IRP_MJ_QUERY_EA (FS and filter drivers)

Article
03/14/2023

When Sent

The I/O Manager, other operating system components, and other kernel-mode drivers send IRP_MJ_QUERY_EA requests when a user-mode application has requested information about a file's extended attributes.

Operation: File System Drivers

If the file system supports extended attributes, the file system driver should process the query and complete the IRP. Otherwise, it should return STATUS_EAS_NOT_SUPPORTED.

Operation: Legacy File System Filter Drivers

The filter driver should pass this IRP down to the next-lower driver on the stack.

Parameters

A file system or filter driver calls IoGetCurrentIrpStackLocation for the given IRP to get a pointer to its own stack location in the IRP. In the following parameters, Irp points to the IRP and IrpSp points to the IO_STACK_LOCATION. The driver can use the information that is set in the following members of the IRP and the IRP stack location to process an IRP_MJ_QUERY_EA request:

DeviceObject is a pointer to the target device object.
Irp->AssociatedIrp.SystemBuffer points to a system-supplied output buffer to be used as an intermediate system buffer. Used for METHOD_BUFFERED I/O.
Irp->IoStatus points to an IO_STATUS_BLOCK structure that receives the final completion status and information about the requested operation.
Irp->MdlAddress is the address of a memory descriptor list (MDL) describing an output buffer that receives the extended attribute information. Used for METHOD_DIRECT I/O.
Irp->UserBuffer points to a caller-supplied FILE_FULL_EA_INFORMATION-structured output buffer that receives the extended attribute information. Used for METHOD_NEITHER I/O.
IrpSp->FileObject points to the file object that is associated with DeviceObject.

The IrpSp->FileObject parameter contains a pointer to the RelatedFileObject field, which is also a FILE_OBJECT structure. The RelatedFileObject field of the FILE_OBJECT structure isn't valid during the processing of IRP_MJ_QUERY_EA and shouldn't be used.
IrpSp->Flags can be one or more of the following values.

Flag	Meaning
SL_INDEX_SPECIFIED	Begin the scan at the entry in the extended attribute list whose index is given by IrpSp->Parameters.QueryEa.EaIndex.
SL_RESTART_SCAN	Begin the scan at the first entry in the list. If this flag isn't set, resume the scan from a previous IRP_MJ_QUERY_EA request.
SL_RETURN_SINGLE_ENTRY	Return only the first entry that is found.

IrpSp->MajorFunction is set to IRP_MJ_QUERY_EA.
IrpSp->Parameters.QueryEa.EaIndex is the index of the entry at which to begin scanning the extended-attribute list. This parameter is ignored if the SL_INDEX_SPECIFIED flag isn't set or if IrpSp->Parameters.QueryEa.EaList points to a nonempty list.
IrpSp->Parameters.QueryEa.EaList points to a caller-supplied FILE_GET_EA_INFORMATION-structured input buffer specifying the extended attributes to be queried.
IrpSp->Parameters.QueryEa.EaListLength is the length in bytes of the buffer pointed to by IrpSp->Parameters.QueryEa.EaList.
IrpSp->Parameters.QueryEa.Length is the length in bytes of the output buffer.

Remarks

When a short buffer is supplied and STATUS_BUFFER_OVERFLOW is returned, NTFS returns the last whole FILE_FULL_EA_INFORMATION entry that fits. When a short buffer is supplied and STATUS_BUFFER_TOO_SMALL is returned, NTFS couldn't fit any FILE_FULL_EA_INFORMATION entries.

On Windows Vista and later, FAT16 no longer supports extended attributes.