/*++
Copyright (c) 1993 Microsoft Corporation
Module Name:
cmgquota.c
Abstract:
The module contains CM routines to support Global Quota
Global Quota has little to do with NT's standard per-process/user
quota system. Global Quota is waying of controlling the aggregate
resource usage of the entire registry. It is used to manage space
consumption by objects which user apps create, but which are persistent
and therefore cannot be assigned to the quota of a user app.
Global Quota prevents the registry from consuming all of paged
pool, and indirectly controls how much disk it can consume.
Like the release 1 file systems, a single app can fill all the
space in the registry, but at least it cannot kill the system.
Memory objects used for known short times and protected by
serialization, or billable as quota objects, are not counted
in the global quota.
Author:
Bryan M. Willman (bryanwi) 13-Jan-1993
Revision History:
Dragos C Sambotin (dragoss) 04-Nov-1999
Charge quota only for bins in paged pool (volatile storage and bins crossing
the CM_VIEW_SIZE boundary).
--*/
#include "cmp.h"
VOID
CmpSystemHiveHysteresisWorker(
IN PVOID WorkItem
);
VOID
CmpRaiseSelfHealWarningWorker(
IN PVOID Arg
);
#ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE,CmpClaimGlobalQuota)
#pragma alloc_text(PAGE,CmpReleaseGlobalQuota)
#pragma alloc_text(PAGE,CmpSetGlobalQuotaAllowed)
#pragma alloc_text(PAGE,CmpQuotaWarningWorker)
#pragma alloc_text(PAGE,CmQueryRegistryQuotaInformation)
#pragma alloc_text(PAGE,CmSetRegistryQuotaInformation)
#pragma alloc_text(PAGE,CmpCanGrowSystemHive)
#pragma alloc_text(PAGE,CmpSystemQuotaWarningWorker)
#pragma alloc_text(INIT,CmpComputeGlobalQuotaAllowed)
#pragma alloc_text(PAGE,CmpSystemHiveHysteresisWorker)
#pragma alloc_text(PAGE,CmpUpdateSystemHiveHysteresis)
#pragma alloc_text(PAGE,CmRegisterSystemHiveLimitCallback)
#pragma alloc_text(PAGE,CmpRaiseSelfHealWarning)
#pragma alloc_text(PAGE,CmpRaiseSelfHealWarningForSystemHives)
#pragma alloc_text(PAGE,CmpRaiseSelfHealWarningWorker)
#endif
//
// Registry control values
//
#define CM_DEFAULT_RATIO (3)
#define CM_LIMIT_RATIO(x) ((x / 10) * 8)
#define CM_MINIMUM_GLOBAL_QUOTA (16 *1024 * 1024)
//
// Percent of used registry quota that triggers a hard error
// warning popup.
//
#define CM_REGISTRY_WARNING_LEVEL (95)
//
// System hive hard quota limit
//
// For an x86 3GB system we set the limit at 12MB for now. Needs some MM changes before we
// bump this up.
// For an x86 non-3GB system, we set the limit at 1/4 of physical memory
// For IA-64 we set the limit at 32MB
//
#define _200MB (200 *1024 * 1024)
#if defined(_X86_)
#define CM_SYSTEM_HIVE_LIMIT_SIZE (MmVirtualBias ? (12 * 1024 * 1024) : (min(MmNumberOfPhysicalPages / 4, _200MB >> PAGE_SHIFT) * PAGE_SIZE))
#else
#define CM_SYSTEM_HIVE_LIMIT_SIZE (32 * 1024 * 1024)
#endif
#define CM_SYSTEM_HIVE_WARNING_SIZE ((CM_SYSTEM_HIVE_LIMIT_SIZE*9)/10)
extern ULONG CmRegistrySizeLimit;
extern ULONG CmRegistrySizeLimitLength;
extern ULONG CmRegistrySizeLimitType;
extern ULONG MmSizeOfPagedPoolInBytes;
//
// Maximum number of bytes of Global Quota the registry may use.
// Set to largest positive number for use in boot. Will be set down
// based on pool and explicit registry values.
//
extern ULONG CmpGlobalQuota;
extern ULONG CmpGlobalQuotaAllowed;
//
// Mark that will trigger the low-on-quota popup
//
extern ULONG CmpGlobalQuotaWarning;
//
// Indicate whether the popup has been triggered yet or not.
