IRP_MN_QUERY_ALL_DATA
All drivers that support WMI must handle this IRP. A driver can handle WMI IRPs either by calling WmiSystemControl or by handling the IRP itself, as described in Handling WMI Requests.
If a driver calls WmiSystemControl to handle an IRP_MN_QUERY_ALL_DATA request, WMI in turn calls that driver's DpWmiQueryDataBlock routine.
Major Code
When Sent
WMI sends this IRP to query for all instances of a given data block.
WMI sends this IRP at IRQL = PASSIVE_LEVEL in an arbitrary thread context.
Input Parameters
Parameters.WMI.ProviderId in the driver's I/O stack location in the IRP points to the device object of the driver that should respond to the request.
Parameters.WMI.DataPath points to a GUID that identifies the data block.
Parameters.WMI.BufferSize indicates the maximum size of the nonpaged buffer at Parameters.WMI.Buffer, which receives output data from the request. The buffer size must be greater than or equal to sizeof(WNODE_ALL_DATA) plus the sizes of instance names and data for all instances to be returned.
Output Parameters
If the driver handles WMI IRPs by calling WmiSystemControl, WMI fills in a WNODE_ALL_DATA by calling the driver's DpWmiQueryDataBlock routine once for each block registered by the driver.
Otherwise, the driver fills in a WNODE_ALL_DATA structure at Parameters.WMI.Buffer as follows:
Sets WnodeHeader.BufferSize to the number of bytes of the entire WNODE_ALL_DATA to be returned, sets WnodeHeader.Timestamp to the value returned by KeQuerySystemTime, and sets WnodeHeader.Flags as appropriate for the data to be returned.
Sets InstanceCount to the number of instances to be returned.
If the block uses dynamic instance names, sets OffsetInstanceNameOffsets to the offset in bytes from the beginning of the WNODE_ALL_DATA to where an array of ULONG offsets begins. Each element in this array is the offset from the WNODE_ALL_DATA to where each dynamic instance name is stored. Each dynamic instance name is stored as a counted Unicode string where the count is a USHORT followed by the Unicode string. The count does not include any terminating null character that may be part of the Unicode string. If the Unicode string does include a terminating null character, this null character must still fit within the size established in WNodeHeader.BufferSize.
If all instances are the same size:
- Sets WNODE_FLAG_FIXED_INSTANCE_SIZE in WnodeHeader.Flags and sets FixedInstanceSize to that size, in bytes.
- Writes instance data starting at DataBlockOffset, with padding so that each instance is aligned to an 8-byte boundary. For example, if FixedInstanceSize is 6, the driver adds 2 bytes of padding between instances.
If instances vary in size:
Clears WNODE_FLAG_FIXED_INSTANCE_SIZE in WnodeHeader.Flags and writes an array of InstanceCount OFFSETINSTANCEDATAANDLENGTH structures starting at OffsetInstanceDataAndLength. Each OFFSETINSTANCEDATAANDLENGTH structure specifies the offset in bytes from the beginning of the WNODE_ALL_DATA structure to the beginning of the data for each instance, and the length of the data. DataBlockOffset is not used.
Writes instance data following the last element of the OffsetInstanceDataAndLength array, plus padding so that each instance is aligned to an 8-byte boundary.
If the buffer at Parameters.WMI.Buffer is too small to receive all of the data, a driver fills in the needed size in a WNODE_TOO_SMALL structure at Parameters.WMI.Buffer. If the buffer is smaller than sizeof(WNODE_TOO_SMALL), the driver fails the IRP and returns STATUS_BUFFER_TOO_SMALL.
I/O Status Block
If the driver handles the IRP by calling WmiSystemControl, WMI sets Irp->IoStatus.Status and Irp->IoStatus.Information in the I/O status block.
Otherwise, the driver sets Irp->IoStatus.Status to STATUS_SUCCESS or to an appropriate error status such as the following:
STATUS_BUFFER_TOO_SMALL
STATUS_WMI_GUID_NOT_FOUND
On success, a driver sets Irp->IoStatus.Information to the number of bytes written to the buffer at Parameters.WMI.Buffer.
Operation
A driver can handle WMI IRPs either by calling WmiSystemControl or by handling the IRP itself, as described in Handling WMI Requests.
If a driver handles WMI IRPs by calling WmiSystemControl, that routine calls the driver's DpWmiQueryDataBlock routine.
If a driver handles an IRP_MN_QUERY_ALL_DATA request, it should do so only if Parameters.WMI.ProviderId points to the same device object that the driver passed to IoWMIRegistrationControl. Otherwise, the driver must forward the request to the next-lower driver.
Before handling the request, the driver must determine whether Parameters.WMI.DataPath points to a GUID that the driver supports. If not, the driver must fail the IRP and return STATUS_WMI_GUID_NOT_FOUND.
If the driver supports the data block, it must do the following:
Verify that Parameters.WMI.BufferSize specifies a buffer that is large enough to receive all the data that the driver will return.
Fill in a WNODE_ALL_DATA structure at Parameters.WMI.Buffer with data for all instances of that data block.
Requirements
Header |
Wdm.h (include Wdm.h, Ntddk.h, or Ntifs.h) |
See also
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for