IRP_MJ_FILE_SYSTEM_CONTROL
Download EaseFilter Filter Driver SDK Setup File Download EaseFilter Filter Driver SDK Zip File
When Sent
The IRP_MJ_FILE_SYSTEM_CONTROL request is sent by the I/O Manager and other operating system components, as well as other kernel-mode drivers. It can be sent, for example, when a user-mode application has called the Microsoft Win32 DeviceIoControl function to send a file system I/O control (FSCTL) request.
Operation: File System Drivers
The file system driver or recognizer should check the minor function code to determine which file system control operation is requested.
File system drivers should handle the following minor function codes:
| Code | Description |
|---|---|
IRP_MN_KERNEL_CALL |
This request is the same as IRP_MN_USER_FS_REQUEST (described following), except that the source of the request is a trusted kernel component. |
IRP_MN_MOUNT_VOLUME |
Indicates a volume mount request. If a file system driver receives this IRP for a volume whose format does not match that of the file system, the file system driver should return STATUS_UNRECOGNIZED_VOLUME. |
IRP_MN_USER_FS_REQUEST |
Indicates an FSCTL request, possibly on behalf of a user-mode application that has called the Microsoft Win32 DeviceIoControl function or on behalf of a kernel-mode component that has called ZwDeviceIoControlFile or IoBuildDeviceIoControlRequest. For detailed information about FSCTL requests, see "Device Input and Output Control Codes" in the Microsoft Windows SDK documentation. |
IRP_MN_VERIFY_VOLUME |
Indicates a volume verification request. For removable media, the file system must verify the volume when it detects that the media has been removed and returned to ensure that it is still the same volume that the file system was previously working with. If the volume has changed, the file system should invalidate all outstanding handles. It will also return an error if the file system on this new media has changed. This request is most often used for floppy drives. |
File system recognizers must handle the following minor function code:
| Code | Description |
|---|---|
IRP_MN_LOAD_FILE_SYSTEM |
Indicates a load-file system request. |
After performing the requested operation, the file system driver or recognizer should complete the IRP.
Operation: Files System Filter Drivers
The filter driver should pass this IRP down to the next-lower driver on the stack.
Parameters
A file system or filter driver calls IoGetCurrentIrpStackLocation with the given IRP to get a pointer to its own stack location in the IRP, shown in the following list as IrpSp. (The IRP is shown as Irp.) The driver can use the information that is set in the following members of the IRP and the IRP stack location in processing a file system control request:
DeviceObject
Pointer to the target device object.
Irp->AssociatedIrp.SystemBuffer
Pointer to a system-supplied input buffer to be passed to the file system or file system filter driver for the target volume. Used for METHOD_BUFFERED or METHOD_DIRECT I/O. Whether this parameter is required depends on the specific file system control code.
Irp->IoStatus
Pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the requested operation.
Irp->MdlAddress
Address of a memory descriptor list (MDL) describing an output buffer to be passed to the file system or file system filter driver for the target volume. Used for METHOD_DIRECT I/O. Whether this parameter is required depends on the specific I/O control code.
Irp->UserBuffer
Pointer to a caller-supplied output buffer to be passed to the file system or file system filter driver for the target volume. Used for METHOD_BUFFERED or METHOD_NEITHER I/O. Whether this parameter is optional or required depends on the specific I/O control code.
IrpSp->FileObject
Pointer to the file object that is associated with DeviceObject.
The IrpSp->FileObject parameter contains a pointer to the RelatedFileObject field, which is also a FILE_OBJECT structure. The RelatedFileObject field of the FILE_OBJECT structure is not valid during the processing of IRP_MJ_FILE_SYSTEM_CONTROL and should not be used.
IrpSp->Flags
The following flag can be set for IRP_MN_VERIFY_VOLUME:
SL_ALLOW_RAW_MOUNT
IrpSp->MajorFunction
Specifies IRP_MJ_FILE_SYSTEM_CONTROL.
IrpSp->MinorFunction
One of the following:
- IRP_MN_KERNEL_CALL
- IRP_MN_LOAD_FILE_SYSTEM
- IRP_MN_MOUNT_VOLUME
- IRP_MN_USER_FS_REQUEST
- IRP_MN_VERIFY_VOLUME
IrpSp->Parameters.FileSystemControl.FsControlCode
FSCTL function code to be passed to the file system or file system filter driver for the target volume. For use with IRP_MN_USER_FS_REQUEST only.
For detailed information about IOCTL and FSCTL requests, see Using I/O Control Codes in the Kernel Mode Architecture Guide and "Device Input and Output Control Codes" in the Microsoft Windows SDK documentation.
IrpSp->Parameters.FileSystemControl.InputBufferLength
Size in bytes of the buffer pointed to by Irp->AssociatedIrp.SystemBuffer.
IrpSp->Parameters.FileSystemControl.OutputBufferLength
Size in bytes of the buffer pointed to by Irp->UserBuffer.
IrpSp->Parameters.FileSystemControl.Type3InputBuffer
Input buffer for kernel-mode requests using METHOD_NEITHER.
IrpSp->Parameters.MountVolume.DeviceObject
Pointer to the device object for the actual device on which the volume is to be mounted. File system filter drivers should not use this parameter.
IrpSp->Parameters.MountVolume.Vpb
Pointer to the volume parameter block (VPB) for the volume to be mounted. File systems that support removable media might substitute a previously used VPB for the one passed in this parameter. On such file systems, after the volume is mounted, this pointer can no longer be assumed to be valid. File system filter drivers that filter these file systems should use this parameter as follows: Before sending the IRP down to lower-level drivers, the filter should save the value of IrpSp->Parameters.MountVolume.Vpb->RealDevice. After the volume is successfully mounted, the filter can use this pointer to the storage device object to obtain the correct VPB pointer.
IrpSp->Parameters.VerifyVolume.DeviceObject
Pointer to the device object for the volume to be verified.
IrpSp->Parameters.VerifyVolume.Vpb
Pointer to the VPB for the volume to be verified.