//
extern BOOLEAN CmpQuotaWarningPopupDisplayed;
extern BOOLEAN CmpSystemQuotaWarningPopupDisplayed;
//
// GQ actually in use
//
extern ULONG CmpGlobalQuotaUsed;
extern HIVE_LIST_ENTRY CmpMachineHiveList[];
VOID
CmQueryRegistryQuotaInformation(
IN PSYSTEM_REGISTRY_QUOTA_INFORMATION RegistryQuotaInformation
)
/*++
Routine Description:
Returns the registry quota information
Arguments:
RegistryQuotaInformation - Supplies pointer to buffer that will return
the registry quota information.
Return Value:
None.
--*/
{
RegistryQuotaInformation->RegistryQuotaAllowed = CmpGlobalQuota;
RegistryQuotaInformation->RegistryQuotaUsed = CmpGlobalQuotaUsed;
RegistryQuotaInformation->PagedPoolSize = MmSizeOfPagedPoolInBytes;
}
VOID
CmSetRegistryQuotaInformation(
IN PSYSTEM_REGISTRY_QUOTA_INFORMATION RegistryQuotaInformation
)
/*++
Routine Description:
Sets the registry quota information. The caller is assumed to have
completed the necessary security checks already.
Arguments:
RegistryQuotaInformation - Supplies pointer to buffer that provides
the new registry quota information.
Return Value:
None.
--*/
{
CmpGlobalQuota = RegistryQuotaInformation->RegistryQuotaAllowed;
//
// Sanity checks against insane values
//
if (CmpGlobalQuota > CM_WRAP_LIMIT) {
CmpGlobalQuota = CM_WRAP_LIMIT;
}
if (CmpGlobalQuota < CM_MINIMUM_GLOBAL_QUOTA) {
CmpGlobalQuota = CM_MINIMUM_GLOBAL_QUOTA;
}
//
// Recompute the warning level
//
CmpGlobalQuotaWarning = CM_REGISTRY_WARNING_LEVEL * (CmpGlobalQuota / 100);
CmpGlobalQuotaAllowed = CmpGlobalQuota;
}
VOID
CmpQuotaWarningWorker(
IN PVOID WorkItem
)
/*++
Routine Description:
Displays hard error popup that indicates the registry quota is
running out.
Arguments:
WorkItem - Supplies pointer to the work item. This routine will
free the work item.
Return Value:
None.
--*/
{
NTSTATUS Status;
ULONG Response;
ExFreePool(WorkItem);
Status = ExRaiseHardError(STATUS_REGISTRY_QUOTA_LIMIT,
0,
0,
NULL,
OptionOk,
&Response);
}
BOOLEAN
CmpClaimGlobalQuota(
IN ULONG Size
)
/*++
Routine Description:
If CmpGlobalQuotaUsed + Size >= CmpGlobalQuotaAllowed, return
false. Otherwise, increment CmpGlobalQuotaUsed, in effect claiming
the requested GlobalQuota.
Arguments:
Size - number of bytes of GlobalQuota caller wants to claim
Return Value:
TRUE - Claim succeeded, and has been counted in Used GQ
FALSE - Claim failed, nothing counted in GQ.
--*/
{
#if 0
//
// We shouldn't come to this, unless we have leaks;
// There is no quota anymore, remember?
//
LONG available;
PWORK_QUEUE_ITEM WorkItem;
//
// compute available space, then see if size <. This prevents overflows.
// Note that this must be signed. Since quota is not enforced until logon,
// it is possible for the available bytes to be negative.
//
available = (LONG)CmpGlobalQuotaAllowed - (LONG)CmpGlobalQuotaUsed;
if ((LONG)Size < available) {
CmpGlobalQuotaUsed += Size;
if ((CmpGlobalQuotaUsed > CmpGlobalQuotaWarning) &&
(!CmpQuotaWarningPopupDisplayed) &&
(ExReadyForErrors)) {
//
// Queue work item to display popup
//
WorkItem = ExAllocatePool(NonPagedPool, sizeof(WORK_QUEUE_ITEM));
if (WorkItem != NULL) {
CmpQuotaWarningPopupDisplayed = TRUE;
ExInitializeWorkItem(WorkItem,
CmpQuotaWarningWorker,
WorkItem);
ExQueueWorkItem(WorkItem, DelayedWorkQueue);
}
}
return TRUE;
} else {
return FALSE;
}
#endif //0
CmpGlobalQuotaUsed += Size;
return TRUE;
}
VOID
CmpReleaseGlobalQuota(
IN ULONG Size
)
/*++
Routine Description:
If Size <= CmpGlobalQuotaUsed, then decrement it. Else BugCheck.
