FsRtlQueryKernelEaFile function (ntifs.h)

Article
02/22/2024

The routine FsRtlQueryKernelEaFile is used to build an explicit QueryEA request and synchronously wait for it to complete, returning the result. This allows the caller to do this by FileObject instead of a handle.

Syntax

NTSTATUS FsRtlQueryKernelEaFile(
  [in]            PFILE_OBJECT FileObject,
  [out]           PVOID        ReturnedEaData,
  [in]            ULONG        Length,
  [in]            BOOLEAN      ReturnSingleEntry,
  [in]            PVOID        EaList,
  [in]            ULONG        EaListLength,
  [in, optional]  PULONG       EaIndex,
  [in]            BOOLEAN      RestartScan,
  [out, optional] PULONG       LengthReturned
);

Parameters

[in] FileObject

A pointer to a FileObject to send the QueryEA request to.

[out] ReturnedEaData

A pointer to a caller-supplied FILE_FULL_EA_INFORMATION-structured output buffer, where the extended attribute values are to be returned.

[in] Length

Specifies the length, in bytes, of ReturnedEaData

[in] ReturnSingleEntry

Specifies whether only a single entry should be returned rather than filling the buffer with as many EAs as possible.

[in] EaList

A pointer to a caller-supplied FILE_GET_EA_INFORMATION-structured input buffer, which specifies the extended attributes to be queried. This parameter is optional and can be NULL.

[in] EaListLength

Specifies the length of EaList, if an EA list was supplied.

[in, optional] EaIndex

Supplies the optional index of an EA whose value is to be returned. If specified, then only that EA is returned.

[in] RestartScan

Specifies whether the scan of the EAs should be restarted from the beginning.

[out, optional] LengthReturned

Specifies the amount of valid data that is returned in the ReturnedEaData buffer.

Return value

The routine FsRtlQueryKernelEaFile returns one of the status codes:

Return code	Description
STATUS_EAS_NOT_SUPPORTED	The file system does not support extended attributes.
STATUS_INVALID_DEVICE_REQUEST	The request failed as it was a direct device open.
STATUS_INSUFFICIENT_RESOURCES	The I/O request packet (IRP) could not be allocated for this request.
STATUS_SUCCESS	The request was successful.

Remarks

This routine FsRtlQueryKernelEaFile assumes all passed in buffers are from kernel mode as it requires that the given Input and Output buffers if specified, be kernel mode addresses. The operation will fail if a user mode address is specified.

Requirements

Requirement	Value
Minimum supported client	Windows 8
Minimum supported server	Windows Server 2012
Target Platform	Windows
Header	ntifs.h

Share via