OwnershipConcept

Explanation

Ownership costs nothing at runtime and needs no allocator, OS, or std — it's a compile-time concept, so everything in the classic Explanation holds without modification under #![no_std]. Embedded Rust also has one of the strongest, most concrete illustrations of why single ownership matters: the singleton peripheral pattern, which nearly every embedded-hal-based crate (the STM32, RP2040, nRF52, and SAMD HAL families among them) uses to model hardware.

A microcontroller's registers are a fixed, singular physical resource — there is exactly one UART1, one GPIOA bank, one TIM2 timer on the chip. The peripheral-access crate (PAC) generated for that chip exposes a single Peripherals struct whose fields are handles to each of these blocks, and a Peripherals::take() function that hands the whole struct out at most once, returning None on every call after the first. Doing this turns ownership into a hardware-safety guarantee: if you have a Gpioa value, you know statically that no other code in the program can also have one, so no other code can be reconfiguring the same GPIO bank's mode register while you're mid-configuration. This is exactly the same "exactly one owner, enforced at compile time" idea the classic Explanation describes for a String — applied here to a piece of physical hardware instead of a heap allocation, which is arguably a more intuitive place for it to click: a microcontroller pin genuinely does have only one wire, so letting exactly one owner exist for it isn't a compiler restriction, it's a fact about the hardware that the type system is finally able to state directly.

Once obtained, that ownership composes exactly like the classic Explanation describes: passing gpioa into a driver's constructor moves it again, so the driver becomes the pin's new sole owner, and the caller loses the ability to touch it directly — see Move semantics for that half of the picture.

Basic usage example

struct Gpioa; // stand-in for a PAC-generated peripheral type

struct Peripherals { gpioa: Gpioa }

static TAKEN: core::sync::atomic::AtomicBool = core::sync::atomic::AtomicBool::new(false);

impl Peripherals {
    fn take() -> Option<Self> {
        if TAKEN.swap(true, core::sync::atomic::Ordering::AcqRel) {
            None // <- already taken once: no second owner of the hardware is possible
        } else {
            Some(Peripherals { gpioa: Gpioa })
        }
    }
}

let p1 = Peripherals::take(); // Some(...): first call succeeds
let p2 = Peripherals::take(); // None: the hardware is already owned
assert!(p1.is_some());
assert!(p2.is_none());

Best practices & deeper information

struct Gpioa; // stand-in for a PAC-generated peripheral type
struct Peripherals { gpioa: Gpioa }
struct Led { pin: Gpioa }

impl Peripherals {
    fn take() -> Option<Self> { Some(Peripherals { gpioa: Gpioa }) } // simplified for this example
}

impl Led {
    fn new(pin: Gpioa) -> Self { // <- ownership moves again: the Led is now the pin's sole owner
        Led { pin }
    }
}

let peripherals = Peripherals::take().unwrap();
let led = Led::new(peripherals.gpioa); // <- peripherals.gpioa moves into led; it can't be reused from `peripherals`

use core::sync::atomic::{AtomicBool, Ordering};

struct Gpioa; // stand-in for a PAC-generated peripheral type

pub struct Peripherals {
    pub gpioa: Gpioa,
}

static TAKEN: AtomicBool = AtomicBool::new(false);

impl Peripherals {
    pub fn take() -> Option<Self> {
        // <- swap is a single atomic operation: two simultaneous callers can't both see `false`
        if TAKEN.swap(true, Ordering::AcqRel) {
            None
        } else {
            Some(Peripherals { gpioa: Gpioa })
        }
    }
}