base: decouple 'Pd_session' from 'Ram_allocator'

With this patch, the 'Pd_session' interface no longer implements the
'Ram_allocator' interface, which allows us to change the
'Genode::Ram_allocator' semantics (as a subsequent step) without
affecting core's PD service.

The patch also replaces the client-local implementation of
'Pd_session_client::dataspace_size' by the proper RPC call 'ram_size' to
core, which mitigates the potential risk of de-referencing a dataspace
cap of an untrusted origin. E.g., in scenarios where the monitor
component requests the size of a dataspace allocated by the debugging
target.

Since 'ram_size' is an RPC call, it cannot be const. Hence, the
'Ram_alloctor::dataspace_size' has become non-const.

The new 'Pd_ram_allocator' implements the 'Ram_allocator' interface by
using a PD session.

Issue #5502

repos/base-linux/src/core/stack_area.cc

@@ -81,7 +81,7 @@ struct Stack_area_ram_allocator : Genode::Ram_allocator
 
 	void free(Genode::Ram_dataspace_capability) override { }
 
-	Genode::size_t dataspace_size(Genode::Ram_dataspace_capability) const override { return 0; }
+	Genode::size_t dataspace_size(Genode::Ram_dataspace_capability) override { return 0; }
 };
 
 

repos/base-linux/src/include/base/internal/platform.h

@@ -52,9 +52,11 @@ struct Genode::Platform
 
 	Local_pd_session pd { parent, pd_cap };
 
+	Pd_ram_allocator ram { pd };
+
 	Expanding_cpu_session_client cpu { parent, cpu_cap, Parent::Env::cpu() };
 
-	Heap heap { pd, rm };
+	Heap heap { ram, rm };
 
 	Platform() { _attach_stack_area(); }
 

repos/base-linux/src/lib/base/attach_stack_area.cc

@@ -33,5 +33,5 @@ void Platform::_attach_stack_area()
 	});
 
 	env_stack_area_region_map    = &pd._stack_area;
-	env_stack_area_ram_allocator = &pd;
+	env_stack_area_ram_allocator = &ram;
 }

repos/base-linux/src/lib/base/platform.cc

@@ -156,7 +156,7 @@ Platform &Genode::init_platform()
 	init_thread(platform.cpu, platform.rm);
 	init_thread_start(platform.pd.rpc_cap());
 	init_thread_bootstrap(platform.cpu, platform.parent.main_thread_cap());
-	init_exception_handling(platform.pd, platform.rm);
+	init_exception_handling(platform.ram, platform.rm);
 	init_signal_receiver(platform.pd, platform.parent);
 
 	return platform;

repos/base-linux/src/test/region_map_mmap/main.cc

@@ -31,8 +31,11 @@ static void test_linux_rmmap_bug(Env &env)
 
 	log("line: ", __LINE__);
 	for (unsigned i = 0; i < ROUNDS; ++i) {
-		Ram_dataspace_capability ds(pd.alloc(CHUNK));
+		Pd_session::Alloc_ram_result const result = pd.alloc_ram(CHUNK);
+		if (result.ok())
 			log(i + 1, " of ", (unsigned)ROUNDS, " pages allocated");
+		else
+			error("allocation ", i + 1, " of ", (unsigned)ROUNDS, " failed");
 	}
 
 	log("Done.");

repos/base-sel4/src/core/stack_area.cc

@@ -119,7 +119,7 @@ struct Stack_area_ram_allocator : Ram_allocator
 	void free(Ram_dataspace_capability) override {
 		warning(__func__, " not implemented"); }
 
-	size_t dataspace_size(Ram_dataspace_capability) const override { return 0; }
+	size_t dataspace_size(Ram_dataspace_capability) override { return 0; }
 };
 
 

repos/base/include/base/child.h

@@ -20,6 +20,7 @@
 #include <base/mutex.h>
 #include <base/local_connection.h>
 #include <base/quota_guard.h>
+#include <base/ram_allocator.h>
 #include <util/arg_string.h>
 #include <region_map/client.h>
 #include <pd_session/connection.h>
@@ -389,7 +390,7 @@ class Genode::Child : protected Rpc_object<Parent>,
 		enum class Start_result { UNKNOWN, OK, OUT_OF_RAM, OUT_OF_CAPS, INVALID };
 
 		static Start_result _start_process(Dataspace_capability   ldso_ds,
-		                                   Pd_session            &pd,
+		                                   Pd_session            &,
 		                                   Initial_thread_base   &,
 		                                   Initial_thread::Start &,
 		                                   Region_map            &local_rm,
@@ -760,8 +761,6 @@ class Genode::Child : protected Rpc_object<Parent>,
 
 		Parent_capability parent_cap() const { return cap(); }
 
-		Ram_allocator       &ram()       { return _pd.session(); }
-		Ram_allocator const &ram() const { return _pd.session(); }
 		Cpu_session      &cpu()      { return _cpu.session(); }
 		Pd_session       &pd()       { return _pd.session(); }
 		Pd_session const &pd() const { return _pd.session(); }

repos/base/include/base/env.h

@@ -44,9 +44,9 @@ struct Genode::Env : Interface
 	virtual Pd_session &pd() = 0;
 
 	/**
-	 * Memory allocator
+	 * RAM backing-store allocator
 	 */
-	Ram_allocator &ram() { return pd(); }
+	virtual Ram_allocator &ram() = 0;
 
 	/**
 	 * Entrypoint for handling RPC requests and signals

repos/base/include/base/ram_allocator.h

@@ -91,7 +91,7 @@ struct Genode::Ram_allocator : Interface, Noncopyable
 	/**
 	 * Return size of dataspace in bytes
 	 */
-	virtual size_t dataspace_size(Ram_dataspace_capability) const = 0;
+	virtual size_t dataspace_size(Ram_dataspace_capability) = 0;
 };
 
 
@@ -165,7 +165,7 @@ class Genode::Accounted_ram_allocator : public Ram_allocator
 			_cap_guard.replenish(Cap_quota{1});
 		}
 
-		size_t dataspace_size(Ram_dataspace_capability ds) const override
+		size_t dataspace_size(Ram_dataspace_capability ds) override
 		{
 			return _ram_alloc.dataspace_size(ds);
 		}

repos/base/include/pd_session/client.h

@@ -75,16 +75,16 @@ struct Genode::Pd_session_client : Rpc_client<Pd_session>
 	Cap_quota cap_quota() const override { return call<Rpc_cap_quota>(); }
 	Cap_quota used_caps() const override { return call<Rpc_used_caps>(); }
 