Arguments:
Size - number of bytes of GlobalQuota caller wants to release
Return Value:
NONE.
--*/
{
if (Size > CmpGlobalQuotaUsed) {
CM_BUGCHECK(REGISTRY_ERROR,QUOTA_ERROR,1,0,0);
}
CmpGlobalQuotaUsed -= Size;
}
VOID
CmpComputeGlobalQuotaAllowed(
VOID
)
/*++
Routine Description:
Compute CmpGlobalQuota based on:
(a) Size of paged pool
(b) Explicit user registry commands to set registry GQ
Return Value:
NONE.
--*/
{
ULONG PagedLimit;
PagedLimit = CM_LIMIT_RATIO(MmSizeOfPagedPoolInBytes);
if ((CmRegistrySizeLimitLength != 4) ||
(CmRegistrySizeLimitType != REG_DWORD) ||
(CmRegistrySizeLimit == 0))
{
//
// If no value at all, or value of wrong type, or set to
// zero, use internally computed default
//
CmpGlobalQuota = MmSizeOfPagedPoolInBytes / CM_DEFAULT_RATIO;
} else if (CmRegistrySizeLimit >= PagedLimit) {
//
// If more than computed upper bound, use computed upper bound
//
CmpGlobalQuota = PagedLimit;
} else {
//
// Use the set size
//
CmpGlobalQuota = CmRegistrySizeLimit;
}
if (CmpGlobalQuota > CM_WRAP_LIMIT) {
CmpGlobalQuota = CM_WRAP_LIMIT;
}
if (CmpGlobalQuota < CM_MINIMUM_GLOBAL_QUOTA) {
CmpGlobalQuota = CM_MINIMUM_GLOBAL_QUOTA;
}
CmpGlobalQuotaWarning = CM_REGISTRY_WARNING_LEVEL * (CmpGlobalQuota / 100);
return;
}
VOID
CmpSetGlobalQuotaAllowed(
VOID
)
/*++
Routine Description:
Enables registry quota
NOTE: Do NOT put this in init segment, we call it after
that code has been freed!
Return Value:
NONE.
--*/
{
CmpGlobalQuotaAllowed = CmpGlobalQuota;
}
BOOLEAN
CmpCanGrowSystemHive(
IN PHHIVE Hive,
IN ULONG NewLength
)
/*++
Routine Description:
Checks if the system hive is allowed to grow with the specified amount
of data (using the hard quota limit on the system hive)
Return Value:
NONE.
--*/
{
PCMHIVE CmHive;
PWORK_QUEUE_ITEM WorkItem;
PAGED_CODE();
CmHive = (PCMHIVE)CONTAINING_RECORD(Hive,CMHIVE,Hive);
if( CmHive != CmpMachineHiveList[SYSTEM_HIVE_INDEX].CmHive ) {
//
// not the system hive, bail out
//
return TRUE;
}
// account for the header.
NewLength += HBLOCK_SIZE;
if( NewLength > CM_SYSTEM_HIVE_LIMIT_SIZE ) {
//
// this is bad; we may not be able to boot next time !!!
//
return FALSE;
}
if( (NewLength > CM_SYSTEM_HIVE_WARNING_SIZE) &&
(!CmpSystemQuotaWarningPopupDisplayed) &&
(ExReadyForErrors)
) {
//
// we're above the warning level, queue work item to display popup
//
WorkItem = ExAllocatePool(NonPagedPool, sizeof(WORK_QUEUE_ITEM));
if (WorkItem != NULL) {
CmpSystemQuotaWarningPopupDisplayed = TRUE;
ExInitializeWorkItem(WorkItem,
CmpSystemQuotaWarningWorker,
WorkItem);
ExQueueWorkItem(WorkItem, DelayedWorkQueue);
}
}
return TRUE;
}
VOID
CmpSystemQuotaWarningWorker(
IN PVOID WorkItem
)
/*++
Routine Description:
Displays hard error popup that indicates the hard quota limit
on the system hive is running out.
Arguments:
WorkItem - Supplies pointer to the work item. This routine will
free the work item.
Return Value:
None.
