int ntfs_attr_lookup (const ATTR_TYPE type, const ntfschar * name, const u32 name_len, const IGNORE_CASE_BOOL ic, const VCN lowest_vcn, const u8 * val, const u32 val_len, ntfs_attr_search_ctx * ctx);
Find an attribute in an ntfs inode. On first search ctx->ntfs_ino must be the base mft record and ctx must have been obtained from a call to ntfs_attr_get_search_ctx.
This function transparently handles attribute lists and ctx is used to continue searches where they were left off at.
After finishing with the attribute/mft record you need to call ntfs_attr_put_search_ctx to cleanup the search context (unmapping any mapped inodes, etc).
Return 0 if the search was successful and -errno if not.
When 0, ctx->attr is the found attribute and it is in mft record ctx->mrec. If an attribute list attribute is present, ctx->al_entry is the attribute list entry of the found attribute.
When -ENOENT, ctx->attr is the attribute which collates just after the attribute being searched for, i.e. if one wants to add the attribute to the mft record this is the correct place to insert it into. If an attribute list attribute is present, ctx->al_entry is the attribute list entry which collates just after the attribute list entry of the attribute being searched for, i.e. if one wants to add the attribute to the mft record this is the correct place to insert its attribute list entry into.
When -errno != -ENOENT, an error occured during the lookup. ctx->attr is then undefined and in particular you should not rely on it not changing.