-	Alloc_result try_alloc(size_t size, Cache cache = CACHED) override
+	Alloc_ram_result alloc_ram(size_t size, Cache cache = CACHED) override
 	{
-		return call<Rpc_try_alloc>(size, cache);
+		return call<Rpc_alloc_ram>(size, cache);
 	}
 
-	void free(Ram_dataspace_capability ds) override { call<Rpc_free>(ds); }
+	void free_ram(Ram_dataspace_capability ds) override { call<Rpc_free_ram>(ds); }
 
-	size_t dataspace_size(Ram_dataspace_capability ds) const override
+	size_t ram_size(Ram_dataspace_capability cap) override
 	{
-		return ds.valid() ? Dataspace_client(ds).size() : 0;
+		return call<Rpc_ram_size>(cap);
 	}
 
 	Transfer_result transfer_quota(Capability<Pd_account> pd, Ram_quota amount) override

repos/base/include/pd_session/pd_session.h

@@ -25,6 +25,7 @@
 namespace Genode {
 	struct Pd_account;
 	struct Pd_session;
+	struct Pd_ram_allocator;
 	struct Pd_session_client;
 	struct Parent;
 	struct Signal_context;
@@ -51,7 +52,7 @@ struct Genode::Pd_account : Interface, Noncopyable
 };
 
 
-struct Genode::Pd_session : Session, Pd_account, Ram_allocator
+struct Genode::Pd_session : Session, Pd_account
 {
 	/*
 	 * A PD session consumes a dataspace capability for the session-object
@@ -99,6 +100,38 @@ struct Genode::Pd_session : Session, Pd_account, Ram_allocator
 	virtual Map_result map(Virt_range) = 0;
 
 
+	/******************************
+	 ** RAM dataspace allocation **
+	 ******************************/
+
+	enum class Alloc_ram_error { OUT_OF_RAM, OUT_OF_CAPS, DENIED };
+
+	using Alloc_ram_result = Attempt<Ram_dataspace_capability, Alloc_ram_error>;
+
+	/**
+	 * Allocate RAM dataspace
+	 *
+	 * \param  size   size of RAM dataspace
+	 * \param  cache  selects cacheability attributes of the memory,
+	 *                uncached memory, i.e., for DMA buffers
+	 *
+	 * \return capability to RAM dataspace, or error code of type 'Alloc_error'
+	 */
+	virtual Alloc_ram_result alloc_ram(size_t size, Cache cache = CACHED) = 0;
+
+	/**
+	 * Free RAM dataspace
+	 *
+	 * \param ds  dataspace capability as returned by alloc_ram
+	 */
+	virtual void free_ram(Ram_dataspace_capability ds) = 0;
+
+	/**
+	 * Return size of dataspace in bytes
+	 */
+	virtual size_t ram_size(Ram_dataspace_capability) = 0;
+
+
 	/********************************
 	 ** Support for the signal API **
 	 ********************************/
@@ -355,8 +388,9 @@ struct Genode::Pd_session : Session, Pd_account, Ram_allocator
 	GENODE_RPC(Rpc_ref_account, Ref_account_result, ref_account, Capability<Pd_account>);
 	GENODE_RPC(Rpc_cap_quota, Cap_quota, cap_quota);
 	GENODE_RPC(Rpc_used_caps, Cap_quota, used_caps);
-	GENODE_RPC(Rpc_try_alloc, Alloc_result, try_alloc, size_t, Cache);
+	GENODE_RPC(Rpc_alloc_ram, Alloc_ram_result, alloc_ram, size_t, Cache);
-	GENODE_RPC(Rpc_free, void, free, Ram_dataspace_capability);
+	GENODE_RPC(Rpc_free_ram, void, free_ram, Ram_dataspace_capability);
+	GENODE_RPC(Rpc_ram_size, size_t, ram_size, Ram_dataspace_capability);
 	GENODE_RPC(Rpc_ram_quota, Ram_quota, ram_quota);
 	GENODE_RPC(Rpc_used_ram, Ram_quota, used_ram);
 	GENODE_RPC(Rpc_native_pd, Capability<Native_pd>, native_pd);
@@ -372,10 +406,44 @@ struct Genode::Pd_session : Session, Pd_account, Ram_allocator
 		Rpc_alloc_context, Rpc_free_context, Rpc_submit,
 		Rpc_alloc_rpc_cap, Rpc_free_rpc_cap, Rpc_address_space,
 		Rpc_stack_area, Rpc_linker_area, Rpc_ref_account,
-		Rpc_cap_quota, Rpc_used_caps, Rpc_try_alloc, Rpc_free,
+		Rpc_alloc_ram, Rpc_free_ram, Rpc_ram_size,
-		Rpc_ram_quota, Rpc_used_ram,
+		Rpc_cap_quota, Rpc_used_caps, Rpc_ram_quota, Rpc_used_ram,
 		Rpc_native_pd, Rpc_system_control_cap,
 		Rpc_dma_addr, Rpc_attach_dma);
 };
 
+
+struct Genode::Pd_ram_allocator : Ram_allocator
+{
+	Pd_session &_pd;
+
+	Alloc_result try_alloc(size_t size, Cache cache) override
+	{
+		using Pd_error = Pd_session::Alloc_ram_error;
+		return _pd.alloc_ram(size, cache).convert<Alloc_result>(
+			[&] (Ram_dataspace_capability cap) { return cap; },
+			[&] (Pd_error e) {
+				switch (e) {
+				case Pd_error::OUT_OF_CAPS: return Alloc_error::OUT_OF_CAPS;
+				case Pd_error::OUT_OF_RAM: return Alloc_error::OUT_OF_RAM;;
+				case Pd_error::DENIED:
+					break;
+				}
+				return Alloc_error::DENIED;
+			});
+	}
+
+	void free(Ram_dataspace_capability ds) override
+	{
+		_pd.free_ram(ds);
+	}
+
+	size_t dataspace_size(Ram_dataspace_capability ds) override
+	{
+		return _pd.ram_size(ds);
+	}
+
+	Pd_ram_allocator(Pd_session &pd) : _pd(pd) { }
+};
+
 #endif /* _INCLUDE__PD_SESSION__PD_SESSION_H_ */