--*/
{
NTSTATUS Status;
ULONG Response;
ExFreePool(WorkItem);
Status = ExRaiseHardError(STATUS_REGISTRY_QUOTA_LIMIT,
0,
0,
NULL,
OptionOk,
&Response);
}
//
// Pnp private API
//
ULONG CmpSystemHiveHysteresisLow = 0;
ULONG CmpSystemHiveHysteresisHigh = 0;
PVOID CmpSystemHiveHysteresisContext = NULL;
PCM_HYSTERESIS_CALLBACK CmpSystemHiveHysteresisCallback = NULL;
ULONG CmpSystemHiveHysteresisHitRatio = 0;
BOOLEAN CmpSystemHiveHysteresisLowSeen = FALSE;
BOOLEAN CmpSystemHiveHysteresisHighSeen = FALSE;
VOID
CmpSystemHiveHysteresisWorker(
IN PVOID WorkItem
)
/*++
Routine Description:
Calls the hysteresis callback
Arguments:
WorkItem - Supplies pointer to the work item. This routine will
free the work item.
Return Value:
None.
--*/
{
PCM_HYSTERESIS_CALLBACK Callback;
ExFreePool(WorkItem);
Callback = CmpSystemHiveHysteresisCallback;
if( Callback ) {
(*Callback)(CmpSystemHiveHysteresisContext,CmpSystemHiveHysteresisHitRatio);
}
}
VOID
CmpUpdateSystemHiveHysteresis( PHHIVE Hive,
ULONG NewLength,
ULONG OldLength
)
{
PCMHIVE CmHive;
PWORK_QUEUE_ITEM WorkItem;
ULONG CurrentRatio;
BOOLEAN DoWorkItem = FALSE;
PAGED_CODE();
CmHive = (PCMHIVE)CONTAINING_RECORD(Hive,CMHIVE,Hive);
if( (!CmpSystemHiveHysteresisCallback) || (CmHive != CmpMachineHiveList[SYSTEM_HIVE_INDEX].CmHive) ) {
//
// not the system hive, bail out
//
return;
}
ASSERT( NewLength != OldLength );
//
// compute current ratio; acount for the header first
//
CurrentRatio = NewLength + HBLOCK_SIZE;
CurrentRatio *= 100;
CurrentRatio /= CM_SYSTEM_HIVE_LIMIT_SIZE;
if( NewLength > OldLength ) {
//
// hive is growing
//
if( (CmpSystemHiveHysteresisHighSeen == FALSE) && (CurrentRatio > CmpSystemHiveHysteresisHigh) ) {
//
// we reached high; see if low has already been hit and queue work item
//
CmpSystemHiveHysteresisHighSeen = TRUE;
if( TRUE == CmpSystemHiveHysteresisLowSeen ) {
//
// low to high; queue workitem
//
CmpSystemHiveHysteresisHitRatio = CurrentRatio;
DoWorkItem = TRUE;
}
}
} else {
//
// hive is shrinking
//
if( (FALSE == CmpSystemHiveHysteresisLowSeen) && (CurrentRatio < CmpSystemHiveHysteresisLow ) ) {
//
// we reached low; see if low has been hit and queue work item
//
CmpSystemHiveHysteresisLowSeen = TRUE;
if( TRUE == CmpSystemHiveHysteresisHighSeen ) {
//
// high to low; queue workitem
//
CmpSystemHiveHysteresisHitRatio = CurrentRatio;
DoWorkItem = TRUE;
}
}
}
if( DoWorkItem ) {
ASSERT( CmpSystemHiveHysteresisLowSeen && CmpSystemHiveHysteresisHighSeen );
WorkItem = ExAllocatePool(NonPagedPool, sizeof(WORK_QUEUE_ITEM));
if (WorkItem != NULL) {
ExInitializeWorkItem(WorkItem,
CmpSystemHiveHysteresisWorker,
WorkItem);
ExQueueWorkItem(WorkItem, DelayedWorkQueue);
}
//
// reset state so we can fire again later
//
CmpSystemHiveHysteresisLowSeen = FALSE;
CmpSystemHiveHysteresisHighSeen = FALSE;
}
}
ULONG
CmRegisterSystemHiveLimitCallback(
ULONG Low,
ULONG High,
PVOID Ref,
PCM_HYSTERESIS_CALLBACK Callback
)
/*++
Routine Description:
This routine registers a hysteresis for the system hive limit ratio.
We will call the callback :
a. the system hive goes above High from below Low
b. the system hive goes below Low from above High
Arguments:
Low, High - specifies the hysteresis
Ref - Context to give back to the callback
Callback - callback routine.
