Remove Allocator_guard

This patch removes old 'Allocator_guard' utility and replaces its use
with the modern 'Constrained_ram_allocator'.

The adjustment of core in this respect has the side effect of a more
accurate capability accounting in core's CPU, TRACE, and RM services.
In particular, the dataspace capabilities needed for core-internal
allocations via the 'Sliced_heap' are accounted to the client now.
The same goes for nitpicker and nic_dump as other former users of the
allocator guard. Hence, the patch also touches code at the client and
server sides related to these services.

The only remaining user of the 'Allocator_guard' is the Intel GPU
driver. As the adaptation of this component would be too invasive
without testing, this patch leaves this component unchanged by keeping a
copy of the 'allocator_guard.h' locally at the component.

Fixes #3750

repos/base-foc/src/core/include/vm_session_component.h

@@ -15,7 +15,6 @@
 #define _CORE__VM_SESSION_COMPONENT_H_
 
 /* Genode includes */
-#include <base/allocator_guard.h>
 #include <base/rpc_server.h>
 #include <base/heap.h>
 #include <vm_session/vm_session.h>

repos/base-nova/src/core/include/vm_session_component.h

@@ -15,11 +15,8 @@
 #define _CORE__VM_SESSION_COMPONENT_H_
 
 /* Genode includes */
-#include <base/allocator_guard.h>
 #include <base/rpc_server.h>
-
 #include <vm_session/vm_session.h>
-
 #include <trace/control_area.h>
 #include <trace/source_registry.h>
 

repos/base-sel4/src/core/include/vm_session_component.h

@@ -15,7 +15,6 @@
 #define _CORE__VM_SESSION_COMPONENT_H_
 
 /* Genode includes */
-#include <base/allocator_guard.h>
 #include <base/rpc_server.h>
 #include <vm_session/vm_session.h>
 

repos/base/include/base/connection.h

@@ -14,6 +14,7 @@
 #ifndef _INCLUDE__BASE__CONNECTION_H_
 #define _INCLUDE__BASE__CONNECTION_H_
 
+#include <util/retry.h>
 #include <base/env.h>
 #include <base/capability.h>
 #include <base/log.h>
@@ -52,7 +53,6 @@ class Genode::Connection_base : Noncopyable, Interface
 		 */
 		Connection_base();
 
-
 		void upgrade(Session::Resources resources)
 		{
 			String<80> const args("ram_quota=", resources.ram_quota, ", "
@@ -69,6 +69,29 @@ class Genode::Connection_base : Noncopyable, Interface
 		{
 			upgrade(Session::Resources { Ram_quota{0}, Cap_quota{caps} });
 		}
+
+		/**
+		 * Extend session quota on demand while calling an RPC function
+		 *
+		 * \param ram   amount of RAM to upgrade as response to 'Out_of_ram'
+		 * \param caps  amount of caps to upgrade as response to 'Out_of_caps'
+		 *
+		 * \noapi
+		 */
+		template <typename FUNC>
+		auto retry_with_upgrade(Ram_quota ram, Cap_quota caps, FUNC func) -> decltype(func())
+		{
+			enum { UPGRADE_ATTEMPTS = ~0U };
+			return Genode::retry<Out_of_ram>(
+				[&] () {
+					return Genode::retry<Out_of_caps>(
+						[&] () { return func(); },
+						[&] () { upgrade_caps(caps.value); },
+						UPGRADE_ATTEMPTS);
+				},
+				[&] () { upgrade_ram(ram.value); },
+				UPGRADE_ATTEMPTS);
+		}
 };
 
 

repos/base/include/base/ram_allocator.h

@@ -82,7 +82,7 @@ class Genode::Constrained_ram_allocator : public Ram_allocator
 			_ram_alloc(ram_alloc), _ram_guard(ram_guard), _cap_guard(cap_guard)
 		{ }
 
-		Ram_dataspace_capability alloc(size_t size, Cache_attribute cached) override
+		Ram_dataspace_capability alloc(size_t size, Cache_attribute cached = CACHED) override
 		{
 			size_t page_aligned_size = align_addr(size, 12);
 

repos/base/include/cpu_session/connection.h

@@ -41,6 +41,16 @@ struct Genode::Cpu_connection : Connection<Cpu_session>, Cpu_session_client
 		                                priority, RAM_QUOTA, CAP_QUOTA, label)),
 		Cpu_session_client(cap())
 	{ }
+
+	Thread_capability create_thread(Capability<Pd_session> pd,
+	                                Name const            &name,
+	                                Affinity::Location     affinity,
+	                                Weight                 weight,
+	                                addr_t                 utcb = 0) override
+	{
+		return retry_with_upgrade(Ram_quota{8*1024}, Cap_quota{2}, [&] () {
+			return Cpu_session_client::create_thread(pd, name, affinity, weight, utcb); });
+	}
 };
 
 #endif /* _INCLUDE__CPU_SESSION__CONNECTION_H_ */

repos/base/include/cpu_session/cpu_session.h

@@ -43,7 +43,7 @@ struct Genode::Cpu_session : Session
 	 * allocation, its session capability, the capability of the 'Native_cpu'
 	 * RPC interface, and a capability for the trace-control dataspace.
 	 */
-	enum { CAP_QUOTA = 4 };
+	enum { CAP_QUOTA = 6 };
 
 	typedef Cpu_session_client Client;
 

repos/base/include/trace_session/client.h

@@ -77,7 +77,7 @@ struct Genode::Trace::Session_client : Genode::Rpc_client<Genode::Trace::Session
 		 * \throw Out_of_ram
 		 * \throw Out_of_caps
 		 */
-		size_t subjects(Subject_id *dst, size_t dst_len)
+		virtual size_t subjects(Subject_id *dst, size_t dst_len)
 		{
 			size_t const num_subjects = min(call<Rpc_subjects>(), dst_len);
 

repos/base/include/trace_session/connection.h

@@ -14,6 +14,7 @@
 #ifndef _INCLUDE__TRACE_SESSION__CONNECTION_H_
 #define _INCLUDE__TRACE_SESSION__CONNECTION_H_
 
+#include <util/retry.h>
 #include <trace_session/client.h>
 #include <base/connection.h>
 
@@ -23,6 +24,12 @@ namespace Genode { namespace Trace { struct Connection; } }
 struct Genode::Trace::Connection : Genode::Connection<Genode::Trace::Session>,
                                    Genode::Trace::Session_client
 {
+	template <typename FUNC>
+	auto _retry(FUNC func) -> decltype(func())
+	{
+		return retry_with_upgrade(Ram_quota{8*1024}, Cap_quota{2}, func);
+	}
+
 	/**
 	 * Constructor
 	 *
@@ -34,9 +41,33 @@ struct Genode::Trace::Connection : Genode::Connection<Genode::Trace::Session>,
 	:
 		Genode::Connection<Session>(env,
 			session(env.parent(), "ram_quota=%lu, arg_buffer_size=%lu, parent_levels=%u",
-			        ram_quota + 2048, arg_buffer_size, parent_levels)),
+			        ram_quota + 10*1024, arg_buffer_size, parent_levels)),
 		Session_client(env.rm(), cap())
 	{ }
+
+	Policy_id alloc_policy(size_t size) override
+	{
+		return _retry([&] () {
+			return Session_client::alloc_policy(size); });
+	}
+
+	void trace(Subject_id s, Policy_id p, size_t buffer_size) override
+	{
+		_retry([&] () { Session_client::trace(s, p, buffer_size); });
+	}
+
+	size_t subjects(Subject_id *dst, size_t dst_len) override
+	{
+		return _retry([&] () {
+			return Session_client::subjects(dst, dst_len); });
+	}
+
+	template <typename FN>
+	size_t for_each_subject_info(FN const &fn)
+	{
+		return _retry([&] () {
+			return Session_client::for_each_subject_info(fn); });
+	}
 };
 
 #endif /* _INCLUDE__TRACE_SESSION__CONNECTION_H_ */

repos/base/include/trace_session/trace_session.h

@@ -29,7 +29,7 @@ struct Genode::Trace::Session : Genode::Session
 	 */
 	static const char *service_name() { return "TRACE"; }
 
-	enum { CAP_QUOTA = 4 };
+	enum { CAP_QUOTA = 6 };
 
 	/**
 	 * Allocate policy-module backing store

repos/base/src/core/cpu_session_component.cc

@@ -34,9 +34,7 @@ Thread_capability Cpu_session_component::create_thread(Capability<Pd_session> pd
 {
 	Trace::Thread_name thread_name(name.string());
 
-	if (!_md_alloc.withdraw(_utcb_quota_size())) {
+	withdraw(Ram_quota{_utcb_quota_size()});
-		throw Out_of_ram();
-	}
 
 	Cpu_thread_component *thread = 0;
 
@@ -126,7 +124,7 @@ void Cpu_session_component::_unsynchronized_kill_thread(Thread_capability thread
 		destroy(&_thread_alloc, thread);
 	}
 
-	_md_alloc.upgrade(_utcb_quota_size());
+	replenish(Ram_quota{_utcb_quota_size()});
 }
 
 
@@ -174,17 +172,6 @@ Dataspace_capability Cpu_session_component::trace_control()
 }
 