repos/base/src/core/include/core_ram_allocator.h

@@ -0,0 +1,59 @@
+/*
+ * \brief  RAM allocator for core-internal use
+ * \author Norman Feske
+ * \date   2025-04-01
+ */
+
+/*
+ * Copyright (C) 2025 Genode Labs GmbH
+ *
+ * This file is part of the Genode OS framework, which is distributed
+ * under the terms of the GNU Affero General Public License version 3.
+ */
+
+#ifndef _CORE__INCLUDE__CORE_RAM_ALLOCATOR_H_
+#define _CORE__INCLUDE__CORE_RAM_ALLOCATOR_H_
+
+/* Genode includes */
+#include <base/ram_allocator.h>
+
+/* core includes */
+#include <ram_dataspace_factory.h>
+
+namespace Core { struct Core_ram_allocator; }
+
+
+struct Core::Core_ram_allocator : Ram_allocator
+{
+	Ram_dataspace_factory &_factory;
+
+	Alloc_result try_alloc(size_t size, Cache cache) override
+	{
+		using Pd_error = Pd_session::Alloc_ram_error;
+		return _factory.alloc_ram(size, cache).convert<Alloc_result>(
+			[&] (Ram_dataspace_capability cap) { return cap; },
+			[&] (Pd_error e) {
+				switch (e) {
+				case Pd_error::OUT_OF_CAPS: return Alloc_error::OUT_OF_CAPS;
+				case Pd_error::OUT_OF_RAM: return Alloc_error::OUT_OF_RAM;;
+				case Pd_error::DENIED:
+					break;
+				}
+				return Alloc_error::DENIED;
+			});
+	}
+
+	void free(Ram_dataspace_capability ds) override
+	{
+		_factory.free_ram(ds);
+	}
+
+	size_t dataspace_size(Ram_dataspace_capability ds) override
+	{
+		return _factory.ram_size(ds);
+	}
+
+	Core_ram_allocator(Ram_dataspace_factory &factory) : _factory(factory) { }
+};
+
+#endif /* _CORE__INCLUDE__CORE_RAM_ALLOCATOR_H_ */

repos/base/src/core/include/pd_session_component.h

@@ -59,6 +59,7 @@ class Core::Pd_session_component : public Session_object<Pd_session>
 
 		Rpc_entrypoint         &_ep;
 		Core::System_control   &_system_control;
+		Pd_ram_allocator        _pd_ram;
 		Accounted_ram_allocator _accounted_md_ram_alloc;
 		Accounted_core_ram      _accounted_core_ram_alloc;
 		Sliced_heap             _sliced_heap;
@@ -148,7 +149,8 @@ class Core::Pd_session_component : public Session_object<Pd_session>
 			Session_object(ep, resources, label, diag),
 			_ep(ep),
 			_system_control(system_control),
-			_accounted_md_ram_alloc(*this, _ram_quota_guard(), _cap_quota_guard()),
+			_pd_ram(*this),
+			_accounted_md_ram_alloc(_pd_ram, _ram_quota_guard(), _cap_quota_guard()),
 			_accounted_core_ram_alloc(_ram_quota_guard(), _cap_quota_guard(), core_mem),
 			_sliced_heap(_accounted_md_ram_alloc, local_rm),
 			_ram_ds_factory(ep, phys_alloc, phys_range,
@@ -356,11 +358,11 @@ class Core::Pd_session_component : public Session_object<Pd_session>
 		 ** RAM allocation and accounting **
 		 ***********************************/
 
-		Alloc_result try_alloc(size_t, Cache) override;
+		Alloc_ram_result alloc_ram(size_t, Cache) override;
 
-		void free(Ram_dataspace_capability) override;
+		void free_ram(Ram_dataspace_capability) override;
 
-		size_t dataspace_size(Ram_dataspace_capability) const override;
+		size_t ram_size(Ram_dataspace_capability) override;
 
 
 		/*******************************************

repos/base/src/core/include/ram_dataspace_factory.h

@@ -27,8 +27,7 @@
 namespace Core { class Ram_dataspace_factory; }
 
 
-class Core::Ram_dataspace_factory : public Ram_allocator,
+class Core::Ram_dataspace_factory : public Dataspace_owner
-                                    public Dataspace_owner
 {
 	public:
 
@@ -84,6 +83,9 @@ class Core::Ram_dataspace_factory : public Ram_allocator,
 
 	public:
 
+		using Alloc_ram_error  = Pd_session::Alloc_ram_error;
+		using Alloc_ram_result = Pd_session::Alloc_ram_result;
+
 		Ram_dataspace_factory(Rpc_entrypoint  &ep,
 		                      Range_allocator &phys_alloc,
 		                      Phys_range       phys_range,
@@ -96,20 +98,15 @@ class Core::Ram_dataspace_factory : public Ram_allocator,
 		~Ram_dataspace_factory()
 		{
 			while (Dataspace_component *ds = _ds_slab.first_object())
-				free(static_cap_cast<Ram_dataspace>(
+				free_ram(static_cap_cast<Ram_dataspace>(
 				       static_cap_cast<Dataspace>(ds->cap())));
 		}
 
 		addr_t dataspace_dma_addr(Ram_dataspace_capability);
 
-
+		Alloc_ram_result alloc_ram(size_t, Cache);
-		/*****************************
+		void free_ram(Ram_dataspace_capability);
-		 ** Ram_allocator interface **
+		size_t ram_size(Ram_dataspace_capability ds);
-		 *****************************/
-
-		Alloc_result try_alloc(size_t, Cache) override;
-		void free(Ram_dataspace_capability) override;
-		size_t dataspace_size(Ram_dataspace_capability ds) const override;
 };
 
 #endif /* _CORE__INCLUDE__RAM_DATASPACE_FACTORY_H_ */

repos/base/src/core/main.cc

@@ -33,6 +33,7 @@
 #include <trace/root.h>
 #include <platform_services.h>
 #include <core_child.h>
+#include <core_ram_allocator.h>
 #include <pager.h>
 
 Core::Platform &Core::platform_specific()
@@ -93,9 +94,11 @@ void Genode::bootstrap_component(Genode::Platform &)
 
 	static Core::Core_account core_account { ep, avail_ram, avail_caps };
 
