Ntfs!NtfsInitializeRestartTable函数分析

Ntfs!NtfsInitializeRestartTable函数分析

第一部分：

            //
            //  Now we construct the dirty page table by calling the Cache Manager.
            //  For each dirty page on files tagged with our log handle, he will
            //  call us back at our DirtyPageRoutine.  We will allocate the initial
            //  Dirty Page Table, but we will let the call back routine grow it as
            //  necessary.
            //

            NtfsInitializeRestartTable( (((Vcb->RestartVersion == 0) ?
                                          sizeof( DIRTY_PAGE_ENTRY_V0 ) :
                                          sizeof( DIRTY_PAGE_ENTRY )) +
                                         ((Vcb->ClustersPerPage - 1) * sizeof(LCN))),
                                        Vcb->DirtyPageTableSizeHint,
                                        &DirtyPages );

现在，我们通过调用缓存管理器来构造脏页表。对于标记有我们日志句柄的文件上的每个脏页，他都会在DirtyPageRoutine上给我们回电。
我们将分配初始的脏页表，但我们会让回调例程根据需要对其进行扩展。

    [+0x6a0] RestartVersion   : 0x0 [Type: unsigned long]

    [+0x7b0] DirtyPageTableSizeHint : 0x20 [Type: unsigned long]

NtfsInitializeRestartTable (
    IN ULONG EntrySize,
    IN ULONG NumberEntries,
    OUT PRESTART_POINTERS TablePointer
    )

第二部分：

1: kd> p
Ntfs!NtfsCheckpointVolume+0x6f1:
f71d8639 e8f40afaff      call    Ntfs!NtfsInitializeRestartTable (f7179132)
1: kd> t
Ntfs!NtfsInitializeRestartTable:
f7179132 6a08            push    8
1: kd> dv
      EntrySize = 0x2c
  NumberEntries = 0x20
   TablePointer = 0xf78d2b90

第三部分：

1: kd> gu
Ntfs!NtfsCheckpointVolume+0x6f6:
f71d863e 6a01            push    1

1: kd> dx -r1 (*((Ntfs!_RESTART_POINTERS *)0xf78d2b90))
(*((Ntfs!_RESTART_POINTERS *)0xf78d2b90))                 [Type: _RESTART_POINTERS]
    [+0x000] Resource         [Type: _ERESOURCE]
    [+0x038] Table            : 0x895b9840 [Type: _RESTART_TABLE *]
    [+0x03c] SpinLock         : 0x0 [Type: unsigned long]
    [+0x040] ResourceInitialized : 0x1 [Type: unsigned char]
    [+0x041] DrainPending     : 0x0 [Type: unsigned char]
    [+0x042] Unused           [Type: unsigned char [6]]

1: kd> dx -r1 ((Ntfs!_RESTART_TABLE *)0x895b9840)
((Ntfs!_RESTART_TABLE *)0x895b9840)                 : 0x895b9840 [Type: _RESTART_TABLE *]
    [+0x000] EntrySize        : 0x2c [Type: unsigned short]
    [+0x002] NumberEntries    : 0x20 [Type: unsigned short]
    [+0x004] NumberAllocated  : 0x0 [Type: unsigned short]
    [+0x006] Reserved         [Type: unsigned short [3]]
    [+0x00c] FreeGoal         : 0xffffffff [Type: unsigned long]
    [+0x010] FirstFree        : 0x18 [Type: unsigned long]
    [+0x014] LastFree         : 0x56c [Type: unsigned long]