 
-static size_t remaining_session_ram_quota(char const *args)
-{
-	/*
-	 * We don't need to consider an underflow here because
-	 * 'Cpu_root::_create_session' already checks for the condition.
-	 */
-	return Arg_string::find_arg(args, "ram_quota").ulong_value(0)
-	     - Trace::Control_area::SIZE;
-}
-
-
 void Cpu_session_component::_transfer_quota(Cpu_session_component &dst,
                                             size_t const quota)
 {
@@ -254,28 +241,30 @@ int Cpu_session_component::ref_account(Cpu_session_capability ref_cap)
 }
 
 
-Cpu_session_component::Cpu_session_component(Ram_allocator          &ram,
+Cpu_session_component::Cpu_session_component(Rpc_entrypoint         &session_ep,
+                                             Resources        const &resources,
+                                             Label            const &label,
+                                             Diag             const &diag,
+                                             Ram_allocator          &ram_alloc,
                                              Region_map             &local_rm,
-                                             Rpc_entrypoint         &session_ep,
                                              Rpc_entrypoint         &thread_ep,
                                              Pager_entrypoint       &pager_ep,
-                                             Allocator              &md_alloc,
                                              Trace::Source_registry &trace_sources,
                                              char             const *args,
                                              Affinity         const &affinity,
                                              size_t           const  quota)
 :
-	_label(label_from_args(args)),
+	Session_object(session_ep, resources, label, diag),
-	_session_ep(session_ep),
+	_session_ep(session_ep), _thread_ep(thread_ep), _pager_ep(pager_ep),
-	_thread_ep(thread_ep), _pager_ep(pager_ep),
+	_ram_alloc(ram_alloc, _ram_quota_guard(), _cap_quota_guard()),
-	_md_alloc(&md_alloc, remaining_session_ram_quota(args)),
+	_md_alloc(_ram_alloc, local_rm),
 	_thread_alloc(_md_alloc), _priority(0),
 
 	/* map affinity to a location within the physical affinity space */
 	_location(affinity.scale_to(platform().affinity_space())),
 
 	_trace_sources(trace_sources),
-	_trace_control_area(ram, local_rm),
+	_trace_control_area(_ram_alloc, local_rm),
 	_quota(quota), _ref(0),
 	_native_cpu(*this, args)
 {

repos/base/src/core/include/cpu_root.h

@@ -26,7 +26,7 @@ namespace Genode {
 	{
 		private:
 
-			Ram_allocator          &_ram;
+			Ram_allocator          &_ram_alloc;
 			Region_map             &_local_rm;
 			Rpc_entrypoint         &_thread_ep;
 			Pager_entrypoint       &_pager_ep;
@@ -45,17 +45,19 @@ namespace Genode {
 					throw Insufficient_ram_quota();
 
 				return new (md_alloc())
-					Cpu_session_component(
+					Cpu_session_component(*this->ep(),
-						_ram, _local_rm,
+					                      session_resources_from_args(args),
-						*Root_component<Cpu_session_component>::ep(),
+					                      session_label_from_args(args),
-						_thread_ep, _pager_ep, _md_alloc, _trace_sources,
+					                      session_diag_from_args(args),
-						args, affinity, 0);
+					                      _ram_alloc, _local_rm,
+					                      _thread_ep, _pager_ep, _trace_sources,
+					                      args, affinity, 0);
 			}
 
 			void _upgrade_session(Cpu_session_component *cpu, const char *args) override
 			{
-				size_t ram_quota = Arg_string::find_arg(args, "ram_quota").ulong_value(0);
+				cpu->upgrade(ram_quota_from_args(args));
-				cpu->upgrade_ram_quota(ram_quota);
+				cpu->upgrade(cap_quota_from_args(args));
 			}
 
 		public:
@@ -67,7 +69,7 @@ namespace Genode {
 			 * \param thread_ep    entry point for managing threads
 			 * \param md_alloc     meta data allocator to be used by root component
 			 */
-			Cpu_root(Ram_allocator          &ram,
+			Cpu_root(Ram_allocator          &ram_alloc,
 			         Region_map             &local_rm,
 			         Rpc_entrypoint         &session_ep,
 			         Rpc_entrypoint         &thread_ep,
@@ -76,7 +78,7 @@ namespace Genode {
 			         Trace::Source_registry &trace_sources)
 			:
 				Root_component<Cpu_session_component>(&session_ep, &md_alloc),
-				_ram(ram), _local_rm(local_rm),
+				_ram_alloc(ram_alloc), _local_rm(local_rm),
 				_thread_ep(thread_ep), _pager_ep(pager_ep),
 				_md_alloc(md_alloc), _trace_sources(trace_sources)
 			{ }

repos/base/src/core/include/cpu_session_component.h

@@ -16,10 +16,10 @@
 
 /* Genode includes */
 #include <util/list.h>
-#include <base/allocator_guard.h>
+#include <base/ram_allocator.h>
 #include <base/mutex.h>
 #include <base/session_label.h>
-#include <base/rpc_server.h>
+#include <base/session_object.h>
 #include <cpu_session/cpu_session.h>
 
 /* core includes */
@@ -35,16 +35,16 @@
 namespace Genode { class Cpu_session_component; }
 
 
-class Genode::Cpu_session_component : public  Rpc_object<Cpu_session>,
+class Genode::Cpu_session_component : public  Session_object<Cpu_session>,
                                       private List<Cpu_session_component>::Element
 {
 	private:
 
-		Session_label        const _label;
 		Rpc_entrypoint            &_session_ep;
 		Rpc_entrypoint            &_thread_ep;
 		Pager_entrypoint          &_pager_ep;
-		Allocator_guard            _md_alloc;               /* guarded meta-data allocator */
+		Constrained_ram_allocator  _ram_alloc;
+		Sliced_heap                _md_alloc;               /* guarded meta-data allocator */
 		Cpu_thread_allocator       _thread_alloc;           /* meta-data allocator */
 		Mutex                      _thread_alloc_lock { };  /* protect allocator access */
 		List<Cpu_thread_component> _thread_list       { };
@@ -144,12 +144,14 @@ class Genode::Cpu_session_component : public  Rpc_object<Cpu_session>,
 		/**
 		 * Constructor
 		 */
-		Cpu_session_component(Ram_allocator          &ram,
+		Cpu_session_component(Rpc_entrypoint         &session_ep,
+		                      Resources        const &resources,
+		                      Label            const &label,
+		                      Diag             const &diag,
+		                      Ram_allocator          &ram_alloc,
 		                      Region_map             &local_rm,
-		                      Rpc_entrypoint         &session_ep,
 		                      Rpc_entrypoint         &thread_ep,
 		                      Pager_entrypoint       &pager_ep,
-		                      Allocator              &md_alloc,
 		                      Trace::Source_registry &trace_sources,
 		                      const char *args, Affinity const &affinity,
 		                      size_t quota);
@@ -159,11 +161,6 @@ class Genode::Cpu_session_component : public  Rpc_object<Cpu_session>,
 		 */
 		~Cpu_session_component();
 
-		/**
-		 * Register quota donation at allocator guard
-		 */
-		void upgrade_ram_quota(size_t ram_quota) { _md_alloc.upgrade(ram_quota); }
-
 
 		/***************************
 		 ** CPU session interface **

repos/base/src/core/include/pd_session_component.h

@@ -18,7 +18,6 @@
 
 /* Genode includes */
 #include <util/reconstructible.h>
-#include <base/allocator_guard.h>
 #include <base/session_object.h>
 #include <base/registry.h>
 #include <base/heap.h>

repos/base/src/core/include/rm_root.h

@@ -28,22 +28,26 @@ class Genode::Rm_root : public Root_component<Rm_session_component>
 {
 	private:
 
+		Ram_allocator    &_ram_alloc;
+		Region_map       &_local_rm;
 		Pager_entrypoint &_pager_ep;
 
 	protected:
 
 		Rm_session_component *_create_session(const char *args) override
 		{
-			size_t ram_quota = Arg_string::find_arg(args, "ram_quota").ulong_value(0);
-
 			return new (md_alloc())
-			       Rm_session_component(*this->ep(), *md_alloc(), _pager_ep, ram_quota);
+			       Rm_session_component(*this->ep(),
+			                            session_resources_from_args(args),
+			                            session_label_from_args(args),
+			                            session_diag_from_args(args),
+			                            _ram_alloc, _local_rm, _pager_ep);
 		}
 
 		void _upgrade_session(Rm_session_component *rm, const char *args) override
 		{
-			size_t ram_quota = Arg_string::find_arg(args, "ram_quota").ulong_value(0);
+			rm->upgrade(ram_quota_from_args(args));
-			rm->upgrade_ram_quota(ram_quota);
+			rm->upgrade(cap_quota_from_args(args));
 		}
 
 	public:
@@ -52,15 +56,19 @@ class Genode::Rm_root : public Root_component<Rm_session_component>
 		 * Constructor
 		 *
 		 * \param session_ep   entry point for managing RM session objects
-		 * \param md_alloc     meta data allocator to be used by root component
+		 * \param md_alloc     meta data allocator to for session objects
+		 * \param ram_alloc    RAM allocator used for session-internal
+		 *                     allocations
 		 * \param pager_ep     pager entrypoint
 		 */
 		Rm_root(Rpc_entrypoint   &session_ep,
 		        Allocator        &md_alloc,
+		        Ram_allocator    &ram_alloc,
+		        Region_map       &local_rm,
 		        Pager_entrypoint &pager_ep)
 		:
 			Root_component<Rm_session_component>(&session_ep, &md_alloc),
-			_pager_ep(pager_ep)
+			_ram_alloc(ram_alloc), _local_rm(local_rm), _pager_ep(pager_ep)
 		{ }
 };
 

repos/base/src/core/include/rm_session_component.h

@@ -15,9 +15,9 @@
 #define _CORE__INCLUDE__RM_SESSION_COMPONENT_H_
 
 /* Genode includes */
-#include <base/allocator_guard.h>
 #include <base/rpc_server.h>
 #include <rm_session/rm_session.h>
+#include <base/session_object.h>
 
