Struct Framebuffer 

pub struct Framebuffer {
    pub pitch: usize,
    pub bpp: usize,
    pub width: usize,
    pub height: usize,
    pub r_shift: u32,
    pub g_shift: u32,
    pub b_shift: u32,
    /* private fields */
}

A mapped framebuffer granted to the console service (via crate::ServiceContext::framebuffer), plus the geometry needed to address a pixel in it.

Unlike Mmio, which exists to read and write device registers one at a time, a framebuffer is addressed in bulk - long contiguous runs, whole-row fills, a full-screen clear - so this hands out a slice rather than word accessors. That is what lets the renderer above it be ordinary bounds-checked Rust with no unsafe at all (§18.2 forbids unsafe in a service outright), and it keeps write-combining and write-buffer gathering available: a pixel run is one copy_from_slice, not N volatile stores.

The handle owns the mapping for the service’s lifetime and is not Copy, so there is exactly one route to those bytes and it is a &mut self borrow. That matters beyond tidiness: the alternative spelling, a &'static mut [u8] field, is an unowned mutable global in everything but name.

Fields

pitch: usize

Bytes per scanline.

bpp: usize

Bytes per pixel.

width: usize

Visible width in pixels.

height: usize

Visible height in pixels.

r_shift: u32

Bit position of the red channel within a pixel.

g_shift: u32

Bit position of the green channel within a pixel.

b_shift: u32

Bit position of the blue channel within a pixel.

Implementations

impl Framebuffer

pub fn bytes_mut(&mut self) -> &mut [u8]

The framebuffer’s bytes, for rendering.

The one unsafe a display costs. From here up, every pixel write is a bounds-checked slice write: a wrong offset paints nothing rather than corrupting memory.

pub fn len(&self) -> usize

Length of the mapping in bytes (pitch * height).

pub fn is_empty(&self) -> bool

Whether the mapping is empty. Present because clippy asks for it beside len; a granted framebuffer is never zero-length.