Return Value:
current ratio 0 - 100
--*/
{
ULONG Length;
PAGED_CODE();
if( CmpMachineHiveList[SYSTEM_HIVE_INDEX].CmHive ) {
Length = CmpMachineHiveList[SYSTEM_HIVE_INDEX].CmHive->Hive.BaseBlock->Length + HBLOCK_SIZE;
Length *= 100;
Length /= CM_SYSTEM_HIVE_LIMIT_SIZE;
} else {
Length = 0;
}
//
// allow only one call per system uptime.
//
if( CmpSystemHiveHysteresisCallback == NULL ) {
CmpSystemHiveHysteresisLow = Low;
CmpSystemHiveHysteresisHigh = High;
CmpSystemHiveHysteresisContext = Ref;
CmpSystemHiveHysteresisCallback = Callback;
//
// set state vars
//
if( Length <= Low ) {
CmpSystemHiveHysteresisLowSeen = TRUE;
} else {
CmpSystemHiveHysteresisLowSeen = FALSE;
}
if( Length >= High) {
CmpSystemHiveHysteresisHighSeen = TRUE;
} else {
CmpSystemHiveHysteresisHighSeen = FALSE;
}
}
return Length;
}
VOID
CmpHysteresisTest(PVOID Ref, ULONG Level)
{
UNREFERENCED_PARAMETER (Ref);
DbgPrint("CmpHysteresisTest called with level = %lu \n",Level);
}
typedef struct {
PWORK_QUEUE_ITEM WorkItem;
UNICODE_STRING HiveName;
//
// variable length; name goes here
//
} CM_SELF_HEAL_WORK_ITEM_PARAMETER, *PCM_SELF_HEAL_WORK_ITEM_PARAMETER;
VOID
CmpRaiseSelfHealWarningWorker(
IN PVOID Arg
)
{
PVOID ErrorParameters;
ULONG ErrorResponse;
PCM_SELF_HEAL_WORK_ITEM_PARAMETER Param;
Param = (PCM_SELF_HEAL_WORK_ITEM_PARAMETER)Arg;
ErrorParameters = &(Param->HiveName);
ExRaiseHardError(
STATUS_REGISTRY_RECOVERED,
1,
1,
(PULONG_PTR)&ErrorParameters,
OptionOk,
&ErrorResponse
);
//
// free what we have allocated
//
ExFreePool(Param->WorkItem);
ExFreePool(Param);
}
VOID
CmpRaiseSelfHealWarning(
IN PUNICODE_STRING HiveName
)
/*++
Routine Description:
Raise a hard error informing the use the specified hive has been self healed and
it might not be entirely consitent
Arguments:
Parameter - the hive name.
Return Value:
None.
--*/
{
PCM_SELF_HEAL_WORK_ITEM_PARAMETER Param;
PAGED_CODE();
//
// we're above the warning level, queue work item to display popup
//
Param = ExAllocatePool(NonPagedPool, sizeof(CM_SELF_HEAL_WORK_ITEM_PARAMETER) + HiveName->Length);
if( Param ) {
Param->WorkItem = ExAllocatePool(NonPagedPool, sizeof(WORK_QUEUE_ITEM));
if(Param->WorkItem != NULL) {
Param->HiveName.Length = Param->HiveName.MaximumLength = HiveName->Length;
Param->HiveName.Buffer = (PWSTR)(((PUCHAR)Param) + sizeof(CM_SELF_HEAL_WORK_ITEM_PARAMETER));
RtlCopyMemory(Param->HiveName.Buffer,HiveName->Buffer,HiveName->Length);
ExInitializeWorkItem(Param->WorkItem,
CmpRaiseSelfHealWarningWorker,
Param);
ExQueueWorkItem(Param->WorkItem, DelayedWorkQueue);
} else {
ExFreePool(Param);
}
}
}
VOID
CmpRaiseSelfHealWarningForSystemHives( )
/*++
Routine Description:
Walks the system hivelist and raises a hard error in the event one of the hives has been self healed.
Intended to be called after controlset has been saved, from inside NtInitializeRegistry
(i.e. we have an UI available so it will not stop the machine).
Arguments:
Return Value:
None.
--*/
{
ULONG i;
UNICODE_STRING Name;
PAGED_CODE();
for (i = 0; i < CM_NUMBER_OF_MACHINE_HIVES; i++) {
if( !(CmpMachineHiveList[i].Flags & HIVE_VOLATILE) && (((PHHIVE)(CmpMachineHiveList[i].CmHive2))->BaseBlock->BootType & HBOOT_SELFHEAL) ) {
RtlInitUnicodeString(
&Name,
CmpMachineHiveList[i].Name
);
CmpRaiseSelfHealWarning( &Name );
}
}
}