 /* core includes */
 #include <region_map_component.h>
@@ -25,13 +25,14 @@
 namespace Genode { class Rm_session_component; }
 
 
-class Genode::Rm_session_component : public Rpc_object<Rm_session>
+class Genode::Rm_session_component : public Session_object<Rm_session>
 {
 	private:
 
-		Rpc_entrypoint   &_ep;
+		Rpc_entrypoint           &_ep;
-		Allocator_guard   _md_alloc;
+		Constrained_ram_allocator _ram_alloc;
-		Pager_entrypoint &_pager_ep;
+		Sliced_heap               _md_alloc;
+		Pager_entrypoint         &_pager_ep;
 
 		Mutex                      _region_maps_lock { };
 		List<Region_map_component> _region_maps      { };
@@ -42,11 +43,18 @@ class Genode::Rm_session_component : public Rpc_object<Rm_session>
 		 * Constructor
 		 */
 		Rm_session_component(Rpc_entrypoint   &ep,
-		                     Allocator        &md_alloc,
+		                     Resources  const &resources,
-		                     Pager_entrypoint &pager_ep,
+		                     Label      const &label,
-		                     size_t            ram_quota)
+		                     Diag       const &diag,
+		                     Ram_allocator    &ram_alloc,
+		                     Region_map       &local_rm,
+		                     Pager_entrypoint &pager_ep)
 		:
-			_ep(ep), _md_alloc(&md_alloc, ram_quota), _pager_ep(pager_ep)
+			Session_object(ep, resources, label, diag),
+			_ep(ep),
+			_ram_alloc(ram_alloc, _ram_quota_guard(), _cap_quota_guard()),
+			_md_alloc(_ram_alloc, local_rm),
+			_pager_ep(pager_ep)
 		{ }
 
 		~Rm_session_component()
@@ -59,11 +67,6 @@ class Genode::Rm_session_component : public Rpc_object<Rm_session>
 			}
 		}
 
-		/**
-		 * Register quota donation at allocator guard
-		 */
-		void upgrade_ram_quota(size_t ram_quota) { _md_alloc.upgrade(ram_quota); }
-
 
 		/**************************
 		 ** Rm_session interface **

repos/base/src/core/include/signal_source_component.h

@@ -15,7 +15,6 @@
 #define _CORE__INCLUDE__SIGNAL_SOURCE_COMPONENT_H_
 
 #include <signal_source/rpc_object.h>
-#include <base/allocator_guard.h>
 #include <base/tslab.h>
 #include <base/lock.h>
 #include <base/rpc_client.h>

repos/base/src/core/include/trace/root.h

@@ -44,15 +44,19 @@ class Genode::Trace::Root : public Genode::Root_component<Session_component>
 				throw Service_denied();
 
 			return new (md_alloc())
-			       Session_component(_ram, _local_rm, *md_alloc(), ram_quota,
+			       Session_component(*this->ep(),
+			                         session_resources_from_args(args),
+			                         session_label_from_args(args),
+			                         session_diag_from_args(args),
+			                         _ram, _local_rm,
 			                         arg_buffer_size, parent_levels,
-			                         label_from_args(args).string(), _sources, _policies);
+			                         _sources, _policies);
 		}
 
 		void _upgrade_session(Session_component *s, const char *args) override
 		{
-			size_t ram_quota = Arg_string::find_arg(args, "ram_quota").ulong_value(0);
+			s->upgrade(ram_quota_from_args(args));
-			s->upgrade_ram_quota(ram_quota);
+			s->upgrade(cap_quota_from_args(args));
 		}
 
 	public:

repos/base/src/core/include/trace/session_component.h

@@ -15,9 +15,9 @@
 #define _CORE__INCLUDE__TRACE__SESSION_COMPONENT_H_
 
 /* Genode includes */
-#include <base/allocator_guard.h>
+#include <base/session_object.h>
-#include <base/rpc_server.h>
 #include <base/tslab.h>
+#include <base/heap.h>
 #include <base/attached_ram_dataspace.h>
 #include <trace_session/trace_session.h>
 
@@ -30,19 +30,18 @@ namespace Genode { namespace Trace { class Session_component; } }
 
 class Genode::Trace::Session_component
 :
-	public Genode::Rpc_object<Genode::Trace::Session,
+	public Session_object<Trace::Session,
-	                          Genode::Trace::Session_component>,
+	                      Trace::Session_component>,
-	public Genode::Trace::Policy_owner
+	public Trace::Policy_owner
 {
 	private:
 
-		Ram_allocator               &_ram;
+		Constrained_ram_allocator    _ram;
 		Region_map                  &_local_rm;
-		Allocator_guard              _md_alloc;
+		Sliced_heap                  _md_alloc { _ram, _local_rm };
 		Tslab<Trace::Subject, 4096>  _subjects_slab;
 		Tslab<Trace::Policy, 4096>   _policies_slab;
 		unsigned               const _parent_levels;
-		Session_label          const _label;
 		Source_registry             &_sources;
 		Policy_registry             &_policies;
 		Subject_registry             _subjects;
@@ -54,19 +53,19 @@ class Genode::Trace::Session_component
 		/**
 		 * Constructor
 		 */
-		Session_component(Ram_allocator &ram, Region_map &local_rm,
+		Session_component(Rpc_entrypoint  &ep,
-		                  Allocator &md_alloc, size_t ram_quota,
+		                  Resources const &resources,
-		                  size_t arg_buffer_size, unsigned parent_levels,
+		                  Label     const &label,
-		                  char const *label, Source_registry &sources,
+		                  Diag      const &diag,
+		                  Ram_allocator   &ram,
+		                  Region_map      &local_rm,
+		                  size_t           arg_buffer_size,
+		                  unsigned         parent_levels,
+		                  Source_registry &sources,
 		                  Policy_registry &policies);
 
 		~Session_component();
 
-		/**
-		 * Register quota donation at allocator guard
-		 */
-		void upgrade_ram_quota(size_t ram_quota) { _md_alloc.upgrade(ram_quota); }
-
 
 		/***********************
 		 ** Session interface **

repos/base/src/core/main.cc

@@ -252,7 +252,7 @@ int main()
 	static Pager_entrypoint pager_ep(rpc_cap_factory);
 
 	static Rom_root    rom_root    (ep, ep, platform().rom_fs(), sliced_heap);
-	static Rm_root     rm_root     (ep, sliced_heap, pager_ep);
+	static Rm_root     rm_root     (ep, sliced_heap, core_ram_alloc, local_rm, pager_ep);
 	static Cpu_root    cpu_root    (core_ram_alloc, local_rm, ep, ep, pager_ep,
 	                                sliced_heap, Trace::sources());
 	static Pd_root     pd_root     (ep, core_env().signal_ep(), pager_ep,
@@ -300,9 +300,14 @@ int main()
 
 	/* CPU session representing core */
 	static Cpu_session_component
-		core_cpu(core_ram_alloc, local_rm, ep, ep, pager_ep, sliced_heap, Trace::sources(),
+		core_cpu(ep,
-		         "label=\"core\"", Affinity(), Cpu_session::QUOTA_LIMIT);
+		         Session::Resources{{Cpu_connection::RAM_QUOTA},
-	Cpu_session_capability core_cpu_cap = ep.manage(&core_cpu);
+		                            {Cpu_session::CAP_QUOTA}},
+		         "core", Session::Diag{false},
+		         core_ram_alloc, local_rm, ep, pager_ep, Trace::sources(), "",
+		         Affinity(), Cpu_session::QUOTA_LIMIT);
+
+	Cpu_session_capability core_cpu_cap = core_cpu.cap();
 
 	log("", init_ram_quota.value / (1024*1024), " MiB RAM and ", init_cap_quota, " caps "
 	    "assigned to init");

repos/base/src/core/trace_session_component.cc

@@ -59,17 +59,22 @@ Policy_id Session_component::alloc_policy(size_t size)
 	 */
 	Policy_id const id(++_policy_cnt);
 
-	if (!_md_alloc.withdraw(size))
+	Ram_quota const amount { size };
-		throw Out_of_ram();
+
+	/*
+	 * \throw Out_of_ram
+	 */
+	withdraw(amount);
 
 	try {
-		Ram_dataspace_capability ds = _ram.alloc(size);
+		Dataspace_capability ds_cap = _ram.alloc(size);
+		_policies.insert(*this, id, _policies_slab, ds_cap, size);
 
