Ntfs!LfsRestartLogFile函數分析之調用Ntfs!LfsAllocateLfcb函數初始化Lfcb->LbcbWorkque

第一部分：

F:\srv03rtm>grep "NtfsStartLogFile" -rn F:\srv03rtm\base\fs\ntfs |grep -v "inary"
F:\srv03rtm\base\fs\ntfs/fsctrl.c:1890:??????????? NtfsStartLogFile( Vcb->LogFileScb,
F:\srv03rtm\base\fs\ntfs/logsup.c:130:#pragma alloc_text(PAGE, NtfsStartLogFile)
F:\srv03rtm\base\fs\ntfs/logsup.c:3556:NtfsStartLogFile (
F:\srv03rtm\base\fs\ntfs/logsup.c:3587:??? DebugTrace( +1, Dbg, ("NtfsStartLogFile:\n") );
F:\srv03rtm\base\fs\ntfs/logsup.c:3634:??? DebugTrace( -1, Dbg, ("NtfsStartLogFile -> VOID\n") );
F:\srv03rtm\base\fs\ntfs/mp/ntfs.prf:348:NtfsStartLogFile@8
F:\srv03rtm\base\fs\ntfs/ntfsproc.h:3031:NtfsStartLogFile (

NTSTATUS
NtfsMountVolume (
??? IN PIRP_CONTEXT IrpContext,
??? IN PIRP Irp
??? )
{

??????? //
??????? //? Create the log file Scb and really look up its size.
??????? //

??????? NtfsOpenSystemFile( IrpContext,
??????????????????????????? &Vcb->LogFileScb,
??????????????????????????? Vcb,
??????????????????????????? LOG_FILE_NUMBER,
??????????????????????????? 0,
??????????????????????????? $DATA,
??????????????????????????? TRUE );

??????? try {

??????????? Status = STATUS_SUCCESS;
??????????? UnrecognizedRestart = FALSE;

??????????? NtfsStartLogFile( Vcb->LogFileScb,
????????????????????????????? Vcb );

第二部分：

VOID
NtfsStartLogFile (
??? IN PSCB LogFileScb,
??? IN PVCB Vcb
??? )
{

??? Vcb->LogHeaderReservation = LfsOpenLogFile( LogFileScb->FileObject,
??????????????????????????????????????????????? UnicodeName,
??????????????????????????????????????????????? 1,
??????????????????????????????????????????????? 0,
??????????????????????????????????????????????? LogFileScb->Header.AllocationSize.QuadPart,
??????????????????????????????????????????????? &LfsInfo,
??????????????????????????????????????????????? &Vcb->LogHandle,
??????????????????????????????????????????????? &Vcb->LfsWriteData );

F:\srv03rtm>grep "LfsOpenLogFile" -rn F:\srv03rtm\base\fs\ntfs |grep -v "inary"
F:\srv03rtm\base\fs\ntfs/logsup.c:3623:??? Vcb->LogHeaderReservation = LfsOpenLogFile( LogFileScb->FileObject,
F:\srv03rtm\base\fs\ntfs/mp/ntfs.prf:389:LfsOpenLogFile@36

第三部分：

ULONG
LfsOpenLogFile (
??? IN PFILE_OBJECT LogFile,
??? IN UNICODE_STRING ClientName,
??? IN USHORT MaximumClients,
??? IN ULONG LogPageSize OPTIONAL,
??? IN LONGLONG FileSize,
??? IN OUT PLFS_INFO LfsInfo,
??? OUT PLFS_LOG_HANDLE LogHandle,
??? OUT PLFS_WRITE_DATA WriteData
??? )
{

??????????? //
??????????? //? Perform Lfs restart on this file object.
??????????? //

??????????? ThisLfcb = NewLfcb = LfsRestartLogFile( LogFile,
??????????????????????????????????????????????????? MaximumClients,
??????????????????????????????????????????????????? LogPageSize,
??????????????????????????????????????????????????? FileSize,
??????????????????????????????????????????????????? LfsInfo,
??????????????????????????????????????????????????? WriteData );

第四部分：

LfsAllocateLfcb
LfsRestartLogFile

PLFCB
LfsRestartLogFile (
??? IN PFILE_OBJECT LogFile,
??? IN USHORT MaximumClients,
??? IN ULONG LogPageSize OPTIONAL,
??? IN LONGLONG FileSize,
??? IN OUT PLFS_INFO LfsInfo,
??? OUT PLFS_WRITE_DATA WriteData
??? )

?? try {

??????? //
??????? //? Normalize the values passed in with this call.
??????? //

??????? LfsNormalizeBasicLogFile( &FileSize,
????????????????????????????????? &LogPageSize,
????????????????????????????????? &MaximumClients,
????????????????????????????????? UseDefaultLogPage );

??????? //
??????? //? Allocate an Lfcb to use for this file.
??????? //

??????? ThisLfcb = LfsAllocateLfcb( LogPageSize, FileSize );

第五部分：Ntfs!_LFCB結構的建立

PLFCB
LfsAllocateLfcb (
??? IN ULONG LogPageSize,
??? IN LONGLONG FileSize
??? )
{

??????? //
??????? //? Initialize the Lbcb links.
??????? //

??????? InitializeListHead( &Lfcb->LbcbWorkque );
??????? InitializeListHead( &Lfcb->LbcbActive );