Ntfs!LfsRestartLogFile函数分析之调用Ntfs!LfsAllocateLfcb函数初始化Lfcb->LbcbWorkque

第一部分：

F:\srv03rtm>grep "NtfsStartLogFile" -rn F:\srv03rtm\base\fs\ntfs |grep -v "inary"
F:\srv03rtm\base\fs\ntfs/fsctrl.c:1890:            NtfsStartLogFile( Vcb->LogFileScb,
F:\srv03rtm\base\fs\ntfs/logsup.c:130:#pragma alloc_text(PAGE, NtfsStartLogFile)
F:\srv03rtm\base\fs\ntfs/logsup.c:3556:NtfsStartLogFile (
F:\srv03rtm\base\fs\ntfs/logsup.c:3587:    DebugTrace( +1, Dbg, ("NtfsStartLogFile:\n") );
F:\srv03rtm\base\fs\ntfs/logsup.c:3634:    DebugTrace( -1, Dbg, ("NtfsStartLogFile -> VOID\n") );
F:\srv03rtm\base\fs\ntfs/mp/ntfs.prf:348:NtfsStartLogFile@8
F:\srv03rtm\base\fs\ntfs/ntfsproc.h:3031:NtfsStartLogFile (

NTSTATUS
NtfsMountVolume (
    IN PIRP_CONTEXT IrpContext,
    IN PIRP Irp
    )
{

        //
        //  Create the log file Scb and really look up its size.
        //

        NtfsOpenSystemFile( IrpContext,
                            &Vcb->LogFileScb,
                            Vcb,
                            LOG_FILE_NUMBER,
                            0,
                            $DATA,
                            TRUE );

        try {

            Status = STATUS_SUCCESS;
            UnrecognizedRestart = FALSE;

            NtfsStartLogFile( Vcb->LogFileScb,
                              Vcb );

第二部分：

VOID
NtfsStartLogFile (
    IN PSCB LogFileScb,
    IN PVCB Vcb
    )
{

    Vcb->LogHeaderReservation = LfsOpenLogFile( LogFileScb->FileObject,
                                                UnicodeName,
                                                1,
                                                0,
                                                LogFileScb->Header.AllocationSize.QuadPart,
                                                &LfsInfo,
                                                &Vcb->LogHandle,
                                                &Vcb->LfsWriteData );

F:\srv03rtm>grep "LfsOpenLogFile" -rn F:\srv03rtm\base\fs\ntfs |grep -v "inary"
F:\srv03rtm\base\fs\ntfs/logsup.c:3623:    Vcb->LogHeaderReservation = LfsOpenLogFile( LogFileScb->FileObject,
F:\srv03rtm\base\fs\ntfs/mp/ntfs.prf:389:LfsOpenLogFile@36

第三部分：

ULONG
LfsOpenLogFile (
    IN PFILE_OBJECT LogFile,
    IN UNICODE_STRING ClientName,
    IN USHORT MaximumClients,
    IN ULONG LogPageSize OPTIONAL,
    IN LONGLONG FileSize,
    IN OUT PLFS_INFO LfsInfo,
    OUT PLFS_LOG_HANDLE LogHandle,
    OUT PLFS_WRITE_DATA WriteData
    )
{

            //
            //  Perform Lfs restart on this file object.
            //

            ThisLfcb = NewLfcb = LfsRestartLogFile( LogFile,
                                                    MaximumClients,
                                                    LogPageSize,
                                                    FileSize,
                                                    LfsInfo,
                                                    WriteData );

第四部分：

LfsAllocateLfcb
LfsRestartLogFile

PLFCB
LfsRestartLogFile (
    IN PFILE_OBJECT LogFile,
    IN USHORT MaximumClients,
    IN ULONG LogPageSize OPTIONAL,
    IN LONGLONG FileSize,
    IN OUT PLFS_INFO LfsInfo,
    OUT PLFS_WRITE_DATA WriteData
    )

   try {

        //
        //  Normalize the values passed in with this call.
        //

        LfsNormalizeBasicLogFile( &FileSize,
                                  &LogPageSize,
                                  &MaximumClients,
                                  UseDefaultLogPage );

        //
        //  Allocate an Lfcb to use for this file.
        //

        ThisLfcb = LfsAllocateLfcb( LogPageSize, FileSize );

第五部分：Ntfs!_LFCB结构的建立

PLFCB
LfsAllocateLfcb (
    IN ULONG LogPageSize,
    IN LONGLONG FileSize
    )
{

        //
        //  Initialize the Lbcb links.
        //

        InitializeListHead( &Lfcb->LbcbWorkque );
        InitializeListHead( &Lfcb->LbcbActive );