@@ -253,8 +253,16 @@ impl GraphicsOutput {
253253 ///
254254 /// To use this pointer safely, a caller must...
255255 /// - Honor the pixel format specificed by the mode info
256+ /// - Keep pointer accesses in bound
256257 /// - Use volatile writes so that the compiler does not optimize out or
257- /// aggressively reorder the framebuffer accesses.
258+ /// aggressively reorder framebuffer accesses
259+ /// - Make sure that the pointer is not used beyond its validity limit
260+ ///
261+ /// Although the UEFI spec makes no clear statement about framebuffer
262+ /// pointer validity, it seems reasonable to expect the framebuffer pointer
263+ /// to be valid until the next mode change. In the future, a safer interface
264+ /// may be introduced, which would enforce volatile writes and automatically
265+ /// check for dangling pointers using Rust's borrow checker.
258266 pub fn frame_buffer ( & mut self ) -> ( * mut u8 , usize ) {
259267 assert ! (
260268 self . mode. info. format != PixelFormat :: BltOnly ,
0 commit comments