IRP_MJ_QUERY_INFORMATION

When Sent

The IRP_MJ_QUERY_INFORMATION request is sent by the I/O Manager and other operating system components, as well as by other kernel-mode drivers. This request can be sent, for example, when a user-mode application has called a Microsoft Win32 function such as GetFileInformationByHandle or when a kernel-mode component has called ZwQueryInformationFile.

Operation: File System Drivers

The file system driver should extract and decode the file object to determine whether it represents a user open of a file or directory. If it does, the driver should process the query and complete the IRP. Otherwise, the driver should complete the IRP as appropriate without processing the query.

The types of file and directory information that can be queried are file system-dependent, but generally include the following:

FileAllInformation FileAlternateNameInformation FileAttributeTagInformation FileBasicInformation FileCompressionInformation FileEaInformation FileInternalInformation FileNameInformation FileNetworkOpenInformation FilePositionInformation FileStandardInformation FileStreamInformation FileHardLinkInformation Although the FileAccessInformation, FileAlignmentInformation, and FileModeInformation information types can also be passed as a parameter to ZwQueryInformationFile, this information is file-system-independent. Thus ZwQueryInformationFile supplies this information directly, without sending an IRP_MJ_QUERY_INFORMATION request to the file system.

For more information about these information types, refer to the See Also links below. For a list of all possible information types, see the FILE_INFORMATION_CLASS enumeration in ntifs.h.

Operation: Network Redirector Drivers

A network redirector driver not based on RDBSS that receives an IRP_MJ_QUERY_INFORMATION request for FileAllInformation or FileNameInformation, must respond with the full "\server\share\file" path for the file name with a single leading backslash before the server name. This format for name information must be returned for a file accessed as a Universal Naming Convention (UNC) name (\\server\share\folder\filename.txt, for example) or a file located on a mapped drive (x:\folder\filename.txt, for example).

For a network mini-redirector driver (a driver that links dynamically with rdbss.sys or that links statically with rdbsslib.lib), an IRP_MJ_QUERY_INFORMATION request for FileNameInformation is handled internally by RDBSS and the correct name information is returned. For a network mini-redirector driver, an IRP_MJ_QUERY_INFORMATION request for FileAllInformation is handled internally by RDBSS for the name information part of the request. The other parts of the FileAllInformation request are sent as separate requests to the network mini-redirector driver to resolve.

A network redirector that receives an IRP_MJ_QUERY_INFORMATION request for FileAlternateNameInformation should respond with the short name (8.3 characters) for the file without any path information, if a short name exists for the file.

Operation: File System Filter Drivers

The filter driver should pass this IRP down to the next-lower driver on the stack.

Parameters

A file system or filter driver calls IoGetCurrentIrpStackLocation with the given IRP to get a pointer to its own stack location in the IRP, shown in the following list as IrpSp. (The IRP is shown as Irp.) The driver can use the information that is set in the following members of the IRP and the IRP stack location in processing a query file information request:

DeviceObject
Pointer to the target device object.

Irp->AssociatedIrp.SystemBuffer
Pointer to the output buffer where the file or directory information is to be returned. This information is stored in one of the following structures:

FILE_ALL_INFORMATION

FILE_ATTRIBUTE_TAG_INFORMATION

FILE_BASIC_INFORMATION

FILE_COMPRESSION_INFORMATION

FILE_EA_INFORMATION

FILE_INTERNAL_INFORMATION

FILE_NAME_INFORMATION

FILE_NETWORK_OPEN_INFORMATION

FILE_POSITION_INFORMATION

FILE_STANDARD_INFORMATION

FILE_STREAM_INFORMATION

FILE_LINKS_INFORMATION

Irp->IoStatus Pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the requested operation. For more information, see the description of the IoStatusBlock parameter in the ZwQueryInformationFile. routine.

Irp->UserBuffer Optional pointer to a caller-supplied output buffer into which the contents of Irp->AssociatedIrp.SystemBuffer are copied during I/O completion by the I/O manager. Drivers do not use this buffer to return any data for the request.

IrpSp->FileObject Pointer to the file object that is associated with DeviceObject.

The IrpSp->FileObject parameter contains a pointer to the RelatedFileObject field, which is also a FILE_OBECT structure. The RelatedFileObject field of the FILE_OBJECT structure is not valid during the processing of IRP_MJ_QUERY_INFORMATION and should not be used.

IrpSp->MajorFunction Specifies IRP_MJ_QUERY_INFORMATION.

IrpSp->Parameters.QueryFile.FileInformationClass Type of file information to be queried. This member can be one of the following values.

Value Meaning

FileAllInformation

Return a FILE_ALL_INFORMATION structure for the file.

FileAttributeTagInformation

Return a FILE_ATTRIBUTE_TAG_INFORMATION structure for the file.

FileBasicInformation

Return a FILE_BASIC_INFORMATION structure for the file.

FileCompressionInformation

Return a FILE_COMPRESSION_INFORMATION structure for the file.

FileEaInformation

Return a FILE_EA_INFORMATION structure for the file.

FileInternalInformation

Return a FILE_INTERNAL_INFORMATION structure for the file.

FileNameInformation

Return a FILE_NAME_INFORMATION structure for the file.

FileNetworkOpenInformation

Return a single FILE_NETWORK_OPEN_INFORMATION structure for the file.

FilePositionInformation

Return a single FILE_POSITION_INFORMATION structure for the file.

FileStandardInformation

Return a single FILE_STANDARD_INFORMATION structure for the file.

FileStreamInformation

Return a single FILE_STREAM_INFORMATION structure for the file.

FileHardLinkInformation

Return a FILE_LINKS_INFORMATION structure for the file.

IrpSp->Parameters.QueryFile.Length Length, in bytes, of the buffer pointed to by Irp->AssociatedIrp.SystemBuffer.

Remarks

The IRP_MJ_QUERY_INFORMATION operation is always buffered by the I/O manager. The Irp->AssociatedIrp.SystemBuffer that is used to return the requested file or directory information is allocated by the I/O manager from non-paged pool memory. As a result, the Irp->AssociatedIrp.SystemBuffer returned by the operating system will always be a valid address for the length specified in IrpSp->Parameters.QueryFile.Length.

The Irp->AssociatedIrp.UserBuffer is used internally by the I/O manager and should not be used by file system or file system filter drivers.

See also

FILE_ALIGNMENT_INFORMATION

FILE_ATTRIBUTE_TAG_INFORMATION

FILE_BASIC_INFORMATION

FILE_INTERNAL_INFORMATION

FILE_NAME_INFORMATION

FILE_NETWORK_OPEN_INFORMATION

FILE_POSITION_INFORMATION

FILE_STANDARD_INFORMATION

FILE_STREAM_INFORMATION

FILE_LINKS_INFORMATION

IO_STACK_LOCATION

IO_STATUS_BLOCK

IoCheckEaBufferValidity

IoGetCurrentIrpStackLocation

IRP

IRP_MJ_SET_INFORMATION

ZwQueryInformationFile

Send comments about this topic to Microsoft