The IRP_MJ_QUERY_EA request is sent by the I/O Manager and other operating system components, as well as other kernel-mode drivers, when a user-mode application has requested information about a file's extended attributes.
Operation: File System Drivers
If the file system supports extended attributes, the file system driver should process the query and complete the IRP. Otherwise, it should return STATUS_EAS_NOT_SUPPORTED.
Operation: File System Filter Drivers
The filter driver should pass this IRP down to the next-lower driver on the stack.
A file system or filter driver calls IoGetCurrentIrpStackLocation with the given IRP to get a pointer to its own stack location in the IRP, shown in the following list as IrpSp. (The IRP is shown as Irp.) The driver can use the information that is set in the following members of the IRP and the IRP stack location in processing an IRP_MJ_QUERY_EA request:
A pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the requested operation.
A pointer to a caller-supplied FILE_FULL_EA_INFORMATION-structured output buffer that receives the extended attribute information. Used for METHOD_NEITHER I/O.
The IrpSp->FileObject parameter contains a pointer to the RelatedFileObject field, which is also a FILE_OBJECT structure. The RelatedFileObject field of the FILE_OBJECT structure is not valid during the processing of IRP_MJ_QUERY_EA and should not be used.
Begin the scan at the entry in the extended attribute list whose index is given by IrpSp->Parameters.QueryEa.EaIndex.
Begin the scan at the first entry in the list. If this flag is not set, resume the scan from a previous IRP_MJ_QUERY_EA request.
Return only the first entry that is found.
Index of the entry at which to begin scanning the extended-attribute list. This parameter is ignored if the SL_INDEX_SPECIFIED flag is not set or if IrpSp->Parameters.QueryEa.EaList points to a nonempty list.
A pointer to a caller-supplied FILE_GET_EA_INFORMATION-structured input buffer specifying the extended attributes to be queried.
When a short buffer is supplied and STATUS_BUFFER_OVERFLOW is returned, NTFS returns the last whole FILE_FULL_EA_INFORMATION entry that fits. When a short buffer is supplied and STATUS_BUFFER_TOO_SMALL is returned, NTFS could not fit any FILE_FULL_EA_INFORMATION entries.
> [!Note] > On Windows Vista and later, FAT16 no longer supports extended attributes.