-		_policies.insert(*this, id, _policies_slab, ds, size);
 	} catch (...) {
+
 		/* revert withdrawal or quota */
-		_md_alloc.upgrade(size);
+		replenish(amount);
-		throw Out_of_ram();
+		throw;
 	}
 
 	return id;
@@ -91,30 +96,32 @@ void Session_component::unload_policy(Policy_id id)
 void Session_component::trace(Subject_id subject_id, Policy_id policy_id,
                               size_t buffer_size)
 {
-	size_t const  policy_size = _policies.size(*this, policy_id);
+	size_t const policy_size  = _policies.size(*this, policy_id);
-	size_t const required_ram = buffer_size + policy_size;
+
+	Ram_quota const required_ram { buffer_size + policy_size };
 
 	Trace::Subject &subject = _subjects.lookup_by_id(subject_id);
+
 	/* revert quota from previous call to trace */
 	if (subject.allocated_memory()) {
-		_md_alloc.upgrade(subject.allocated_memory());
+		replenish(Ram_quota{subject.allocated_memory()});
 		subject.reset_allocated_memory();
 	}
 
 	/*
 	 * Account RAM needed for trace buffer and policy buffer to the trace
 	 * session.
+	 *
+	 * \throw Out_of_ram
 	 */
-	if (!_md_alloc.withdraw(required_ram)) {
+	withdraw(required_ram);
-		throw Out_of_ram();
-	}
 
 	try {
 		subject.trace(policy_id, _policies.dataspace(*this, policy_id),
 		              policy_size, _ram, _local_rm, buffer_size);
 	} catch (...) {
 		/* revert withdrawal or quota */
-		_md_alloc.upgrade(required_ram);
+		replenish(required_ram);
 		throw;
 	}
 }
@@ -153,29 +160,35 @@ Dataspace_capability Session_component::buffer(Subject_id subject_id)
 
 void Session_component::free(Subject_id subject_id)
 {
-	size_t const released_ram = _subjects.release(subject_id);
+	Ram_quota const released_ram { _subjects.release(subject_id) };
-	_md_alloc.upgrade(released_ram);
+
+	replenish(released_ram);
 }
 
 
-Session_component::Session_component(Ram_allocator &ram, Region_map &local_rm,
+Session_component::Session_component(Rpc_entrypoint  &ep,
-                                     Allocator &md_alloc, size_t ram_quota,
+                                     Resources const &resources,
-                                     size_t arg_buffer_size, unsigned parent_levels,
+                                     Label     const &label,
-                                     char const *label, Source_registry &sources,
+                                     Diag      const &diag,
+                                     Ram_allocator   &ram,
+                                     Region_map      &local_rm,
+                                     size_t           arg_buffer_size,
+                                     unsigned         parent_levels,
+                                     Source_registry &sources,
                                      Policy_registry &policies)
 :
-	_ram(ram), _local_rm(local_rm),
+	Session_object(ep, resources, label, diag),
-	_md_alloc(&md_alloc, ram_quota),
+	_ram(ram, _ram_quota_guard(), _cap_quota_guard()),
+	_local_rm(local_rm),
 	_subjects_slab(&_md_alloc),
 	_policies_slab(&_md_alloc),
 	_parent_levels(parent_levels),
-	_label(label),
 	_sources(sources),
 	_policies(policies),
 	_subjects(_subjects_slab, _ram, _sources),
 	_argument_buffer(_ram, local_rm, arg_buffer_size)
 {
-	_md_alloc.withdraw(_argument_buffer.size());
+	withdraw(Ram_quota{_argument_buffer.size()});
 }
 
 

repos/base/src/include/base/internal/expanding_cpu_session_client.h

@@ -44,8 +44,12 @@ struct Genode::Expanding_cpu_session_client : Upgradeable_client<Genode::Cpu_ses
 	{
 		return retry<Out_of_ram>(
 			[&] () {
-				return Cpu_session_client::create_thread(pd, name, location,
+				return retry<Out_of_caps>(
-				                                         weight, utcb); },
+					[&] () {
+						return Cpu_session_client::create_thread(pd, name, location,
+						                                         weight, utcb); },
+					[&] () { upgrade_caps(2); });
+				},
 			[&] () { upgrade_ram(8*1024); });
 	}
 };

repos/dde_rump/run/rump_ext2.run

@@ -52,7 +52,7 @@ append config {
 		<resource name="RAM" quantum="1M"/>
 		<provides><service name="Timer"/></provides>
 	</start>
-	<start name="ram_block">
+	<start name="ram_block" caps="120">
 		<resource name="RAM" quantum="20M"/>
 		<provides><service name="Block"/></provides>
 		<config file="ext2.raw" block_size="512"/>

repos/gems/recipes/raw/drivers_nic-pc/drivers.config

@@ -47,7 +47,7 @@
 		</route>
 	</start>
 
-	<start name="platform_drv" caps="200">
+	<start name="platform_drv" caps="210">
 		<resource name="RAM" quantum="3M" constrain_phys="yes"/>
 		<provides>
 			<service name="Platform"/>
@@ -70,7 +70,7 @@
 		</config>
 	</start>
 
-	<start name="nic_drv">
+	<start name="nic_drv" caps="120">
 		<binary name="ipxe_nic_drv"/>
 		<resource name="RAM" quantum="4M"/>
 		<provides> <service name="Nic"/> </provides>

repos/gems/run/fs_query.run

@@ -72,7 +72,7 @@ install_config {
 			</route>
 		</start>
 
-		<start name="fs_query">
+		<start name="fs_query" caps="120">
 			<resource name="RAM" quantum="1M"/>
 			<config>
 				<vfs> <dir name="fs"> <fs writeable="yes"/> </dir> </vfs>

repos/libports/recipes/pkg/test-sequence/runtime

@@ -37,7 +37,7 @@
 			<service name="LOG"/>
 		</parent-provides>
 		<default-route> <any-service> <parent/> </any-service> </default-route>
-		<start name="log_1" caps="64">
+		<start name="log_1" caps="100">
 			<binary name="vfs"/>
 			<resource name="RAM" quantum="4M"/>
 			<provides> <service name="File_system"/> </provides>
@@ -46,7 +46,7 @@
 				<default-policy root="/" writeable="yes"/>
 			</config>
 		</start>
-		<start name="log_2" caps="64">
+		<start name="log_2" caps="100">
 			<binary name="vfs"/>
 			<resource name="RAM" quantum="4M"/>
 			<provides> <service name="File_system"/> </provides>
@@ -55,7 +55,7 @@
 				<default-policy writeable="yes"/>
 			</config>
 		</start>
-		<start name="log_3" caps="64">
+		<start name="log_3" caps="100">
 			<binary name="vfs"/>
 			<resource name="RAM" quantum="4M"/>
 			<provides> <service name="File_system"/> </provides>

repos/libports/run/nic_bridge.run

@@ -68,7 +68,7 @@ install_config {
 		</route>
 	</start>
 
-	<start name="server_1">
+	<start name="server_1" caps="120">
 		<binary name="test-lwip_httpsrv"/>
 		<resource name="RAM" quantum="32M"/>
 		<route>
@@ -86,7 +86,7 @@ install_config {
 		</config>
 	</start>
 
-	<start name="server_2">
+	<start name="server_2" caps="120">
 		<binary name="test-lwip_httpsrv"/>
 		<resource name="RAM" quantum="32M"/>
 		<route>

repos/os/recipes/raw/drivers_interactive-muen/drivers.config

@@ -59,7 +59,7 @@
 		</route>
 	</start>
 
-	<start name="ps2_drv" caps="70">
+	<start name="ps2_drv" caps="80">
 		<resource name="RAM" quantum="1M"/>
 		<provides> <service name="Input"/> </provides>
 		<route>
@@ -72,7 +72,7 @@
 		</route>
 	</start>
 
-	<start name="usb_drv" caps="120">
+	<start name="usb_drv" caps="150">
 		<resource name="RAM" quantum="14M"/>
 		<provides> <service name="Input"/> </provides>
 		<config uhci="yes" ehci="yes" xhci="yes"> <hid/> </config>

repos/os/recipes/raw/drivers_interactive-pc/drivers.config

@@ -105,7 +105,7 @@
 		</route>
 	</start>
 
-	<start name="usb_drv" caps="120">
+	<start name="usb_drv" caps="150">
 		<resource name="RAM" quantum="14M"/>
 		<provides> <service name="Input"/> </provides>
 		<config uhci="yes" ehci="yes" xhci="yes"> <hid/> </config>

repos/os/run/nic_dump.run

@@ -59,7 +59,7 @@ append config {
 		<provides> <service name="Nic"/> </provides>
 	</start>
 
