Struct SplitMetadata 

pub struct SplitMetadata<I: Allocator> { /* private fields */ }

SplitMetadata wrapper.

Note: this primitive isolates allocator metadata into a separate mapping (cache-line / pollution separation). It does not by itself enforce that a linear overflow cannot reach metadata — two independent mmaps may land adjacent; see the module docs. For a hard overflow barrier, wrap the data side in GuardPage.

Adding guard pages on top requires the inner data region to be OsBacked (so GuardPage<SplitMetadata<MmapBacked>> works, but GuardPage<SplitMetadata<Slab<...>>> does not — Slab is not OsBacked and GuardPage rejects it at the type level). For the HardenedSlab recipe — the recommended security composition — the guard pages wrap the OS-mapped data side and the Slab lives on top, giving the form Slab<T, GuardPage<SplitMetadata<MmapBacked>>>.

Implementations

impl<I: Allocator> SplitMetadata<I>

pub fn new(data_region: I, meta_size: usize) -> Result<Self, AllocError>

Wrap data_region and allocate a fresh metadata mmap of meta_size bytes.

Returns Err(AllocError) if the metadata mmap fails.

pub fn with_meta(data_region: I, meta_region: MmapBacked) -> Self

Wrap with a pre-built metadata region. Useful when the caller wants to construct the meta MmapBacked with specific flags (huge pages, populate, etc.).

Precondition: meta_region must not overlap the data_region’s address range. A fresh MmapBacked::new(..) always satisfies this (the OS returns a distinct mapping); the caveat exists only if you hand in a region derived from the data side. Overlap would silently defeat the isolation this type provides — it is not checked here.

pub fn meta_base(&self) -> NonNull<u8>

First byte of the metadata region.

pub fn meta_size(&self) -> usize

Length in bytes of the metadata region.

pub fn meta(&self) -> &MmapBacked

Borrow the metadata mmap directly. Mainly for callers that want to apply OsBacked ops (release_pages, protect) to the meta region independently.

pub fn data(&self) -> &I

Borrow the data allocator.

Trait Implementations

impl<I: Allocator> Allocator for SplitMetadata<I>

fn allocate(&self, layout: NonZeroLayout) -> Result<NonNull<[u8]>, AllocError>

Allocate a block satisfying layout. The returned slice’s length is at least layout.size() but may be larger.

unsafe fn usable_size( &self, ptr: NonNull<u8>, layout: NonZeroLayout, ) -> Option<usize>

Usable size of an existing allocation, if the allocator can report it. Defaults to None — implementors that track usable size override.

fn capacity_bytes(&self) -> Option<usize>

Total bytes this allocator can issue, if bounded. None for unbounded allocators like System. Used by Watermark to compute thresholds.

fn corruption_events(&self) -> u64

Detected freelist / metadata corruption events observed by this allocator since construction.

fn allocate_zeroed( &self, layout: NonZeroLayout, ) -> Result<NonNull<[u8]>, AllocError>

Allocate a zero-initialized block.

unsafe fn grow( &self, ptr: NonNull<u8>, old: NonZeroLayout, new: NonZeroLayout, ) -> Result<NonNull<[u8]>, AllocError>

Grow an allocation in place if possible, otherwise allocate-copy-free.

unsafe fn shrink( &self, ptr: NonNull<u8>, old: NonZeroLayout, new: NonZeroLayout, ) -> Result<NonNull<[u8]>, AllocError>

Shrink an allocation in place if possible, otherwise allocate-copy-free.

fn reset(&mut self) -> Result<(), AllocError>

Reclaim everything previously allocated. Default impl returns AllocError — only arena-style allocators implement a meaningful reset.

impl<I: Allocator> Deallocator for SplitMetadata<I>

unsafe fn deallocate(&self, ptr: NonNull<u8>, layout: NonZeroLayout)

Release a previously allocated block.

impl<I: Allocator + FixedRange> FixedRange for SplitMetadata<I>

fn commit(&self, offset: usize, len: usize) -> Result<(), AllocError>

Forward to the data region. The metadata lives in a separate mmap, so base/size already track data_region 1:1 — no offset translation is needed, and a commit-aware consumer over a lazy_commit data region reaches the right pages.

fn base(&self) -> NonNull<u8>

First byte of the owned address range.

fn size(&self) -> usize

Length in bytes of the owned address range.

fn contains(&self, ptr: NonNull<u8>) -> bool

Whether ptr lies within [base, base + size).

impl<I: Allocator + OsBacked> OsBacked for SplitMetadata<I>

fn base_ptr(&self) -> NonNull<u8>

First byte of the OS-managed region.

fn region_size(&self) -> usize

Length in bytes of the OS-managed region.

unsafe fn release_pages(&self, ptr: NonNull<u8>, size: usize)

Release the physical pages backing [ptr, ptr + size) to the OS while keeping the virtual address range reserved.

unsafe fn protect(&self, ptr: NonNull<u8>, size: usize, flags: ProtectFlags)

Change memory protection flags on [ptr, ptr + size).