Export (0) Print
Expand All

IRP_MJ_QUERY_INFORMATION

When Sent

The IRP_MJ_QUERY_INFORMATION request is sent by the I/O Manager and other operating system components, as well as by other kernel-mode drivers. This request can be sent, for example, when a user-mode application has called a Microsoft Win32 function such as GetFileInformationByHandle or when a kernel-mode component has called ZwQueryInformationFile.

Operation: File System Drivers

The file system driver should extract and decode the file object to determine whether it represents a user open of a file or directory. If it does, the driver should process the query and complete the IRP. Otherwise, the driver should complete the IRP as appropriate without processing the query.

The types of file and directory information that can be queried are file system-dependent, but generally include the following:

FileAllInformation
FileAlternateNameInformation
FileAttributeTagInformation
FileBasicInformation
FileCompressionInformation
FileEaInformation
FileInternalInformation
FileNameInformation
FileNetworkOpenInformation
FilePositionInformation
FileStandardInformation
FileStreamInformation
FileHardLinkInformation

Although the FileAccessInformation, FileAlignmentInformation, and FileModeInformation information types can also be passed as a parameter to ZwQueryInformationFile, this information is file-system-independent. Thus ZwQueryInformationFile supplies this information directly, without sending an IRP_MJ_QUERY_INFORMATION request to the file system.

For more information about these information types, refer to the See Also links below. For a list of all possible information types, see the FILE_INFORMATION_CLASS enumeration in ntifs.h.

Operation: Network Redirector Drivers

A network redirector driver not based on RDBSS that receives an IRP_MJ_QUERY_INFORMATION request for FileAllInformation or FileNameInformation, must respond with the full "\server\share\file" path for the file name with a single leading backslash before the server name. This format for name information must be returned for a file accessed as a Universal Naming Convention (UNC) name (\\server\share\folder\filename.txt, for example) or a file located on a mapped drive (x:\folder\filename.txt, for example).

For a network mini-redirector driver (a driver that links dynamically with rdbss.sys or that links statically with rdbsslib.lib), an IRP_MJ_QUERY_INFORMATION request for FileNameInformation is handled internally by RDBSS and the correct name information is returned. For a network mini-redirector driver, an IRP_MJ_QUERY_INFORMATION request for FileAllInformation is handled internally by RDBSS for the name information part of the request. The other parts of the FileAllInformation request are sent as separate requests to the network mini-redirector driver to resolve.

A network redirector that receives an IRP_MJ_QUERY_INFORMATION request for FileAlternateNameInformation should respond with the short name (8.3 characters) for the file without any path information, if a short name exists for the file.

Operation: File System Filter Drivers

The filter driver should pass this IRP down to the next-lower driver on the stack.

Parameters

A file system or filter driver calls IoGetCurrentIrpStackLocation with the given IRP to get a pointer to its own stack location in the IRP, shown in the following list as IrpSp. (The IRP is shown as Irp.) The driver can use the information that is set in the following members of the IRP and the IRP stack location in processing a query file information request:

DeviceObject

Pointer to the target device object.

Irp->AssociatedIrp.SystemBuffer

Pointer to the output buffer where the file or directory information is to be returned. This information is stored in one of the following structures:

FILE_ALL_INFORMATION
FILE_ATTRIBUTE_TAG_INFORMATION
FILE_BASIC_INFORMATION
FILE_COMPRESSION_INFORMATION
FILE_EA_INFORMATION
FILE_INTERNAL_INFORMATION
FILE_NAME_INFORMATION
FILE_NETWORK_OPEN_INFORMATION
FILE_POSITION_INFORMATION
FILE_STANDARD_INFORMATION
FILE_STREAM_INFORMATION
FILE_LINKS_INFORMATION
Irp->IoStatus

Pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the requested operation. For more information, see the description of the IoStatusBlock parameter in the ZwQueryInformationFile. routine.

Irp->UserBuffer

Optional pointer to a caller-supplied output buffer into which the contents of Irp->AssociatedIrp.SystemBuffer are copied during I/O completion by the I/O manager. Drivers do not use this buffer to return any data for the request.

IrpSp->FileObject

Pointer to the file object that is associated with DeviceObject.

The IrpSp->FileObject parameter contains a pointer to the RelatedFileObject field, which is also a FILE_OBECT structure. The RelatedFileObject field of the FILE_OBJECT structure is not valid during the processing of IRP_MJ_QUERY_INFORMATION and should not be used.

IrpSp->MajorFunction

Specifies IRP_MJ_QUERY_INFORMATION.

IrpSp->Parameters.QueryFile.FileInformationClass

Type of file information to be queried. This member can be one of the following values.

ValueMeaning

FileAllInformation

Return a FILE_ALL_INFORMATION structure for the file.

FileAttributeTagInformation

Return a FILE_ATTRIBUTE_TAG_INFORMATION structure for the file.

FileBasicInformation

Return a FILE_BASIC_INFORMATION structure for the file.

FileCompressionInformation

Return a FILE_COMPRESSION_INFORMATION structure for the file.

FileEaInformation

Return a FILE_EA_INFORMATION structure for the file.

FileInternalInformation

Return a FILE_INTERNAL_INFORMATION structure for the file.

FileNameInformation

Return a FILE_NAME_INFORMATION structure for the file.

FileNetworkOpenInformation

Return a single FILE_NETWORK_OPEN_INFORMATION structure for the file.

FilePositionInformation

Return a single FILE_POSITION_INFORMATION structure for the file.

FileStandardInformation

Return a single FILE_STANDARD_INFORMATION structure for the file.

FileStreamInformation

Return a single FILE_STREAM_INFORMATION structure for the file.

FileHardLinkInformation

Return a FILE_LINKS_INFORMATION structure for the file.

 

IrpSp->Parameters.QueryFile.Length

Length, in bytes, of the buffer pointed to by Irp->AssociatedIrp.SystemBuffer.

Remarks

The IRP_MJ_QUERY_INFORMATION operation is always buffered by the I/O manager. The Irp->AssociatedIrp.SystemBuffer that is used to return the requested file or directory information is allocated by the I/O manager from non-paged pool memory. As a result, the Irp->AssociatedIrp.SystemBuffer returned by the operating system will always be a valid address for the length specified in IrpSp->Parameters.QueryFile.Length.

The Irp->AssociatedIrp.UserBuffer is used internally by the I/O manager and should not be used by file system or file system filter drivers.

See also

FILE_ALIGNMENT_INFORMATION
FILE_ATTRIBUTE_TAG_INFORMATION
FILE_BASIC_INFORMATION
FILE_INTERNAL_INFORMATION
FILE_NAME_INFORMATION
FILE_NETWORK_OPEN_INFORMATION
FILE_POSITION_INFORMATION
FILE_STANDARD_INFORMATION
FILE_STREAM_INFORMATION
FILE_LINKS_INFORMATION
IO_STACK_LOCATION
IO_STATUS_BLOCK
IoCheckEaBufferValidity
IoGetCurrentIrpStackLocation
IRP
IRP_MJ_SET_INFORMATION
ZwQueryInformationFile

 

 

Send comments about this topic to Microsoft

Show:
© 2015 Microsoft