-	<start name="nic_dump" priority="-1">
+	<start name="nic_dump" priority="-1" caps="120">
 		<resource name="RAM" quantum="6M"/>
 		<provides><service name="Nic"/></provides>
 		<config uplink="bridge"

repos/os/src/app/top/main.cc

@@ -312,7 +312,7 @@ struct App::Main
 	Env &_env;
 
 	enum {
-		TRACE_RAM_QUOTA = 10 * 4096,
+		TRACE_RAM_QUOTA = 20 * 4096,
 		ARG_BUFFER_RAM  = 32 * 1024,
 		PARENT_LEVELS   = 0
 	};

repos/os/src/app/trace_logger/main.cc

@@ -160,8 +160,6 @@ class Main
 				}
 				monitors.insert(new (_heap) Monitor(_trace, _env.rm(), id));
 			}
-			catch (Out_of_ram                    ) { warning("Cannot activate tracing: Out_of_ram"             ); return; }
-			catch (Out_of_caps                   ) { warning("Cannot activate tracing: Out_of_caps"            ); return; }
 			catch (Trace::Already_traced         ) { warning("Cannot activate tracing: Already_traced"         ); return; }
 			catch (Trace::Source_is_dead         ) { warning("Cannot activate tracing: Source_is_dead"         ); return; }
 			catch (Trace::Nonexistent_policy     ) { warning("Cannot activate tracing: Nonexistent_policy"     ); return; }

repos/os/src/app/trace_subject_reporter/main.cc

@@ -160,7 +160,7 @@ struct App::Main
 {
 	Env &_env;
 
-	Trace::Connection _trace { _env, 10*4096, 32*1024, 0 };
+	Trace::Connection _trace { _env, 128*1024, 32*1024, 0 };
 
 	Reporter _reporter { _env, "trace_subjects", "trace_subjects", 64*1024 };
 

repos/os/src/drivers/gpu/intel/allocator_guard.h

@@ -11,8 +11,8 @@
  * under the terms of the GNU Affero General Public License version 3.
  */
 
-#ifndef _INCLUDE__BASE__ALLOCATOR_GUARD_H_
+#ifndef _ALLOCATOR_GUARD_H_
-#define _INCLUDE__BASE__ALLOCATOR_GUARD_H_
+#define _ALLOCATOR_GUARD_H_
 
 #include <base/allocator.h>
 #include <base/stdint.h>
@@ -112,4 +112,4 @@ class Genode::Allocator_guard : public Allocator
 			return _allocator->need_size_for_free(); }
 };
 
-#endif /* _INCLUDE__BASE__ALLOCATOR_GUARD_H_ */
+#endif /* _ALLOCATOR_GUARD_H_ */

repos/os/src/drivers/gpu/intel/main.cc

@@ -12,7 +12,6 @@
  */
 
 /* Genode includes */
-#include <base/allocator_guard.h>
 #include <base/attached_rom_dataspace.h>
 #include <base/component.h>
 #include <base/heap.h>
@@ -34,6 +33,7 @@
 #include <util/xml_node.h>
 
 /* local includes */
+#include <allocator_guard.h>
 #include <mmio.h>
 #include <ppgtt.h>
 #include <ppgtt_allocator.h>

repos/os/src/drivers/gpu/intel/ppgtt_allocator.h

@@ -14,12 +14,10 @@
 #ifndef _PPGTT_ALLOCATOR_H_
 #define _PPGTT_ALLOCATOR_H_
 
-/* Genode includes */
-#include <base/allocator_guard.h>
-
 /* local includes */
 #include <types.h>
 #include <utils.h>
+#include <allocator_guard.h>
 
 
 namespace Igd {

repos/os/src/drivers/platform/spec/x86/pci_session_component.h

@@ -14,7 +14,6 @@
 #pragma once
 
 /* base */
-#include <base/allocator_guard.h>
 #include <base/attached_rom_dataspace.h>
 #include <base/heap.h>
 #include <base/rpc_server.h>
@@ -30,7 +29,6 @@
 #include <os/reporter.h>
 #include <os/session_policy.h>
 #include <platform_session/platform_session.h>
-#include <base/allocator_guard.h>
 
 /* local */
 #include "device_pd.h"

repos/os/src/server/nic_dump/component.cc

@@ -38,15 +38,20 @@ Communication_buffer::Communication_buffer(Ram_allocator &ram,
  ****************************/
 
 Session_component_base::
-Session_component_base(Allocator     &guarded_alloc_backing,
+Session_component_base(Ram_allocator  &ram,
-                       size_t   const guarded_alloc_amount,
+                       Region_map     &local_rm,
-                       Ram_allocator &buf_ram,
+                       Ram_quota const ram_quota,
-                       size_t   const tx_buf_size,
+                       Cap_quota const cap_quota,
-                       size_t   const rx_buf_size)
+                       size_t    const tx_buf_size,
+                       size_t    const rx_buf_size)
 :
-	_guarded_alloc(&guarded_alloc_backing, guarded_alloc_amount),
+	_ram_quota_guard(ram_quota),
-	_range_alloc(&_guarded_alloc), _tx_buf(buf_ram, tx_buf_size),
+	_cap_quota_guard(cap_quota),
-	_rx_buf(buf_ram, rx_buf_size)
+	_ram(ram, _ram_quota_guard, _cap_quota_guard),
+	_alloc(_ram, local_rm),
+	_range_alloc(&_alloc),
+	_tx_buf(ram, tx_buf_size),
+	_rx_buf(ram, rx_buf_size)
 { }
 
 
@@ -54,22 +59,23 @@ Session_component_base(Allocator     &guarded_alloc_backing,
  ** Session_component **
  ***********************/
 
-Net::Session_component::Session_component(Allocator         &alloc,
+Net::Session_component::Session_component(Ram_quota    const ram_quota,
-                                          size_t const       amount,
+                                          Cap_quota    const cap_quota,
-                                          size_t const       tx_buf_size,
+                                          size_t       const tx_buf_size,
-                                          size_t const       rx_buf_size,
+                                          size_t       const rx_buf_size,
-                                          Xml_node           config,
+                                          Xml_node     const config,
                                           Timer::Connection &timer,
                                           Duration          &curr_time,
                                           Env               &env)
 :
-	Session_component_base(alloc, amount, env.ram(), tx_buf_size, rx_buf_size),
+	Session_component_base(env.ram(), env.rm(), ram_quota, cap_quota,
+	                       tx_buf_size, rx_buf_size),
 	Session_rpc_object(env.rm(), _tx_buf, _rx_buf, &_range_alloc,
 	                   env.ep().rpc_ep()),
 	Interface(env.ep(), config.attribute_value("downlink", Interface_label()),
 	          timer, curr_time, config.attribute_value("time", false),
-	          _guarded_alloc, config),
+	          Session_component_base::_alloc, config),
-	_uplink(env, config, timer, curr_time, alloc),
+	_uplink(env, config, timer, curr_time, Session_component_base::_alloc),
 	_link_state_handler(env.ep(), *this, &Session_component::_handle_link_state)
 {
 	_tx.sigh_ready_to_ack(_sink_ack);
@@ -120,8 +126,8 @@ Net::Root::Root(Env               &env,
 Session_component *Net::Root::_create_session(char const *args)
 {
 	try {
-		size_t const ram_quota =
+		Ram_quota const ram_quota = ram_quota_from_args(args);
-			Arg_string::find_arg(args, "ram_quota").ulong_value(0);
+		Cap_quota const cap_quota = cap_quota_from_args(args);
 
 		size_t const tx_buf_size =
 			Arg_string::find_arg(args, "tx_buf_size").ulong_value(0);
@@ -132,19 +138,19 @@ Session_component *Net::Root::_create_session(char const *args)
 		size_t const session_size =
 			max((size_t)4096, sizeof(Session_component));
 
-		if (ram_quota < session_size) {
+		if (ram_quota.value < session_size) {
 			throw Insufficient_ram_quota(); }
 
-		if (tx_buf_size               > ram_quota - session_size ||
+		if (tx_buf_size               > ram_quota.value - session_size ||
-		    rx_buf_size               > ram_quota - session_size ||
+		    rx_buf_size               > ram_quota.value - session_size ||
-		    tx_buf_size + rx_buf_size > ram_quota - session_size)
+		    tx_buf_size + rx_buf_size > ram_quota.value - session_size)
 		{
 			error("insufficient 'ram_quota' for session creation");
 			throw Insufficient_ram_quota();
 		}
 		return new (md_alloc())
-			Session_component(*md_alloc(), ram_quota - session_size,
+			Session_component(Ram_quota{ram_quota.value - session_size},
-			                  tx_buf_size, rx_buf_size, _config, _timer,
+			                  cap_quota, tx_buf_size, rx_buf_size, _config, _timer,
 			                  _curr_time, _env);
 	}
 	catch (...) { throw Service_denied(); }

repos/os/src/server/nic_dump/component.h

@@ -15,10 +15,10 @@
 #define _COMPONENT_H_
 
 /* Genode includes */
-#include <base/allocator_guard.h>
 #include <root/component.h>
 #include <nic/packet_allocator.h>
 #include <nic_session/rpc_object.h>
+#include <base/heap.h>
 
 /* local includes */
 #include <interface.h>
@@ -52,24 +52,28 @@ class Net::Session_component_base
 {
 	protected:
 
-		Genode::Allocator_guard _guarded_alloc;
+		Genode::Ram_quota_guard           _ram_quota_guard;
-		Nic::Packet_allocator   _range_alloc;
+		Genode::Cap_quota_guard           _cap_quota_guard;
-		Communication_buffer    _tx_buf;
+		Genode::Constrained_ram_allocator _ram;
-		Communication_buffer    _rx_buf;
+		Genode::Sliced_heap               _alloc;
+		Nic::Packet_allocator             _range_alloc;
+		Communication_buffer              _tx_buf;
+		Communication_buffer              _rx_buf;
 
 	public:
 
