Speakers
Description
On embedded and automotive Linux systems, a single daemon often allocates DMA-buf memory on behalf of other clients. Today, most of that memory is invisible to cgroup accounting, only system-heap buffers can carry a charge via __GFP_ACCOUNT, and even then it lands on the allocator’s cgroup rather than the app that requested the buffer.
The misattribution has real consequences on any system that uses cgroup memory limits to drive reclaim or enforce resource budgets, as untracked buffers silently skew pressure signals. For example, on Android, where app memory limits depend on per-app accounting; or on automotive systems, where strict Freedom From Interference (FFI) is a key requirement and a central allocator absorbing the charge of its clients across domains breaks any meaningful resource isolation argument.
In this session we will discuss the design space for fixing the proxy-allocator problem, presenting the context from our proposal in upstream. Should the charge be attributed at allocation time, or before export time? Should the allocator identify the target via a pidfd (natural for approaches like Binder, where the allocator already knows the sender_pid) or a cgroupfd? What happens with buffers that may belong to different cgroups across their lifetime?