Operations That Can Be IRP-Based or Fast I/O
The following types of operations can be IRP-based or fast I/O operations:
IRP_MJ_DEVICE_CONTROL. (Note that IRP_MJ_INTERNAL_DEVICE_CONTROL is always IRP-based.)
IRP_MJ_QUERY_INFORMATION. This operation can be fast I/O if the FileInformationClass parameter is FileBasicInformation, FileStandardInformation, or FileNetworkOpenInformation.
IRP_MJ_READ. Minifilter drivers can set the FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO flag in the FLT_OPERATION_REGISTRATION structure to avoid receiving fast I/O IRP_MJ_READ operations and cached IRP-based reads.
IRP_MJ_WRITE. Minifilter drivers can set the FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO flag in the FLT_OPERATION_REGISTRATION structure to avoid receiving fast I/O IRP_MJ_WRITE operations and cached IRP-based writes.
When any of these operations is a fast I/O operation, it always uses neither buffered nor direct I/O, even if the equivalent IRP-based operation uses a different buffering method.
When IRP_MJ_DEVICE_CONTROL is a fast I/O operation, it always uses neither buffered nor direct I/O, regardless of the IOCTL's transfer type.
Although IRP_MJ_LOCK_CONTROL can be an IRP-based or fast I/O operation, it has no buffers.