-	static Ram_dataspace_factory core_ram {
+	static Ram_dataspace_factory core_ds_factory {
 		ep, ram_ranges, Ram_dataspace_factory::any_phys_range(), core_alloc };
 
+	static Core_ram_allocator core_ram { core_ds_factory };
+
 	static Core_region_map core_rm { ep };
 
 	static Rpc_entrypoint &signal_ep = core_signal_ep(ep);

repos/base/src/core/pd_session_component.cc

@@ -19,23 +19,22 @@
 using namespace Core;
 
 
-Ram_allocator::Alloc_result
+Pd_session::Alloc_ram_result
-Pd_session_component::try_alloc(size_t ds_size, Cache cache)
+Pd_session_component::alloc_ram(size_t ds_size, Cache cache)
 {
 	/* zero-sized dataspaces are not allowed */
 	if (!ds_size)
-		return Alloc_error::DENIED;
+		return Alloc_ram_error::DENIED;
 
 	/* dataspace allocation granularity is page size */
 	ds_size = align_addr(ds_size, 12);
 
-	using Result      = Ram_allocator::Alloc_result;
 	using Reservation = Genode::Reservation;
 
 	/* track quota use */
-	return _ram_quota_guard().with_reservation<Result>(Ram_quota{ds_size},
+	return _ram_quota_guard().with_reservation<Alloc_ram_result>(Ram_quota{ds_size},
 
-		[&] (Reservation &ram_reservation) -> Result {
+		[&] (Reservation &ram_reservation) -> Alloc_ram_result {
 
 			/*
 			 * In the worst case, we need to allocate a new slab block for
@@ -48,41 +47,41 @@ Pd_session_component::try_alloc(size_t ds_size, Cache cache)
 
 			if (!_ram_quota_guard().have_avail(overhead)) {
 				ram_reservation.cancel();
-				return Ram_allocator::Alloc_error::OUT_OF_RAM;
+				return Alloc_ram_error::OUT_OF_RAM;
 			}
 
 			/*
 			 * Each dataspace is an RPC object and thereby consumes a
 			 * capability.
 			 */
-			return _cap_quota_guard().with_reservation<Result>(Cap_quota{1},
+			return _cap_quota_guard().with_reservation<Alloc_ram_result>(Cap_quota{1},
 
-				[&] (Genode::Reservation &) -> Result {
+				[&] (Genode::Reservation &) -> Alloc_ram_result {
-					return _ram_ds_factory.try_alloc(ds_size, cache);
+					return _ram_ds_factory.alloc_ram(ds_size, cache);
 				},
-				[&] () -> Result {
+				[&] () -> Alloc_ram_result {
 					ram_reservation.cancel();
-					return Ram_allocator::Alloc_error::OUT_OF_CAPS;
+					return Alloc_ram_error::OUT_OF_CAPS;
 				}
 			);
 		},
-		[&] () -> Result {
+		[&] () -> Alloc_ram_result {
-			return Ram_allocator::Alloc_error::OUT_OF_RAM;
+			return Alloc_ram_error::OUT_OF_RAM;
 		}
 	);
 }
 
 
-void Pd_session_component::free(Ram_dataspace_capability ds_cap)
+void Pd_session_component::free_ram(Ram_dataspace_capability ds_cap)
 {
 	if (this->cap() == ds_cap)
 		return;
 
-	size_t const size = _ram_ds_factory.dataspace_size(ds_cap);
+	size_t const size = _ram_ds_factory.ram_size(ds_cap);
 	if (size == 0)
 		return;
 
-	_ram_ds_factory.free(ds_cap);
+	_ram_ds_factory.free_ram(ds_cap);
 
 	/* physical memory */
 	_ram_account->replenish(Ram_quota{size});
@@ -92,12 +91,12 @@ void Pd_session_component::free(Ram_dataspace_capability ds_cap)
 }
 
 
-size_t Pd_session_component::dataspace_size(Ram_dataspace_capability ds_cap) const
+size_t Pd_session_component::ram_size(Ram_dataspace_capability ds_cap)
 {
 	if (this->cap() == ds_cap)
 		return 0;
 
-	return _ram_ds_factory.dataspace_size(ds_cap);
+	return _ram_ds_factory.ram_size(ds_cap);
 }
 
 

repos/base/src/core/ram_dataspace_factory.cc

@@ -17,12 +17,12 @@
 using namespace Core;
 
 
-Ram_allocator::Alloc_result
+Ram_dataspace_factory::Alloc_ram_result
-Ram_dataspace_factory::try_alloc(size_t ds_size, Cache cache)
+Ram_dataspace_factory::alloc_ram(size_t ds_size, Cache cache)
 {
 	/* zero-sized dataspaces are not allowed */
 	if (!ds_size)
-			return Alloc_error::DENIED;
+			return Alloc_ram_error::DENIED;
 
 	/* dataspace allocation granularity is page size */
 	ds_size = align_addr(ds_size, 12);
@@ -82,9 +82,13 @@ Ram_dataspace_factory::try_alloc(size_t ds_size, Cache cache)
 		error("out of physical memory while allocating ", ds_size, " bytes ",
 		      "in range [", Hex(_phys_range.start), "-", Hex(_phys_range.end), "]");
 
-		return allocated_range.convert<Ram_allocator::Alloc_result>(
+		if (allocated_range == Allocator::Alloc_error::OUT_OF_RAM)
-			[&] (void *)            { return Alloc_error::DENIED; },
+			return Alloc_ram_error::OUT_OF_RAM;
-			[&] (Alloc_error error) { return error; });
+
+		if (allocated_range == Allocator::Alloc_error::OUT_OF_CAPS)
+			return Alloc_ram_error::OUT_OF_CAPS;
+
+		return Alloc_ram_error::DENIED;
 	}
 
 	/*
@@ -106,7 +110,7 @@ Ram_dataspace_factory::try_alloc(size_t ds_size, Cache cache)
 
 	allocated_range.with_result(
 		[&] (void *ptr) { phys_alloc_guard.ds_addr = ptr; },
-		[&] (Alloc_error) { /* already checked above */ });
+		[&] (Allocator::Alloc_error) { /* already checked above */ });
 
