The IRP_MJ_QUERY_EA request is sent by the I/O Manager and other operating system components, as well as other kernel-mode drivers, when a user-mode application has requested information about a file's extended attributes.
If the file system supports extended attributes, the file system driver should process the query and complete the IRP. Otherwise, it should return STATUS_EAS_NOT_SUPPORTED.
The filter driver should pass this IRP down to the next-lower driver on the stack.
A file system or filter driver calls IoGetCurrentIrpStackLocation with the given IRP to get a pointer to its own stack location in the IRP, shown in the following list as IrpSp. (The IRP is shown as Irp.) The driver can use the information that is set in the following members of the IRP and the IRP stack location in processing an IRP_MJ_QUERY_EA request:
A pointer to the target device object.
A pointer to a system-supplied output buffer to be used as an intermediate system buffer. Used for METHOD_BUFFERED I/O.
A pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the requested operation.
Address of a memory descriptor list (MDL) describing an output buffer that receives the extended attribute information. Used for METHOD_DIRECT I/O.
A pointer to a caller-supplied FILE_FULL_EA_INFORMATION-structured output buffer that receives the extended attribute information. Used for METHOD_NEITHER I/O.
A pointer to the file object that is associated with DeviceObject.
The IrpSp->FileObject parameter contains a pointer to the RelatedFileObject field, which is also a FILE_OBJECT structure. The RelatedFileObject field of the FILE_OBJECT structure is not valid during the processing of IRP_MJ_QUERY_EA and should not be used.
Specifies one or more of the following values.
Begin the scan at the entry in the extended attribute list whose index is given by IrpSp->Parameters.QueryEa.EaIndex.
Begin the scan at the first entry in the list. If this flag is not set, resume the scan from a previous IRP_MJ_QUERY_EA request.
Return only the first entry that is found.
Index of the entry at which to begin scanning the extended-attribute list. This parameter is ignored if the SL_INDEX_SPECIFIED flag is not set or if IrpSp->Parameters.QueryEa.EaList points to a nonempty list.
A pointer to a caller-supplied FILE_GET_EA_INFORMATION-structured input buffer specifying the extended attributes to be queried.
Length in bytes of the buffer pointed to by IrpSp->Parameters.QueryEa.EaList.
Length in bytes of the output buffer.
When a short buffer is supplied and STATUS_BUFFER_OVERFLOW is returned, NTFS returns the last whole FILE_FULL_EA_INFORMATION entry that fits. When a short buffer is supplied and STATUS_BUFFER_TOO_SMALL is returned, NTFS could not fit any FILE_FULL_EA_INFORMATION entries.