Edit

FLT_PARAMETERS for IRP_MJ_QUERY_EA union

  • Article

Union component used when the MajorFunction field of the FLT_IO_PARAMETER_BLOCK structure for the operation is IRP_MJ_QUERY_EA.

Syntax

typedef union _FLT_PARAMETERS {
  ...    ;
  struct {
    ULONG                    Length;
    PVOID                    EaList;
    ULONG                    EaListLength;
    ULONG  POINTER_ALIGNMENT EaIndex;
    PVOID                    EaBuffer;
    PMDL                     MdlAddress;
  } QueryEa;
  ...    ;
} FLT_PARAMETERS, *PFLT_PARAMETERS;

Members

  • QueryEa: Structure within FLT_PARAMETERS union containing the following members.

  • Length: Length, in bytes, of the buffer that EaBuffer points to.

  • EaList: Pointer to a caller-supplied, FILE_GET_EA_INFORMATION-structured input buffer specifying the extended attributes to be queried.

  • EaListLength: Length, in bytes, of the buffer that EaList points to.

  • EaIndex: Index of the entry at which to begin scanning the extended-attribute list. This parameter is ignored if the SL_INDEX_SPECIFIED flag is not set in the FLT_IO_PARAMETER_BLOCK structure for the operation or if EaList points to a nonempty list.

  • EaBuffer: Pointer to a caller-supplied, FILE_FULL_EA_INFORMATION-structured output buffer where the extended attribute values are to be returned. This member is optional and can be NULL if a MDL is provided in MdlAddress. See Remarks.

  • MdlAddress: Address of a memory descriptor list (MDL) describing the buffer that EaBuffer points to. This member is optional and can be NULL if a buffer is provided in EaBuffer. See Remarks.

Remarks

The FLT_PARAMETERS structure for IRP_MJ_QUERY_EA operations contains the parameters for an IRP-based query-extended-attributes-information operation represented by a callback data (FLT_CALLBACK_DATA) structure. It is contained in an FLT_IO_PARAMETER_BLOCK structure.

If both an EaBuffer and MdlAddress buffer are provided, it is recommended that minifilters use the MDL. The memory that EaBuffer points to is valid when it is a user mode address being accessed within the context of the calling process, or if it is a kernel mode address.

If a minifilter changes the value of MdlAddress, then after its post operation callback, Filter Manager will free the MDL currently stored in MdlAddress and restore the previous value of MdlAddress.

IRP_MJ_QUERY_EA is an IRP-based operation.

Requirements

Requirement type Requirement
Header Fltkernel.h (include Fltkernel.h)

See also

FILE_FULL_EA_INFORMATION

FLT_CALLBACK_DATA

FLT_IO_PARAMETER_BLOCK

FLT_IS_FASTIO_OPERATION

FLT_IS_FS_FILTER_OPERATION

FLT_IS_IRP_OPERATION

FLT_PARAMETERS

IoCheckEaBufferValidity

IRP_MJ_QUERY_EA