Battery backed RAM

[usbalbin]

What do you think about adding some nice API for accessing the battery backed RAM found in, for example, the stm32h5 series?

---

I suppose we could always offer some simple API with read/write methods.

However, do you think it would be possible to figure out how to achieve something like this in a safe way?

enum ReasonForDataReset {
    /// This is the first time we run or the first time after battery power was lost
    BackupRamDisabled,

    /// The struct layout does not seem to match
    ///
    /// `all_bytes` may be used to try to recover if the firmware was updated on purpose
    StructureMissmatch{ all_bytes: &mut[u8] }
}

...

#[repr(C)]
struct MyStruct {
    foo: u32,
    bar: MyEnum, // <-- Not all bit patterns are valid for this type
}

// This will be run the first time to set the defaults and on struct layout missmatch
let fn_to_setup_defaults = |_reason: ReasonForDataReset| MyStruct { foo: 42 };

// Here we get a mutable reference to the value stored in battery backed ram
let x: &'static mut MyStruct = BackupRam::init::<MyStruct>(p.BACKUP_RAM, fn_to_setup_defaults);

loop {
    x.foo += 1; // These writes will persist resets and loss of vcc
    defmt::info!("I have ran {} iterations since I was programmed/battery was inserted", x.foo);
}

How do we ensure

• The user uses the same type with the same layout every time
  • Would it be possible to create a checksum for the types layout and run fn_to_setup_defaults on missmatch or something?
• The type does not contain pointers/references out of the battery backed memory
  • Create a trait for types that are safe to store?
• Large structures does not overflow the stack in fn_to_setup_defaults.
• Ensure the compiler does not think it is reading uninitialized garbage.

[usbalbin]

Some sort of (very) rough idea here #4663

[nikvoid]

I use custom RAM section and unsafe code for this purpose:

/// Wrapper for storing persistent value in backup SRAM
///
/// Must be used carefully:
/// - `T` must not have any pointers
/// - `T` must not have `Drop` impl
/// 
/// Should be in `static` in section `.bkpsram`
#[repr(C)]
pub struct BackupSram<T> {
    init: UnsafeCell<MaybeUninit<u32>>,
    data: UnsafeCell<MaybeUninit<T>>,
}

impl<T> BackupSram<T> {
    /// Init magic number
    const INIT: u32 = 0xA7EE7151;
    
    /// No-op initializer
    pub const fn new() -> Self {
        Self {
            init: UnsafeCell::new(MaybeUninit::uninit()),
            data: UnsafeCell::new(MaybeUninit::uninit()),
        }
    }

    /// Overwrite previous value, if it exists
    pub unsafe fn set(&self, f: impl FnOnce() -> T) {
        self.data.get().write_volatile(MaybeUninit::new(f()));
        self.init.get().write_volatile(MaybeUninit::new(Self::INIT));
    }
    
    /// Get reference to current value
    pub unsafe fn get(&self) -> Option<&mut T> {
        if self.init.get().read().assume_init() != Self::INIT {
            return None;           
        }

        Some(self.data.get().as_mut_unchecked().assume_init_mut())
    }

    /// Reset init state and zeroize data
    pub unsafe fn reset(&self) {
        self.init.get().write_volatile(MaybeUninit::zeroed());
        self.data.get().write_volatile(MaybeUninit::zeroed());
    }

    /// Get value and reset init state
    pub unsafe fn take(&self) -> Option<T> {
        if self.init.get().read().assume_init() != Self::INIT {
            return None;           
        }
        
        let ret = Some(self.data.get().read_volatile().assume_init());
        
        self.reset();

        ret
    }
}

MEMORY {
  FLASH (rx)   : ORIGIN = 0x08000000, LENGTH = 896K
  RAM (xrw)    : ORIGIN = 0x20000000, LENGTH = 512K
  BKPSRAM (rw) : ORIGIN = 0x40024000, LENGTH = 4K
}

SECTIONS {
  .bkpsram (NOLOAD): {
    KEEP(*(.bkpsram))
    KEEP(*(.bkpsram.*))
  } > BKPSRAM
}

With this approach you just can't use other type, but it is not actually checked for being Plain Old Data. All reads are volatile so compiler (I hope) don't assume it may be optimized in some way.

Another good side: you'll get linker error on memory overflow.

[usbalbin]

Thanks! :)