 	/*
 	 * For non-cached RAM dataspaces, we mark the dataspace as write
@@ -119,9 +123,9 @@ Ram_dataspace_factory::try_alloc(size_t ds_size, Cache cache)
 			Dataspace_component(ds_size, (addr_t)phys_alloc_guard.ds_addr,
 			                    cache, true, this);
 	}
-	catch (Out_of_ram)  { return Alloc_error::OUT_OF_RAM; }
+	catch (Out_of_ram)  { return Alloc_ram_error::OUT_OF_RAM; }
-	catch (Out_of_caps) { return Alloc_error::OUT_OF_CAPS; }
+	catch (Out_of_caps) { return Alloc_ram_error::OUT_OF_CAPS; }
-	catch (...)         { return Alloc_error::DENIED; }
+	catch (...)         { return Alloc_ram_error::DENIED; }
 
 	Dataspace_component &ds = *ds_ptr;
 
@@ -132,7 +136,7 @@ Ram_dataspace_factory::try_alloc(size_t ds_size, Cache cache)
 
 		/* cleanup unneeded resources */
 		destroy(_ds_slab, &ds);
-		return Alloc_error::DENIED;
+		return Alloc_ram_error::DENIED;
 	}
 
 	/*
@@ -150,7 +154,7 @@ Ram_dataspace_factory::try_alloc(size_t ds_size, Cache cache)
 }
 
 
-void Ram_dataspace_factory::free(Ram_dataspace_capability ds_cap)
+void Ram_dataspace_factory::free_ram(Ram_dataspace_capability ds_cap)
 {
 	Dataspace_component *ds = nullptr;
 	_ep.apply(ds_cap, [&] (Dataspace_component *c)
@@ -181,7 +185,7 @@ void Ram_dataspace_factory::free(Ram_dataspace_capability ds_cap)
 }
 
 
-size_t Ram_dataspace_factory::dataspace_size(Ram_dataspace_capability ds_cap) const
+size_t Ram_dataspace_factory::ram_size(Ram_dataspace_capability ds_cap)
 {
 	size_t result = 0;
 	_ep.apply(ds_cap, [&] (Dataspace_component *c) {

repos/base/src/core/stack_area.cc

@@ -134,7 +134,7 @@ struct Stack_area_ram_allocator : Ram_allocator
 
 	void free(Ram_dataspace_capability) override { }
 
-	size_t dataspace_size(Ram_dataspace_capability) const override { return 0; }
+	size_t dataspace_size(Ram_dataspace_capability) override { return 0; }
 };
 
 

repos/base/src/include/base/internal/expanding_pd_session_client.h

@@ -38,23 +38,23 @@ struct Genode::Expanding_pd_session_client : Pd_session_client
 	Expanding_pd_session_client(Parent &parent, Pd_session_capability cap)
 	: Pd_session_client(cap), _parent(parent) { }
 
-	Alloc_result try_alloc(size_t size, Cache cache) override
+	Alloc_ram_result alloc_ram(size_t size, Cache cache) override
 	{
 		/*
 		 * If the PD session runs out of quota, issue a resource request
 		 * to the parent and retry.
 		 */
 		for (;;) {
-			Alloc_result const result = Pd_session_client::try_alloc(size, cache);
+			Alloc_ram_result const result = Pd_session_client::alloc_ram(size, cache);
 			if (result.ok())
 				return result;
 
 			bool denied = false;
 			result.with_error(
-				[&] (Alloc_error error) {
+				[&] (Alloc_ram_error error) {
 					switch (error) {
 
-					case Alloc_error::OUT_OF_RAM:
+					case Alloc_ram_error::OUT_OF_RAM:
 						/*
 						 * The RAM service withdraws the meta data for the allocator
 						 * from the RAM quota. In the worst case, a new slab block
@@ -69,17 +69,17 @@ struct Genode::Expanding_pd_session_client : Pd_session_client
 						_request_ram_from_parent(size + OVERHEAD);
 						break;
 
-					case Alloc_error::OUT_OF_CAPS:
+					case Alloc_ram_error::OUT_OF_CAPS:
 						_request_caps_from_parent(4);
 						break;
 
-					case Alloc_error::DENIED:
+					case Alloc_ram_error::DENIED:
 						denied = true;
 					}
 				});
 
 			if (denied)
-				return Alloc_error::DENIED;
+				return Alloc_ram_error::DENIED;
 		}
 	}
 

repos/base/src/include/base/internal/platform.h

@@ -47,11 +47,13 @@ struct Genode::Platform : Noncopyable
 	Expanding_region_map_client rm {
 		parent, pd.rpc_cap(), pd.address_space(), Parent::Env::pd() };
 
+	Pd_ram_allocator ram { pd };
+
 	Attached_stack_area stack_area { parent, pd.rpc_cap() };
 
 	Platform()
 	{
-		env_stack_area_ram_allocator = &pd;
+		env_stack_area_ram_allocator = &ram;
 		env_stack_area_region_map    = &stack_area;
 	}
 };

repos/base/src/lib/base/child_process.cc

@@ -210,7 +210,8 @@ Child::Start_result Child::_start_process(Dataspace_capability   ldso_ds,
                                           Region_map            &remote_rm,
                                           Parent_capability      parent_cap)
 {
-	return _load_static_elf(ldso_ds, pd, local_rm, remote_rm, parent_cap).convert<Start_result>(
+	Pd_ram_allocator ram { pd };
+	return _load_static_elf(ldso_ds, ram, local_rm, remote_rm, parent_cap).convert<Start_result>(
 		[&] (Entry entry) {
 			initial_thread.start(entry.ip, start);
 			return Start_result::OK;

repos/base/src/lib/base/component.cc

@@ -50,6 +50,8 @@ struct Genode::Component_env : Env
 	Capability<Pd_session>  _pd_cap  = _platform.pd.rpc_cap();
 	Capability<Cpu_session> _cpu_cap = _platform.cpu.rpc_cap();
 
+	Pd_ram_allocator _ram { _pd  };
+
 	Entrypoint &_ep;
 
 	/**
@@ -85,6 +87,7 @@ struct Genode::Component_env : Env
 	Cpu_session   &cpu()    override { return _cpu; }
 	Region_map    &rm()     override { return _rm; }
 	Pd_session    &pd()     override { return _pd; }
+	Ram_allocator &ram()    override { return _ram; }
 	Entrypoint    &ep()     override { return _ep; }
 
