg);
    }
 
    return RTE_STATUS_OK;
}
 
 
/****Local functions ****/
 
static void reboot_safestate_handler(rte_safestate_level_t level, rte_safestate_reason_t reason, const char *file,
                                      int32_t line, const char *message)
{
    char extra[32];
 
    (void)level;
    (void)file;
    (void)line;
    (void)message;
    (void)snprintf(extra, sizeof(extra), "DelayMs=%u", (unsigned int)RTE_EXAMPLE_REBOOT_DELAY_MS);
    /* No site identifier is available in this handler's scope (fixed
     * rte_safestate handler signature, no user_ctx - registered once in
     * app_main_common_init() before/independent of this process's own
     * site/role) - "" per rte_log_write_event()'s own doc on a caller
     * with no site concept reachable here. */
    rte_log_write_event(RTE_LOG_LEVEL_WARNING, "", 0U, "REBOOT", "-", "REBOOT",
                          "FAULTED - simulating hardware reboot", extra);
    {
        struct timespec ts;
 
        ts.tv_sec = (time_t)(RTE_EXAMPLE_REBOOT_DELAY_MS / 1000U);
        ts.tv_nsec = (long)((RTE_EXAMPLE_REBOOT_DELAY_MS % 1000U) * 1000000L);
        (void)nanosleep(&ts, NULL);
    }
    /* Info text literally contains "REBOOT requested" - depended on by
     * safeAPIRBC2oo2TestEnv's own Robot fault-injection suite
     * (ContainerSupportFunctions.extended_partition_container_and_verify_self_reboot(),
     * which greps container logs for that exact substring to confirm the
     * channel-down->REBOOT escalation actually fired) - do not reword
     * this Info text without updating that check too. */
    (void)snprintf(extra, sizeof(extra), "Reason=%u", (unsigned int)reason);
    rte_log_write_event(RTE_LOG_LEVEL_WARNING, "", 0U, "REBOOT", "-", "REBOOT",
                          "REBOOT requested - re-execing process image", extra);
    (void)rte_reboot_request((uint16_t)reason);
}
 
static void safe_safestate_handler(rte_safestate_level_t level, rte_safestate_reason_t reason, const char *file,
                                    int32_t line, const char *message)
{
    char extra[160];
 
    (void)level;
    (void)snprintf(extra, sizeof(extra), "Reason=%u File=%s Line=%d", (unsigned int)reason,
                    (file != NULL) ? file : "?", (int)line);
    rte_log_write_event(RTE_LOG_LEVEL_ERROR, "", 0U, "SAFESTATE", "-", "SAFE_HALT",
                          (message != NULL) ? message : "entering SAFE state", extra);
}
 
static void degraded_safestate_handler(rte_safestate_level_t level, rte_safestate_reason_t reason, const char *file,
                                        int32_t line, const char *message)
{
    char extra[160];
    const rte_log_level_t log_level =
        (reason == RTE_SAFESTATE_REASON_SETUP_AFTER_INIT) ? RTE_LOG_LEVEL_ERROR : RTE_LOG_LEVEL_WARNING;
 
    (void)level;
    (void)snprintf(extra, sizeof(extra), "Reason=%u File=%s Line=%d", (unsigned int)reason,
                    (file != NULL) ? file : "?", (int)line);
    rte_log_write_event(log_level, "", 0U, "SAFESTATE", "-", "DEGRADED",
                          (message != NULL) ? message : "DEGRADED reported", extra);
}