-		Session_component_base(Genode::Allocator     &guarded_alloc_backing,
+		Session_component_base(Genode::Ram_allocator &ram,
-		                       Genode::size_t const   guarded_alloc_amount,
+		                       Genode::Region_map    &local_rm,
-		                       Genode::Ram_allocator &buf_ram,
+		                       Genode::Ram_quota      ram_quota,
-		                       Genode::size_t const   tx_buf_size,
+		                       Genode::Cap_quota      cap_quota,
-		                       Genode::size_t const   rx_buf_size);
+		                       Genode::size_t   const tx_buf_size,
+		                       Genode::size_t   const rx_buf_size);
 };
 
 
 class Net::Session_component : private Session_component_base,
                                public  ::Nic::Session_rpc_object,
-                               public  Interface
+                               private Interface
 {
 	private:
 
@@ -90,14 +94,14 @@ class Net::Session_component : private Session_component_base,
 
 	public:
 
-		Session_component(Genode::Allocator    &alloc,
+		Session_component(Genode::Ram_quota  ram_quota,
-		                  Genode::size_t const  amount,
+		                  Genode::Cap_quota  cap_quota,
-		                  Genode::size_t const  tx_buf_size,
+		                  Genode::size_t     tx_buf_size,
-		                  Genode::size_t const  rx_buf_size,
+		                  Genode::size_t     rx_buf_size,
-		                  Genode::Xml_node      config,
+		                  Genode::Xml_node   config,
-		                  Timer::Connection    &timer,
+		                  Timer::Connection &timer,
-		                  Genode::Duration     &curr_time,
+		                  Genode::Duration  &curr_time,
-		                  Genode::Env          &env);
+		                  Genode::Env       &env);
 
 
 		/******************

repos/os/src/server/nic_router/component.h

@@ -16,7 +16,6 @@
 
 /* Genode includes */
 #include <base/heap.h>
-#include <base/allocator_guard.h>
 #include <root/component.h>
 #include <nic/packet_allocator.h>
 #include <nic_session/rpc_object.h>

repos/os/src/server/nitpicker/main.cc

@@ -15,7 +15,6 @@
 #include <base/sleep.h>
 #include <base/log.h>
 #include <base/component.h>
-#include <base/heap.h>
 #include <base/attached_rom_dataspace.h>
 #include <input/keycodes.h>
 #include <root/component.h>
@@ -87,26 +86,17 @@ class Nitpicker::Root : public Root_component<Session_component>,
 
 		Session_component *_create_session(const char *args) override
 		{
-			size_t const ram_quota = Arg_string::find_arg(args, "ram_quota").ulong_value(0);
-
-			size_t const required_quota = Input::Session_component::ev_ds_size()
-			                            + align_addr(sizeof(Session::Command_buffer), 12);
-
-			if (ram_quota < required_quota) {
-				warning("Insufficient dontated ram_quota (", ram_quota,
-				        " bytes), require ", required_quota, " bytes");
-				throw Insufficient_ram_quota();
-			}
-
-			size_t const unused_quota = ram_quota - required_quota;
-
 			Session_label const label = label_from_args(args);
+
 			bool const provides_default_bg = (label == "backdrop");
 
 			Session_component *session = new (md_alloc())
-				Session_component(_env, label, _view_stack, _font, _focus_updater,
+				Session_component(_env,
+				                  session_resources_from_args(args), label,
+				                  session_diag_from_args(args),
+				                  _view_stack, _font, _focus_updater,
 				                  _pointer_origin, _builtin_background, _framebuffer,
-				                  provides_default_bg, *md_alloc(), unused_quota,
+				                  provides_default_bg,
 				                  _focus_reporter, *this);
 
 			session->apply_session_policy(_config.xml(), _domain_registry);
@@ -119,8 +109,8 @@ class Nitpicker::Root : public Root_component<Session_component>,
 
 		void _upgrade_session(Session_component *s, const char *args) override
 		{
-			size_t ram_quota = Arg_string::find_arg(args, "ram_quota").ulong_value(0);
+			s->upgrade(ram_quota_from_args(args));
-			s->upgrade_ram_quota(ram_quota);
+			s->upgrade(cap_quota_from_args(args));
 		}
 
 		void _destroy_session(Session_component *session) override

repos/os/src/server/nitpicker/session_component.cc

@@ -31,7 +31,7 @@ void Session_component::_release_buffer()
 
 	destroy(&_session_alloc, const_cast<Chunky_texture<PT> *>(cdt));
 
-	_session_alloc.upgrade(_buffer_size);
+	replenish(Ram_quota{_buffer_size});
 	_buffer_size = 0;
 }
 
@@ -427,9 +427,13 @@ Framebuffer::Mode Session_component::mode()
 void Session_component::buffer(Framebuffer::Mode mode, bool use_alpha)
 {
 	/* check if the session quota suffices for the specified mode */
-	if (_session_alloc.quota() < ram_quota(mode, use_alpha))
+	if (_buffer_size + _ram_quota_guard().avail().value < ram_quota(mode, use_alpha))
 		throw Out_of_ram();
 
+	/* buffer re-allocation may consume new dataspace capability if buffer is new */
+	if (_cap_quota_guard().avail().value < 1)
+		throw Out_of_caps();
+
 	_framebuffer_session_component.notify_mode_change(mode, use_alpha);
 }
 
@@ -477,7 +481,7 @@ Buffer *Session_component::realloc_buffer(Framebuffer::Mode mode, bool use_alpha
 
 	/*
 	 * Preserve the content of the original buffer if nitpicker has
-	 * enough lack memory to temporarily keep the original pixels.
+	 * enough slack memory to temporarily keep the original pixels.
 	 */
 	Texture<PT> const *src_texture = nullptr;
 	if (texture()) {
@@ -491,8 +495,22 @@ Buffer *Session_component::realloc_buffer(Framebuffer::Mode mode, bool use_alpha
 		}
 	}
 
-	Chunky_texture<PT> * const texture = new (&_session_alloc)
+	Ram_quota const temporary_ram_upgrade = src_texture
-		Chunky_texture<PT>(_env.ram(), _env.rm(), size, use_alpha);
+	                                      ? Ram_quota{_buffer_size} : Ram_quota{0};
+
+	_ram_quota_guard().upgrade(temporary_ram_upgrade);
+
+	auto try_alloc_texture = [&] ()
+	{
+		try {
+			return new (&_session_alloc)
+				Chunky_texture<PT>(_env.ram(), _env.rm(), size, use_alpha);
+		} catch (...) {
+			return (Chunky_texture<PT>*)nullptr;
+		}
+	};
+
+	Chunky_texture<PT> * const texture = try_alloc_texture();
 
 	/* copy old buffer content into new buffer and release old buffer */
 	if (src_texture) {
@@ -503,9 +521,14 @@ Buffer *Session_component::realloc_buffer(Framebuffer::Mode mode, bool use_alpha
 		Texture_painter::paint(surface, *src_texture, Color(), Point(0, 0),
 		                       Texture_painter::SOLID, false);
 		_release_buffer();
+
+		if (!_ram_quota_guard().try_downgrade(temporary_ram_upgrade))
+			warning("accounting error during framebuffer realloc");
+
 	}
 
-	if (!_session_alloc.withdraw(_buffer_size)) {
+	try { withdraw(Ram_quota{_buffer_size}); }
+	catch (...) {
 		destroy(&_session_alloc, texture);
 		_buffer_size = 0;
 		return nullptr;

repos/os/src/server/nitpicker/session_component.h

@@ -16,12 +16,12 @@
 
 /* Genode includes */
 #include <util/list.h>
-#include <base/rpc_server.h>
+#include <base/session_object.h>
+#include <base/heap.h>
 #include <os/session_policy.h>
 #include <os/reporter.h>
 #include <os/pixel_rgb565.h>
 #include <nitpicker_session/nitpicker_session.h>
-#include <base/allocator_guard.h>
 
 /* local includes */
 #include "canvas.h"
@@ -52,7 +52,7 @@ struct Nitpicker::Visibility_controller : Interface
 };
 
 
-class Nitpicker::Session_component : public  Rpc_object<Session>,
+class Nitpicker::Session_component : public  Session_object<Nitpicker::Session>,
                                      public  View_owner,
                                      public  Buffer_provider,
                                      private Session_list::Element
@@ -61,6 +61,8 @@ class Nitpicker::Session_component : public  Rpc_object<Session>,
 
 		friend class List<Session_component>;
 
+		using Nitpicker::Session::Label;
+
 		/*
 		 * Noncopyable
 		 */
@@ -69,7 +71,7 @@ class Nitpicker::Session_component : public  Rpc_object<Session>,
 
 		Env &_env;
 
-		Session_label const _label;
+		Constrained_ram_allocator _ram;
 
 		Domain_registry::Entry const *_domain     = nullptr;
 		Texture_base           const *_texture    = nullptr;
@@ -89,12 +91,15 @@ class Nitpicker::Session_component : public  Rpc_object<Session>,
 		bool _uses_alpha = false;
 		bool _visible    = true;
 
-		Allocator_guard _session_alloc;
+		Sliced_heap _session_alloc;
 
 		Framebuffer::Session &_framebuffer;
 
