Struct SafeStop 

pub struct SafeStop;

SafeStop — owns the warm-reset cleanup sequence.

Per DPR-02 §5.5 and the §7 API sketch: SafeStop::run is the single entry point, called once during BoardRuntime::init before the new boot’s init code touches any peripheral in the active ServiceSet. The current boot’s clock tree MUST NOT have been reprogrammed yet (INV-DPR-2-1).

The type is intentionally a zero-sized marker today. DPR-02a phase-1 step 2+ extends it to own typed hwcore::regs::* handles for the peripherals it disables (DMA1, SAI1, BDMA, SAI4, SDMMC1, QUADSPI, I2C4, NVIC) plus a DWT cycle-counter reference for the elapsed_us accumulator. The owned-handles refactor preserves the unsafe fn run signature.

Implementations

impl SafeStop

pub unsafe fn run(services: ServiceSet) -> SafeStopReport

Run the safe-stop sequence for every peripheral implied by services, in the DPR-02 §5.1 frozen order. Returns the per-peripheral SafeStopReport::timeouts bitmask and the elapsed wall-clock from the DWT cycle counter.

Safety

The caller MUST assert all of the following:

1. Called exactly once during early boot — before any peripheral in the active ServiceSet is enabled by the new boot’s init code. The DPR-02 §5.4 mapping enumerates which peripherals correspond to each service.
2. Pre-clock-tree-reprogramming — the current boot’s RCC PLL / divider / kernel-clock-mux configuration MUST NOT have been modified yet (DPR-02 §6 INV-DPR-2-1). Reprogramming kernel clocks while a peripheral is still running an inherited transfer can latch the peripheral into a partially-disabled state.
3. No concurrent access to the named peripherals — no other code path is currently writing to any peripheral in the DPR-02 §5.4 mapping for services. The caller’s typed-register-handle ownership discipline is what makes this assertion safe (DPR-02a phase-1 wires this through hwcore::regs::* accessors).

Scaffold body

This is scaffold: the body is a NOP and returns SafeStopReport { timeouts: 0, elapsed_us: 0 }. The signature is frozen here so consumer wiring in BoardRuntime::init ratifies separately from the peripheral-disable sequence. DPR-02a phase-1 step 2+ replaces the body with the real 5-step ordering per DPR-02 §5.1.