 	Cpu_session_capability cpu_session_cap() override { return _cpu_cap; }

repos/base/src/test/ds_ownership/main.cc

@@ -27,13 +27,15 @@ void Component::construct(Genode::Env &env)
 	static Pd_connection pd_1 { env };
 	static Pd_connection pd_2 { env };
 
+	Pd_ram_allocator ram_1 { pd_1 }, ram_2 { pd_2 };
+
 	log("allocate dataspace from one RAM session");
 	pd_1.ref_account(env.pd_session_cap());
 	env.pd().transfer_quota(pd_1.cap(), Ram_quota{8*1024});
-	Ram_dataspace_capability ds = pd_1.alloc(sizeof(unsigned));
+	Ram_dataspace_capability ds = ram_1.alloc(sizeof(unsigned));
 
 	log("attempt to free dataspace from foreign RAM session");
-	pd_2.free(ds);
+	ram_2.free(ds);
 
 	log("try to attach dataspace to see if it still exists");
 	env.rm().attach(ds, { });
@@ -42,7 +44,7 @@ void Component::construct(Genode::Env &env)
 
 	log("free dataspace from legitimate RAM session");
 	Ram_quota const quota_before_free { pd_1.avail_ram() };
-	pd_1.free(ds);
+	ram_1.free(ds);
 	Ram_quota const quota_after_free { pd_1.avail_ram() };
 
 	if (quota_after_free.value > quota_before_free.value)

repos/base/src/test/rm_fault/main.cc

@@ -215,7 +215,7 @@ class Test_child_policy : public Child_policy
 
 		Binary_name binary_name() const override { return "test-rm_fault"; }
 
-		Ram_allocator &session_md_ram() override { return _env.pd(); }
+		Ram_allocator &session_md_ram() override { return _env.ram(); }
 
 		Pd_account            &ref_account()           override { return _env.pd(); }
 		Capability<Pd_account> ref_account_cap() const override { return _env.pd_session_cap(); }

repos/demo/include/launchpad/launchpad.h

@@ -135,7 +135,7 @@ class Launchpad_child : public  Genode::Child_policy,
 
 		Binary_name binary_name() const override { return _elf_name; }
 
-		Genode::Ram_allocator &session_md_ram() override { return _env.pd(); }
+		Genode::Ram_allocator &session_md_ram() override { return _env.ram(); }
 
 		Genode::Pd_account                    &ref_account()           override { return _env.pd(); }
 		Genode::Capability<Genode::Pd_account> ref_account_cap() const override { return _env.pd_session_cap(); }

repos/gems/src/lib/vfs/import/plugin.cc

@@ -232,7 +232,7 @@ class Vfs_import::File_system : public Vfs::File_system
 	public:
 
 		File_system(Vfs::Env &env, Genode::Xml_node const &config)
-		: _heap(env.env().pd(), env.env().rm())
+		: _heap(env.env().ram(), env.env().rm())
 		{
 			bool overwrite = config.attribute_value("overwrite", false);
 

repos/libports/src/app/fetchurl/component.cc

@@ -102,7 +102,7 @@ struct Fetchurl::Main
 
 	Libc::Env &_env;
 
-	Heap _heap { _env.pd(), _env.rm() };
+	Heap _heap { _env.ram(), _env.rm() };
 
 	Timer::Connection _timer { _env, "reporter" };
 

repos/libports/src/app/qt5/qt_launchpad/main.cpp

@@ -45,6 +45,7 @@ struct Qt_launchpad_namespace::Local_env : Genode::Env
 	Cpu_session &cpu()                       override { return genode_env.cpu(); }
 	Region_map &rm()                         override { return genode_env.rm(); }
 	Pd_session &pd()                         override { return genode_env.pd(); }
+	Ram_allocator &ram()                     override { return genode_env.ram(); }
 	Entrypoint &ep()                         override { return local_ep; }
 	Cpu_session_capability cpu_session_cap() override { return genode_env.cpu_session_cap(); }
 	Pd_session_capability pd_session_cap()   override { return genode_env.pd_session_cap(); }

repos/libports/src/app/qt6/qt_launchpad/main.cpp

@@ -45,6 +45,7 @@ struct Qt_launchpad_namespace::Local_env : Genode::Env
 	Cpu_session &cpu()                       override { return genode_env.cpu(); }
 	Region_map &rm()                         override { return genode_env.rm(); }
 	Pd_session &pd()                         override { return genode_env.pd(); }
+	Ram_allocator &ram()                     override { return genode_env.ram(); }
 	Entrypoint &ep()                         override { return local_ep; }
 	Cpu_session_capability cpu_session_cap() override { return genode_env.cpu_session_cap(); }
 	Pd_session_capability pd_session_cap()   override { return genode_env.pd_session_cap(); }

repos/libports/src/lib/libc/internal/env.h

@@ -67,6 +67,7 @@ class Libc::Env_implementation : public Libc::Env
 		Cpu_session   &cpu()    override { return _env.cpu(); }
 		Region_map    &rm()     override { return _env.rm(); }
 		Pd_session    &pd()     override { return _env.pd(); }
+		Ram_allocator &ram()    override { return _env.ram(); }
 		Entrypoint    &ep()     override { return _env.ep(); }
 
 		Cpu_session_capability cpu_session_cap() override {

repos/libports/src/lib/libc/internal/malloc_ram_allocator.h

@@ -75,7 +75,7 @@ struct Libc::Malloc_ram_allocator : Ram_allocator
 				_release(ds); });
 	}
 
-	size_t dataspace_size(Ram_dataspace_capability ds_cap) const override
+	size_t dataspace_size(Ram_dataspace_capability ds_cap) override
 	{
 		return _ram.dataspace_size(ds_cap);
 	}

repos/libports/src/lib/lwip/socket.cc

@@ -75,7 +75,7 @@ Errno Socket::genode_errno(Lwip::err_t errno)
 struct Socket::Main
 {
 	Env  &_env;
-	Heap  _heap { _env.pd(), _env.rm() };
+	Heap  _heap { _env.ram(), _env.rm() };
 