 		Framebuffer::Session_component _framebuffer_session_component;
 
+		bool const _input_session_accounted = (
+			withdraw(Ram_quota{Input::Session_component::ev_ds_size()}), true );
+
 		Input::Session_component _input_session_component { _env };
 
 		View_stack &_view_stack;
@@ -125,6 +130,9 @@ class Nitpicker::Session_component : public  Rpc_object<Session>,
 		Attached_ram_dataspace _command_ds { _env.ram(), _env.rm(),
 		                                     sizeof(Command_buffer) };
 
+		bool const _command_buffer_accounted = (
+			withdraw(Ram_quota{align_addr(sizeof(Session::Command_buffer), 12)}), true );
+
 		Command_buffer &_command_buffer = *_command_ds.local_addr<Command_buffer>();
 
 		typedef Handle_registry<View_handle, View_component> View_handle_registry;
@@ -166,7 +174,9 @@ class Nitpicker::Session_component : public  Rpc_object<Session>,
 	public:
 
 		Session_component(Env                   &env,
-		                  Session_label   const &label,
+		                  Resources       const &resources,
+		                  Label           const &label,
+		                  Diag            const &diag,
 		                  View_stack            &view_stack,
 		                  Font            const &font,
 		                  Focus_updater         &focus_updater,
@@ -174,14 +184,13 @@ class Nitpicker::Session_component : public  Rpc_object<Session>,
 		                  View_component        &builtin_background,
 		                  Framebuffer::Session  &framebuffer,
 		                  bool                   provides_default_bg,
-		                  Allocator             &session_alloc,
-		                  size_t                 ram_quota,
 		                  Reporter              &focus_reporter,
 		                  Visibility_controller &visibility_controller)
 		:
+			Session_object(env.ep(), resources, label, diag),
 			_env(env),
-			_label(label),
+			_ram(env.ram(), _ram_quota_guard(), _cap_quota_guard()),
-			_session_alloc(&session_alloc, ram_quota),
+			_session_alloc(_ram, env.rm()),
 			_framebuffer(framebuffer),
 			_framebuffer_session_component(view_stack, *this, framebuffer, *this),
 			_view_stack(view_stack), _font(font), _focus_updater(focus_updater),
@@ -193,9 +202,7 @@ class Nitpicker::Session_component : public  Rpc_object<Session>,
 			_view_handle_registry(_session_alloc),
 			_focus_reporter(focus_reporter),
 			_visibility_controller(visibility_controller)
-		{
+		{ }
-			_session_alloc.upgrade(ram_quota);
-		}
 
 		~Session_component()
 		{
@@ -338,8 +345,6 @@ class Nitpicker::Session_component : public  Rpc_object<Session>,
 				Signal_transmitter(_mode_sigh).submit();
 		}
 
-		void upgrade_ram_quota(size_t ram_quota) { _session_alloc.upgrade(ram_quota); }
-
 		/**
 		 * Deliver sync signal to the client's virtual frame buffer
 		 */

repos/os/src/server/vfs/main.cc

@@ -22,12 +22,9 @@
 #include <file_system_session/rpc_object.h>
 #include <root/component.h>
 #include <os/session_policy.h>
-#include <base/allocator_guard.h>
-#include <util/fifo.h>
 #include <vfs/simple_env.h>
 
 /* local includes */
-#include "assert.h"
 #include "node.h"
 
 

repos/os/src/test/slab/main.cc

@@ -15,7 +15,6 @@
 #include <base/heap.h>
 #include <base/slab.h>
 #include <base/log.h>
-#include <base/allocator_guard.h>
 #include <timer_session/connection.h>
 
 
@@ -79,7 +78,36 @@ void Component::construct(Genode::Env & env)
 	static Timer::Connection timer(env);
 
 	enum { SLAB_SIZE = 16, BLOCK_SIZE = 256 };
-	static Genode::Allocator_guard alloc(&heap, ~0UL);
+
+	struct Tracked_alloc : Genode::Allocator
+	{
+		size_t _consumed = 0;
+
+		Allocator &_alloc;
+
+		bool alloc(size_t size, void **out_addr) override
+		{
+			if (_alloc.alloc(size, out_addr)) {
+				_consumed += size;
+				return true;
+			}
+			return false;
+		}
+
+		void free(void *addr, size_t size) override
+		{
+			_alloc.free(addr, size);
+			_consumed -= size;
+		}
+
+		size_t overhead(size_t)      const override { return 0; }
+		size_t consumed()            const override { return _consumed; }
+		bool   need_size_for_free()  const override { return true; }
+
+		Tracked_alloc(Allocator &alloc) : _alloc(alloc) { }
+	};
+
+	Tracked_alloc alloc { heap };
 
 	{
 		Genode::Slab slab(SLAB_SIZE, BLOCK_SIZE, nullptr, &alloc);

repos/ports/include/vmm/vcpu_dispatcher.h

@@ -70,7 +70,7 @@ class Vmm::Vcpu_dispatcher : public T
 		unsigned int exit_reason = 0;
 
 		Vcpu_dispatcher(Genode::Env &env, Genode::size_t stack_size,
-		                Cpu_session * cpu_session,
+		                Cpu_connection *,
 		                Genode::Affinity::Location location,
 		                const char * name = "vCPU dispatcher")
 		:

repos/ports/include/vmm/vcpu_thread.h

@@ -51,7 +51,7 @@ class Vmm::Vcpu_other_pd : public Vmm::Vcpu_thread
 
 		Genode::Capability<Genode::Pd_session> _pd_cap;
 		Genode::Affinity::Location  _location;
-		Genode::Cpu_session        *_cpu_session;
+		Genode::Cpu_connection     *_cpu_connection;
 
 		Genode::addr_t _exc_pt_sel;
 
@@ -63,12 +63,12 @@ class Vmm::Vcpu_other_pd : public Vmm::Vcpu_thread
 
 	public:
 
-		Vcpu_other_pd(Cpu_session * cpu_session,
+		Vcpu_other_pd(Cpu_connection * cpu_connection,
 		              Genode::Affinity::Location location,
 		              Genode::Capability<Genode::Pd_session> pd_cap,
 		              Genode::size_t = 0 /* stack_size */)
 		:
-			_pd_cap(pd_cap), _location(location), _cpu_session(cpu_session),
+			_pd_cap(pd_cap), _location(location), _cpu_connection(cpu_connection),
 			_exc_pt_sel(Genode::cap_map().insert(Nova::NUM_INITIAL_VCPU_PT_LOG2))
 		{ }
 
@@ -77,13 +77,17 @@ class Vmm::Vcpu_other_pd : public Vmm::Vcpu_thread
 			using namespace Genode;
 
 			Thread_capability vcpu_vm =
-				_cpu_session->create_thread(_pd_cap, "vCPU",
+				_cpu_connection->retry_with_upgrade(Ram_quota{8*1024}, Cap_quota{2},
-				                            _location, Cpu_session::Weight());
+				                                    [&] ()
+				{
+					return _cpu_connection->create_thread(_pd_cap, "vCPU", _location,
+					                                      Cpu_session::Weight());
+				});
 
 			/* tell parent that this will be a vCPU */
 			Nova_native_cpu::Thread_type thread_type { Nova_native_cpu::Thread_type::VCPU };
 			Nova_native_cpu::Exception_base exception_base { _exc_pt_sel };
-			Nova_native_cpu_client native_cpu(_cpu_session->native_cpu());
+			Nova_native_cpu_client native_cpu(_cpu_connection->native_cpu());
 			native_cpu.thread_type(vcpu_vm, thread_type, exception_base);
 
 			Cpu_thread_client cpu_thread(vcpu_vm);
@@ -123,12 +127,12 @@ class Vmm::Vcpu_same_pd : public Vmm::Vcpu_thread, Genode::Thread
 
 	public:
 
-		Vcpu_same_pd(Cpu_session * cpu_session,
+		Vcpu_same_pd(Cpu_connection * cpu_connection,
 		             Genode::Affinity::Location location,
 		             Genode::Capability<Genode::Pd_session>,
 		             Genode::size_t stack_size)
 		:
-			Thread(WEIGHT, "vCPU", stack_size, Type::NORMAL, cpu_session, location)
+			Thread(WEIGHT, "vCPU", stack_size, Type::NORMAL, cpu_connection, location)
 		{
 			/* release pre-allocated selectors of Thread */
 			Genode::cap_map().remove(native_thread().exc_pt_sel, Nova::NUM_INITIAL_PT_LOG2);

repos/ports/run/netperf.inc

@@ -196,7 +196,7 @@ append  config { </wifi_config>
 } elseif { $use_usb_driver } {
 	append_platform_drv_config
 	append config {
-	<start name="nic_drv" caps="120">
+	<start name="nic_drv" caps="150">
 		<binary name="usb_drv"/>
 		<resource name="RAM" quantum="18M"/>
 		<provides><service name="Nic"/></provides>
@@ -219,7 +219,7 @@ append  config { </wifi_config>
 }
 
 append_if $use_nic_router config {
-	<start name="nic_router">
+	<start name="nic_router" caps="120">
 		<resource name="RAM" quantum="5M"/>
 		<provides><service name="Nic"/></provides>
 		<config verbose_domain_state="yes">

repos/ports/src/virtualbox5/generic/sup_vmm.cc

@@ -759,7 +759,7 @@ extern "C" int sched_yield(void)
 
 bool create_emt_vcpu(pthread_t * thread, ::size_t stack_size,
                      void *(*start_routine)(void *), void *arg,
-                     Genode::Cpu_session * cpu_session,
+                     Genode::Cpu_connection * cpu_connection,
                      Genode::Affinity::Location location,
                      unsigned int cpu_id, const char * name, long prio)
 {
@@ -791,7 +791,7 @@ bool create_emt_vcpu(pthread_t * thread, ::size_t stack_size,
 	vcpu_handler_list().insert(vcpu_handler);
 
