The IRP_MJ_QUERY_INFORMATION request is sent by the I/O Manager and other operating system components, as well as by other kernel-mode drivers. This request can be sent, for example, when a user-mode application has called a Microsoft Win32 function such as GetFileInformationByHandle or when a kernel-mode component has called ZwQueryInformationFile.
The file system driver should extract and decode the file object to determine whether it represents a user open of a file or directory. If it does, the driver should process the query and complete the IRP. Otherwise, the driver should complete the IRP as appropriate without processing the query.
The types of file and directory information that can be queried are file system-dependent, but generally include the following:
Although the FileAccessInformation, FileAlignmentInformation, and FileModeInformation information types can also be passed as a parameter to ZwQueryInformationFile, this information is file-system-independent. Thus ZwQueryInformationFile supplies this information directly, without sending an IRP_MJ_QUERY_INFORMATION request to the file system.
For more information about these information types, refer to the See Also links below. For a list of all possible information types, see the FILE_INFORMATION_CLASS enumeration in ntifs.h.
A network redirector driver not based on RDBSS that receives an IRP_MJ_QUERY_INFORMATION request for FileAllInformation or FileNameInformation, must respond with the full "\server\share\file" path for the file name with a single leading backslash before the server name. This format for name information must be returned for a file accessed as a Universal Naming Convention (UNC) name (\\server\share\folder\filename.txt, for example) or a file located on a mapped drive (x:\folder\filename.txt, for example).
For a network mini-redirector driver (a driver that links dynamically with rdbss.sys or that links statically with rdbsslib.lib), an IRP_MJ_QUERY_INFORMATION request for FileNameInformation is handled internally by RDBSS and the correct name information is returned. For a network mini-redirector driver, an IRP_MJ_QUERY_INFORMATION request for FileAllInformation is handled internally by RDBSS for the name information part of the request. The other parts of the FileAllInformation request are sent as separate requests to the network mini-redirector driver to resolve.
A network redirector that receives an IRP_MJ_QUERY_INFORMATION request for FileAlternateNameInformation should respond with the short name (8.3 characters) for the file without any path information, if a short name exists for the file.
The filter driver should pass this IRP down to the next-lower driver on the stack.
A file system or filter driver calls IoGetCurrentIrpStackLocation with the given IRP to get a pointer to its own stack location in the IRP, shown in the following list as IrpSp. (The IRP is shown as Irp.) The driver can use the information that is set in the following members of the IRP and the IRP stack location in processing a query file information request:
Pointer to the target device object.
Pointer to the output buffer where the file or directory information is to be returned. This information is stored in one of the following structures:
Pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the requested operation. For more information, see the description of the IoStatusBlock parameter in the ZwQueryInformationFile. routine.
Optional pointer to a caller-supplied output buffer into which the contents of Irp->AssociatedIrp.SystemBuffer are copied during I/O completion by the I/O manager. Drivers do not use this buffer to return any data for the request.
Pointer to the file object that is associated with DeviceObject.
The IrpSp->FileObject parameter contains a pointer to the RelatedFileObject field, which is also a FILE_OBECT structure. The RelatedFileObject field of the FILE_OBJECT structure is not valid during the processing of IRP_MJ_QUERY_INFORMATION and should not be used.
Type of file information to be queried. This member can be one of the following values.
Return a FILE_ALL_INFORMATION structure for the file.
Return a FILE_ATTRIBUTE_TAG_INFORMATION structure for the file.
Return a FILE_BASIC_INFORMATION structure for the file.
Return a FILE_COMPRESSION_INFORMATION structure for the file.
Return a FILE_EA_INFORMATION structure for the file.
Return a FILE_INTERNAL_INFORMATION structure for the file.
Return a FILE_NAME_INFORMATION structure for the file.
Return a single FILE_NETWORK_OPEN_INFORMATION structure for the file.
Return a single FILE_POSITION_INFORMATION structure for the file.
Return a single FILE_STANDARD_INFORMATION structure for the file.
Return a single FILE_STREAM_INFORMATION structure for the file.
Return a FILE_LINKS_INFORMATION structure for the file.
Length, in bytes, of the buffer pointed to by Irp->AssociatedIrp.SystemBuffer.
The IRP_MJ_QUERY_INFORMATION operation is always buffered by the I/O manager. The Irp->AssociatedIrp.SystemBuffer that is used to return the requested file or directory information is allocated by the I/O manager from non-paged pool memory. As a result, the Irp->AssociatedIrp.SystemBuffer returned by the operating system will always be a valid address for the length specified in IrpSp->Parameters.QueryFile.Length.
The Irp->AssociatedIrp.UserBuffer is used internally by the I/O manager and should not be used by file system or file system filter drivers.