 	Timer::Connection _timer { _env, "vfs_lwip" };
 

repos/libports/src/lib/qemu-usb/webcam.cc

@@ -159,7 +159,7 @@ struct Capture_webcam
 			_libyuv_ds.destruct();
 
 		if (!_libyuv_ds.constructed() || _libyuv_ds->size() != size)
-			_libyuv_ds.construct(_env.pd(), _env.rm(), size);
+			_libyuv_ds.construct(_env.ram(), _env.rm(), size);
 
 		_libyuv_alloc_in_use = true;
 

repos/os/src/app/sequence/main.cc

@@ -31,7 +31,7 @@ struct Sequence::Child : Genode::Child_policy
 {
 	Genode::Env &_env;
 
-	Heap _services_heap { _env.pd(), _env.rm() };
+	Heap _services_heap { _env.ram(), _env.rm() };
 
 	static Binary_name _start_binary(Name const &name, Xml_node const &start_node)
 	{
@@ -46,7 +46,7 @@ struct Sequence::Child : Genode::Child_policy
 	Binary_name const _binary_name;
 
 	Child_policy_dynamic_rom_file _config_policy {
-		_env.rm(), "config", _env.ep().rpc_ep(), &_env.pd() };
+		_env.rm(), "config", _env.ep().rpc_ep(), &_env.ram() };
 
 	class Parent_service : public Genode::Parent_service
 	{
@@ -133,7 +133,7 @@ struct Sequence::Child : Genode::Child_policy
 		return route(service);
 	}
 
-	Ram_allocator &session_md_ram() override { return _env.pd(); }
+	Ram_allocator &session_md_ram() override { return _env.ram(); }
 
 	/**
 	 * Only a single child is managed at a time so

repos/os/src/driver/gpu/intel/main.cc

@@ -149,7 +149,7 @@ struct Igd::Device
 		 * RAM allocator interface
 		 */
 
-		size_t dataspace_size(Ram_dataspace_capability) const override { return 0; }
+		size_t dataspace_size(Ram_dataspace_capability) override { return 0; }
 
 		Alloc_result try_alloc(size_t size, Cache) override
 		{

repos/os/src/driver/platform/session_component.h

@@ -121,7 +121,7 @@ class Driver::Session_component
 		Io_mmu_devices               & _io_mmu_devices;
 		Registry<Irq_controller>     & _irq_controller_registry;
 		Device::Owner                  _owner_id    { *this };
-		Accounted_ram_allocator        _env_ram     { _env.pd(),
+		Accounted_ram_allocator        _env_ram     { _env.ram(),
 		                                              _ram_quota_guard(),
 		                                              _cap_quota_guard()  };
 		Heap                           _md_alloc    { _env_ram, _env.rm() };

repos/os/src/lib/genode_c_api/usb.cc

@@ -530,7 +530,7 @@ class Session_component
 		genode_shared_dataspace_free_t         _free_fn;
 		genode_usb_dev_release_t               _release_fn;
 
-		Accounted_ram_allocator    _env_ram     { _env.pd(),
+		Accounted_ram_allocator    _env_ram     { _env.ram(),
 		                                          _ram_quota_guard(),
 		                                          _cap_quota_guard()  };
 		Heap                       _heap        { _env_ram, _env.rm() };

repos/os/src/monitor/inferior_pd.h

@@ -231,27 +231,27 @@ struct Monitor::Inferior_pd : Monitored_pd_session
 	Cap_quota used_caps() const override {
 		return _real.call<Rpc_used_caps>(); }
 
-	Alloc_result try_alloc(size_t size, Cache cache = CACHED) override
+	Alloc_ram_result alloc_ram(size_t size, Cache cache = CACHED) override
 	{
-		return _real.call<Rpc_try_alloc>(size, cache).convert<Alloc_result>(
+		return _real.call<Rpc_alloc_ram>(size, cache).convert<Alloc_ram_result>(
-			[&] (Ram_dataspace_capability cap) -> Alloc_result {
+			[&] (Ram_dataspace_capability cap) -> Alloc_ram_result {
 				new (_alloc) Ram_ds(_ram_dataspaces, cap);
 				return cap;
 			},
-			[&] (Alloc_error e) -> Alloc_result { return e; });
+			[&] (Alloc_ram_error e) -> Alloc_ram_result { return e; });
 	}
 
-	void free(Ram_dataspace_capability ds) override
+	void free_ram(Ram_dataspace_capability ds) override
 	{
 		_ram_dataspaces.apply<Ram_ds &>(Ram_ds::id(ds), [&] (Ram_ds &ram_ds) {
 			_wipe_ram_ds(ram_ds); });
 
-		_real.call<Rpc_free>(ds);
+		_real.call<Rpc_free_ram>(ds);
 	}
 
-	size_t dataspace_size(Ram_dataspace_capability ds) const override
+	size_t ram_size(Ram_dataspace_capability ds) override
 	{
-		return ds.valid() ? Dataspace_client(ds).size() : 0;
+		return _real.call<Rpc_ram_size>(ds);
 	}
 
 	Ram_quota ram_quota() const override {

repos/os/src/monitor/pd_intrinsics.h

@@ -56,9 +56,9 @@ struct Monitor::Pd_intrinsics : Sandbox::Pd_intrinsics
 		Capability<Region_map> linker_area()                             override { never_called(__func__); };
 		Cap_quota              cap_quota() const                         override { never_called(__func__); };
 		Cap_quota              used_caps() const                         override { never_called(__func__); };
-		Alloc_result           try_alloc(size_t, Cache)                  override { never_called(__func__); };
+		Alloc_ram_result       alloc_ram(size_t, Cache)                  override { never_called(__func__); };
-		void                   free(Ram_ds_cap)                          override { never_called(__func__); };
+		void                   free_ram(Ram_ds_cap)                      override { never_called(__func__); };
-		size_t                 dataspace_size(Ram_ds_cap) const          override { never_called(__func__); };
+		size_t                 ram_size(Ram_ds_cap)                      override { never_called(__func__); };
 		Ram_quota              ram_quota() const                         override { never_called(__func__); };
 		Ram_quota              used_ram()  const                         override { never_called(__func__); };
 		Capability<Native_pd>  native_pd()                               override { never_called(__func__); };

repos/os/src/server/cached_fs_rom/main.cc

@@ -68,7 +68,7 @@ struct Cached_fs_rom::Cached_rom final
 	 * This shall be valid even if the file is empty.
 	 */
 	Attached_ram_dataspace ram_ds {
-		env.pd(), env.rm(), file_size ? file_size : 1 };
+		env.ram(), env.rm(), file_size ? file_size : 1 };
 