 	Libc::pthread_create(thread, start_routine, arg,
-	                     stack_size, name, cpu_session, location);
+	                     stack_size, name, cpu_connection, location);
 
 	return true;
 }

repos/ports/src/virtualbox5/spec/nova/sup.cc

@@ -779,7 +779,7 @@ void *operator new (__SIZE_TYPE__ size, int log2_align)
 
 bool create_emt_vcpu(pthread_t * pthread, ::size_t stack,
                      void *(*start_routine)(void *), void *arg,
-                     Genode::Cpu_session * cpu_session,
+                     Genode::Cpu_connection * cpu_connection,
                      Genode::Affinity::Location location,
                      unsigned int cpu_id, const char * name, long)
 {
@@ -797,13 +797,13 @@ bool create_emt_vcpu(pthread_t * pthread, ::size_t stack,
 	if (vmx)
 		vcpu_handler = new (0x10) Vcpu_handler_vmx(genode_env(),
 		                                           stack, start_routine,
-		                                           arg, cpu_session, location,
+		                                           arg, cpu_connection, location,
 		                                           cpu_id, name, pd_vcpus.rpc_cap());
 
 	if (svm)
 		vcpu_handler = new (0x10) Vcpu_handler_svm(genode_env(),
 		                                           stack, start_routine,
-		                                           arg, cpu_session, location,
+		                                           arg, cpu_connection, location,
 		                                           cpu_id, name, pd_vcpus.rpc_cap());
 
 	Assert(!(reinterpret_cast<unsigned long>(vcpu_handler) & 0xf));

repos/ports/src/virtualbox5/spec/nova/vcpu.h

@@ -820,17 +820,17 @@ class Vcpu_handler : public Vmm::Vcpu_dispatcher<Genode::Thread>,
 
 		Vcpu_handler(Genode::Env &env, size_t stack_size,
 		             pthread::start_routine_t start_routine, void *arg,
-		             Genode::Cpu_session * cpu_session,
+		             Genode::Cpu_connection * cpu_connection,
 		             Genode::Affinity::Location location,
 		             unsigned int cpu_id, const char * name,
 		             Genode::Pd_session_capability pd_vcpu)
 		:
-			Vmm::Vcpu_dispatcher<Genode::Thread>(env, stack_size, cpu_session,
+			Vmm::Vcpu_dispatcher<Genode::Thread>(env, stack_size, cpu_connection,
 			                                     location, name),
 			_pthread(*this),
 			_start_routine(start_routine),
 			_start_routine_arg(arg),
-			_vcpu(cpu_session, location, pd_vcpu),
+			_vcpu(cpu_connection, location, pd_vcpu),
 			_ec_sel(Genode::cap_map().insert()),
 			_cpu_id(cpu_id)
 		{ }

repos/ports/src/virtualbox5/spec/nova/vcpu_svm.h

@@ -91,12 +91,12 @@ class Vcpu_handler_svm : public Vcpu_handler
 
 		Vcpu_handler_svm(Genode::Env &env, size_t stack_size,
 		                 void *(*start_routine) (void *), void *arg,
-		                 Genode::Cpu_session * cpu_session,
+		                 Genode::Cpu_connection * cpu_connection,
 		                 Genode::Affinity::Location location,
 		                 unsigned int cpu_id, const char * name,
 		                 Genode::Pd_session_capability pd_vcpu)
 		:
-			Vcpu_handler(env, stack_size, start_routine, arg, cpu_session,
+			Vcpu_handler(env, stack_size, start_routine, arg, cpu_connection,
 			             location, cpu_id, name, pd_vcpu)
 		{
 			using namespace Nova;

repos/ports/src/virtualbox5/spec/nova/vcpu_vmx.h

@@ -177,12 +177,12 @@ class Vcpu_handler_vmx : public Vcpu_handler
 
 		Vcpu_handler_vmx(Genode::Env &env, size_t stack_size,
 		                 void *(*start_routine) (void *), void *arg,
-		                 Genode::Cpu_session * cpu_session,
+		                 Genode::Cpu_connection * cpu_connection,
 		                 Genode::Affinity::Location location,
 		                 unsigned int cpu_id, const char * name,
 		                 Genode::Pd_session_capability pd_vcpu)
 		:
-			 Vcpu_handler(env, stack_size, start_routine, arg, cpu_session,
+			 Vcpu_handler(env, stack_size, start_routine, arg, cpu_connection,
 			              location, cpu_id, name, pd_vcpu)
 		{
 			using namespace Nova;

repos/ports/src/virtualbox5/sup.h

@@ -16,6 +16,7 @@
 
 /* Genode includes */
 #include <base/component.h>
+#include <cpu_session/connection.h>
 
 /* VirtualBox includes */
 #include <VBox/vmm/vm.h>
@@ -34,7 +35,7 @@ HRESULT genode_check_memory_config(ComObjPtr<Machine> machine, size_t);
  */
 bool create_emt_vcpu(pthread_t * pthread, size_t stack,
                      void *(*start_routine)(void *), void *arg,
-                     Genode::Cpu_session * cpu_session,
+                     Genode::Cpu_connection *,
                      Genode::Affinity::Location location,
                      unsigned int cpu_id,
                      const char * name, long prio);
@@ -43,7 +44,7 @@ bool create_emt_vcpu(pthread_t * pthread, size_t stack,
 uint64_t genode_cpu_hz();
 void genode_update_tsc(void (*update_func)(void), Genode::uint64_t update_us);
 
-Genode::Cpu_session * get_vcpu_cpu_session();
+Genode::Cpu_connection * get_vcpu_cpu_connection();
 
 void genode_VMMR0_DO_GVMM_CREATE_VM(PSUPVMMR0REQHDR pReqHdr);
 void genode_VMMR0_DO_GVMM_REGISTER_VMCPU(PVMR0 pVMR0, VMCPUID idCpu);

repos/ports/src/virtualbox5/thread.cc

@@ -104,12 +104,12 @@ static int create_thread(pthread_t *thread, const pthread_attr_t *attr,
 		unsigned int cpu_id = 0;
 		sscanf(rtthread->szName, "EMT-%u", &cpu_id);
 
-		Genode::Cpu_session * cpu_session = cpu_connection(RTTHREADTYPE_EMULATION);
+		Genode::Cpu_connection * cpu = cpu_connection(RTTHREADTYPE_EMULATION);
-		Genode::Affinity::Space space = cpu_session->affinity_space();
+		Genode::Affinity::Space space = cpu->affinity_space();
 		Genode::Affinity::Location location(space.location_of_index(cpu_id));
 
 		if (create_emt_vcpu(thread, stack_size, start_routine, arg,
-		                    cpu_session, location, cpu_id, rtthread->szName,
+		                    cpu, location, cpu_id, rtthread->szName,
 		                    prio_class(rtthread->enmType)))
 			return 0;
 		/*
@@ -124,10 +124,24 @@ static int create_thread(pthread_t *thread, const pthread_attr_t *attr,
 	 * and 'rtTimerLRThread' (timerlr-generic.cpp)
 	 */
 	bool const rtthread_timer = rtthread->enmType == RTTHREADTYPE_TIMER;
-	return Libc::pthread_create(thread, start_routine, arg,
+
-	                            stack_size, rtthread->szName,
+	if (rtthread_timer) {
-	                            rtthread_timer ? nullptr : cpu_connection(rtthread->enmType),
+		return Libc::pthread_create(thread, start_routine, arg,
-	                            Genode::Affinity::Location());
+		                            stack_size, rtthread->szName, nullptr,
+		                            Genode::Affinity::Location());
+
+	} else {
+		using namespace Genode;
+		Cpu_connection *cpu = cpu_connection(rtthread->enmType);
+		return cpu->retry_with_upgrade(Ram_quota{8*1024}, Cap_quota{2},
+		                               [&] ()
+		{
+			return Libc::pthread_create(thread, start_routine, arg,
+			                            stack_size, rtthread->szName, cpu,
+			                            Genode::Affinity::Location());
+		});
+	}
+
 }
 
 extern "C" int pthread_create(pthread_t *thread, const pthread_attr_t *attr,
@@ -139,7 +153,8 @@ extern "C" int pthread_create(pthread_t *thread, const pthread_attr_t *attr,
 	for (unsigned i = 0; i < 2; i++) {
 		using namespace Genode;
 
-		try { return create_thread(thread, attr, start_routine, arg); }
+		try {
+			return create_thread(thread, attr, start_routine, arg); }
 		catch (Out_of_ram) {
 			log("Upgrading memory for creation of "
 			    "thread '", Cstring(rtthread->szName), "'");