Struct BuddyFrameAllocator 

pub struct BuddyFrameAllocator;

Wrapper around the buddy allocator implementing the x86_64 crate’s FrameAllocator trait.

Used by OffsetPageTable when it needs a new intermediate page-table node (PML4 / PDPT / PD / PT).

Safety invariant: page-table frames MUST be zeroed

The x86_64 CPU page-table walker reads all 512 entries of every intermediate node it traverses, regardless of which entries are “in use”. If a newly allocated page-table frame contains stale bytes (left behind by the slab allocator or a previous allocation), any non-zero entry is decoded as a valid PTE pointing to an arbitrary physical address. The first fetch from such an address becomes the new RIP after the Ring 3 transition : explaining why RIP is non-deterministic across boots.

BuddyFrameAllocator enforces zeroing via FrameAllocOptions::new() .purpose(FramePurpose::PageTable) which:

1. Calls the buddy allocator for a raw order-0 frame.
2. CAS-claims the frame via the MetaSlot refcount field (REFCOUNT_UNUSED → 1).
3. Zeros the 4 KiB with a single ptr::write_bytes through the HHDM.
4. Sets purpose flags on the MetaSlot with Release ordering.
5. Stores refcount = 1 with Release ordering so any future reader that loads the refcount with Acquire observes a fully-initialised frame.

This matches the Asterinas OSTD pattern (FrameAllocOptions + per-frame MetaSlot with refcount CAS). Metadata lives in dedicated slots (not in mapped page bytes); see get_meta_slot.

Trait Implementations

impl FrameAllocator<Size4KiB> for BuddyFrameAllocator

fn allocate_frame(&mut self) -> Option<X86PhysFrame<Size4KiB>>

Allocate a frame of the appropriate size and return it if possible.