系统提供环形FIFO写入重载时可能存在数据错乱问题

发布于 2022-01-08 14:22:58 浏览：1134 订阅该版

```
rt_size_t rt_ringbuffer_put_force(struct rt_ringbuffer *rb,
                            const rt_uint8_t     *ptr,
                            rt_uint16_t           length)
{
    rt_uint16_t space_length;

RT_ASSERT(rb != RT_NULL);

space_length = rt_ringbuffer_space_len(rb);

if (length > rb->buffer_size)
    {
        ptr = &ptr[length - rb->buffer_size];
        length = rb->buffer_size;
    }

if (rb->buffer_size - rb->write_index > length)
    {
        /* read_index - write_index = empty space */
        memcpy(&rb->buffer_ptr[rb->write_index], ptr, length);
        /* this should not cause overflow because there is enough space for
         * length of data in current mirror */
        rb->write_index += length;

if (length > space_length)
            rb->read_index = rb->write_index;

return length;
    }

memcpy(&rb->buffer_ptr[rb->write_index],
           &ptr[0],
           rb->buffer_size - rb->write_index);
    memcpy(&rb->buffer_ptr[0],
           &ptr[rb->buffer_size - rb->write_index],
           length - (rb->buffer_size - rb->write_index));

/* we are going into the other side of the mirror */
    rb->write_mirror = ~rb->write_mirror;
    rb->write_index = length - (rb->buffer_size - rb->write_index);

if (length > space_length)
    {
        if (rb->write_index <= rb->read_index)
            rb->read_mirror = ~rb->read_mirror;
        rb->read_index = rb->write_index;
    }

return length;
}
```
ringbuffer.c中原始代码中,在往rb中写入数据时，总是先进行memcpy，再修改write指针。则有可能出现如下现象:
1、假设开始时刻rb为空，且写指针write_index = 0.
2、在低优先级线程中向rb中写入"asdfghjkl"(不包含字符串结尾'\0')，但是在memcpy完成'f'字节时，被高优先级线程抢断/中断触发了，然后在高优先级线程/中断中再次向同一个rb写入"1234567890"(不包含字符串结尾'\0')。
3、我们期望的结果为"asdfghjkl1234567890"(不包含字符串结尾'\0')，write_index=19
3、但是因为write指针因为在低优先级中在memcpy前没有提前偏移到结束位置，因此此时write_index还是等于0，因此高优先级中会把第0到第10个字节幅值为"1234567890"，并且将write_index偏移10个字节，因此此时index=10.
4、然后从高优先级线程/中断返回到第优先级线程时，由于memcpy已经复制完成'f'字节即第4个字节，因此将从第5个字节开始接着复制，于是当第优先级的memcpy复制完成时，rb里的内容为"1234ghjkl0"，然后再将write_index偏移9个字节
5、可以看到，write_index=19这个写入的长度是正确的，但是fifo里的内容已经和期望的不一样了。此时如果将rb中的数据取出来则输出的是"1234ghjkl0000000000"

修复方法：
每次写入rb时，在memcpy前，先用一个局部变量(write_index_temp)记住当前的write_index，然后提前偏移最终的write_index，这样如果被高优先级抢断并且重载了，会从正确的write_index的位置开始进行写入(即低优先级写入内容的末尾)，然后返回低优先级线程时，低优先级使用实现记住的write_index_temp来进行memcpy操作，则可以接着将剩余被打断的内容接着写入rb中

修改后的代码如下：
```
rt_size_t rt_ringbuffer_put_force(struct rt_ringbuffer *rb,
                            const rt_uint8_t     *ptr,
                            rt_uint16_t           length)
{
    rt_uint16_t space_length;
    rt_uint16_t write_index_temp;
    RT_ASSERT(rb != RT_NULL);

space_length = rt_ringbuffer_space_len(rb);

if (length > rb->buffer_size)
    {
        ptr = &ptr[length - rb->buffer_size];
        length = rb->buffer_size;
    }

if (rb->buffer_size - rb->write_index > length)
    {
        /* this should not cause overflow because there is enough space for
         * length of data in current mirror */
        write_index_temp = rb->write_index; //记录当前的index,即使被高优先级重载了,恢复之后也不受影响
        rb->write_index += length; //先偏移write_index防止在高优先级线程中被重载时,index没有被偏移到低优先级结束为止
        
        /* read_index - write_index = empty space */
        memcpy(&rb->buffer_ptr[rb->write_index], ptr, length);

if (length > space_length)
            rb->read_index = rb->write_index;

return length;
    }

/* we are going into the other side of the mirror */
    write_index_temp = rb->write_index; //记录当前的index,即使被高优先级重载了,恢复之后也不受影响
    rb->write_mirror = ~rb->write_mirror; //镜像反转时，处理方法也同上，先反转和计算写入结束时的index
    rb->write_index = length - (rb->buffer_size - rb->write_index);
    
    memcpy(&rb->buffer_ptr[rb->write_index],
           &ptr[0],
           rb->buffer_size - rb->write_index);
    memcpy(&rb->buffer_ptr[0],
           &ptr[rb->buffer_size - rb->write_index],
           length - (rb->buffer_size - rb->write_index));

if (length > space_length)
    {
        if (rb->write_index <= rb->read_index)
            rb->read_mirror = ~rb->read_mirror;
        rb->read_index = rb->write_index;
    }

return length;
}
```
修改之后同上写入流程则如下：
1、低优先级线程写入"asdfghjkl"(不包括结尾'\0')，在写入完成'f'时发生抢断，但是由于提前偏移了write_index，因此此时write_index=9
2、进入高优先级线程，向同一个rb中写入"1234567890"(不包括结尾'\0'),由于write_index=9，因此写入后结果为"asdf000001234567890"，并且write_index += 10，此时write_index=19
3、从高优先级线程返回低优先级线程，memcpy从之前的位置接着往下写，于是结果变为"asdfghjkl1234567890"，数据内容与期望一致,write_index的结果也与期望一致