 	/**
 	 * Read-only region map exposed as ROM module to the client
@@ -287,7 +287,7 @@ struct Cached_fs_rom::Main final : Genode::Session_request_handler
 	Transfer_space transfers { };
 	Session_space  sessions  { };
 
-	Heap heap { env.pd(), env.rm() };
+	Heap heap { env.ram(), env.rm() };
 
 	Allocator_avl           fs_tx_block_alloc { &heap };
 	File_system::Connection fs { env, fs_tx_block_alloc, "/", false, 4*1024*1024 };

repos/os/src/server/cpu_balancer/session.h

@@ -83,7 +83,7 @@ class Cpu::Session : public Rpc_object<Cpu_session>
 
 		Ram_quota_guard        _ram_guard;
 		Cap_quota_guard        _cap_guard;
-		Ram_allocator          _ram      { _env.pd(), _ram_guard, _cap_guard };
+		Ram_allocator          _ram      { _env.ram(), _ram_guard, _cap_guard };
 		Heap                   _md_alloc { _ram, _env.rm() };
 
 		Ram_quota              _reclaim_ram { 0 };

repos/os/src/server/lx_fs/main.cc

@@ -299,7 +299,7 @@ class Lx_fs::Session_component : private Session_resources,
 		                  bool                 writeable,
 		                  Notifier            &notifier)
 		:
-			Session_resources { env.pd(), env.rm(), ram_quota, cap_quota, tx_buf_size },
+			Session_resources { env.ram(), env.rm(), ram_quota, cap_quota, tx_buf_size },
 			Session_rpc_object {_packet_ds.cap(), env.rm(), env.ep().rpc_ep() },
 			_env { env },
 			_root { *new (&_alloc) Directory { _alloc, root_dir, false } },

repos/os/src/server/nic_router/session_env.h

@@ -136,7 +136,7 @@ class Genode::Session_env : public Ram_allocator,
 			try {
 				_consume(ds_size, MAX_SHARED_RAM, 1, MAX_SHARED_CAP, [&] ()
 				{
-					result = _env.pd().try_alloc(ds_size, cache);
+					result = _env.ram().try_alloc(ds_size, cache);
 				});
 			}
 			catch (Out_of_ram)  { result = Alloc_error::OUT_OF_RAM; }
@@ -148,12 +148,12 @@ class Genode::Session_env : public Ram_allocator,
 
 		void free(Ram_dataspace_capability ds) override
 		{
-			_replenish(_env.pd().dataspace_size(ds), 1, [&] () {
+			_replenish(_env.ram().dataspace_size(ds), 1, [&] () {
-				_env.pd().free(ds);
+				_env.ram().free(ds);
 			});
 		}
 
-		size_t dataspace_size(Ram_dataspace_capability ds) const override { return _env.pd().dataspace_size(ds); }
+		size_t dataspace_size(Ram_dataspace_capability ds) override { return _env.ram().dataspace_size(ds); }
 
 
 		/****************

repos/os/src/server/vfs/main.cc

@@ -451,7 +451,7 @@ class Vfs_server::Session_component : private Session_resources,
 		                  char          const *root_path,
 		                  bool                 writeable)
 		:
-			Session_resources(env.pd(), env.rm(), ram_quota, cap_quota, tx_buf_size),
+			Session_resources(env.ram(), env.rm(), ram_quota, cap_quota, tx_buf_size),
 			Session_rpc_object(_packet_ds.cap(), env.rm(), env.ep().rpc_ep()),
 			_vfs(vfs),
 			_io(io),

repos/os/src/test/fault_detection/main.cc

@@ -99,7 +99,7 @@ class Test_child : public Genode::Child_policy
 
 		Binary_name binary_name() const override { return _binary_name; }
 
-		Ram_allocator &session_md_ram() override { return _env.pd(); }
+		Ram_allocator &session_md_ram() override { return _env.ram(); }
 
 		Pd_account            &ref_account()           override { return _env.pd(); }
 		Capability<Pd_account> ref_account_cap() const override { return _env.pd_session_cap(); }

repos/os/src/test/fs_packet/component.cc

@@ -34,7 +34,7 @@ struct Fs_packet::Main
 
 	int _packet_count = _config.xml().attribute_value("count", 1U << 10);
 
-	Heap                    _heap { _env.pd(), _env.rm() };
+	Heap                    _heap { _env.ram(), _env.rm() };
 	Allocator_avl           _avl_alloc { &_heap };
 	File_system::Connection _fs { _env, _avl_alloc, "/", false, 4<<10 };
 

repos/os/src/test/fs_report/main.cc

@@ -30,7 +30,7 @@ struct Test::Main
 {
 	Env &_env;
 
-	Genode::Heap _heap { _env.pd(), _env.rm() };
+	Genode::Heap _heap { _env.ram(), _env.rm() };
 
 	Timer::Connection _timer { _env };
 

repos/os/src/test/resource_request/main.cc

@@ -220,7 +220,7 @@ void Component::construct(Genode::Env &env)
 	 * which is the most likely case in normal scenarios.
 	 */
 	log("\n-- out-of-memory during RAM allocation --");
-	env.pd().alloc(512*1024);
+	env.ram().alloc(512*1024);
 	print_quota_stats(env.pd());
 	size_t const used_quota_after_alloc = env.pd().used_ram().value;
 

repos/os/src/test/resource_yield/main.cc

@@ -304,7 +304,7 @@ class Test::Parent
 			} _config_producer { };
 
 			Dynamic_rom_session _config_session { _env.ep().rpc_ep(),
-			                                      _env.pd(), _env.rm(),
+			                                      _env.ram(), _env.rm(),
 			                                      _config_producer };
 
 			using Config_service = Genode::Local_service<Dynamic_rom_session>;
@@ -323,7 +323,7 @@ class Test::Parent
 
 			Binary_name binary_name() const override { return _binary_name; }
 
-			Ram_allocator &session_md_ram() override { return _env.pd(); }
+			Ram_allocator &session_md_ram() override { return _env.ram(); }
 
 			Pd_account            &ref_account()           override { return _env.pd(); }
 			Capability<Pd_account> ref_account_cap() const override { return _env.pd_session_cap(); }