How to start a Windows Service from EvtDriverDeviceAdd

NTDEV
1

I’d like to add the following functionality to my Driver (KMDF, Software only, Filter):

  1. Whenever the device enabled(=EvtDriverDeviceAdd called?) I want my Windows Service to start.
  2. Whenever the device is Disabled, I want the service to stop.
    Is there any mechanism to link between a WDF driver and the service control manager (SCM)?
2

On 19-Jan-2012 12:14, xxxxx@gmail.com wrote:

I’d like to add the following functionality to my Driver (KMDF, Software only, Filter):

  1. Whenever the device enabled(=EvtDriverDeviceAdd called?) I want my Windows Service to start.
  2. Whenever the device is Disabled, I want the service to stop.
    Is there any mechanism to link between a WDF driver and the service control manager (SCM)?

http://msdn.microsoft.com/en-us/library/windows/desktop/dd405513(v=vs.85).aspx

The service trigger condition SERVICE_TRIGGER_TYPE_DEVICE_INTERFACE_ARRIVAL
is your friend.

– pa

3

Note this trigger is only for 2008R2+ and Win7+

4

xxxxx@gmail.com wrote:

I’d like to add the following functionality to my Driver (KMDF, Software only, Filter):

  1. Whenever the device enabled(=EvtDriverDeviceAdd called?) I want my Windows Service to start.
  2. Whenever the device is Disabled, I want the service to stop.
    Is there any mechanism to link between a WDF driver and the service control manager (SCM)?

The triggers mentioned by Pavel are only available in Win 7 and later,
which may be an issue for you.

Why wouldn’t you just start the service at boot time and leave it
running? The service can register for PNP events to find out when your
device loads (by checking for device interface changes), and stay idle
the rest of the time. It won’t use any resources, except for a bit of
page file.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

5

It sounds to me like you are taking a simple problem and making it a
complex problem.

Start the service and wait for the notification that the device has been
plugged in. When this occurs, it can do whatever it needs to do.
joe

I’d like to add the following functionality to my Driver (KMDF, Software
only, Filter):

  1. Whenever the device enabled(=EvtDriverDeviceAdd called?) I want my
    Windows Service to start.
  2. Whenever the device is Disabled, I want the service to stop.
    Is there any mechanism to link between a WDF driver and the service
    control manager (SCM)?

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

> Is there any mechanism to link between a WDF driver and the service control manager (SCM)?

No. I think no common OS has the mechanism to start processes (except /sbin/init or SMSS) from kernel mode. The reason is that too much info must be provided for a process to be a good citizen in the OS’s running process/session/process group tree, which usually requires the notion of the “parent process” to do this.

Start the service forever, and make it listen for device arrival notifications
OR
Write 2 services, one small, another large, so that only the small service runs forever and starts the large one when needed
OR
Start the driver from the service, not the service from the driver. To start a PnP driver, enable its devnode using SetupDiCallClassInstaller with proper function code.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

7

> Note this trigger is only for 2008R2+ and Win7+

So what?

There was an older w2k+ mechanism to do the same - i.e. to use the ScMgr’s event handler callback to listen for PnP notifications. Actually a replacement of WM_DEVICECHANGE, which uses SC’s handler callback and not HWNDs.

Surely it worked for me on w2k/XP/2003, just note that all strings passed to this mechanism are always Unicode (not T-strings).

Service triggers are all new. But the service event handler callback is old.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

8

Your responces guys where very educative. I think the correct solution in my case will be to divide my task into a few sub-modules:

  1. Device Driver.
  2. Automaticly starting ‘Launchpad’ service (the one Maxim called ‘small service’). This service will run forever and detect changes in the driver. It will also launch an interface application when the driver is running. The interface application will enable the user to tell the small aplication to start the 3. Worker Service (the one Maxim called ‘large service’).
    Worker Service(s): This is where the real work is done. These services will be started and stopped by the ‘Launchpad’ service according to the state of the driver and the commands received from the interface application.
  3. Interface application. Used as an interface to the ‘launchpad’ service.

I think that the service should not be able to stop the driver as theoretically the driver may be in use by another user-mode software.
The ‘Launchpad’ service can wait forever for a command from the Interface application or the driver. This will consume minimal resources.
The reasons that I tend to go for this rather complicated setup rather than just one application that communicates with the driver are:

  1. I need this ‘application’ to run in the background with no (or minimal) user intervention. By default, the user does not have to be aware of it. Hence, most of the functionality is preferably a service.
  2. I do want to alow the sophisticated user to configure the behaviour of the ‘application’ and even to be able to turn it off. Hence I need some GUI added.
  3. I must control the ‘application’ behaviour based on the availability of the driver. This is why I need to split it into two or more services since restarting a service is possible only from W7 and up. On Vista, I’ll need a small service to be kept alive in order to get notifications from the driver.

I’ll be happy to discuss this issue further (I have no hidden parts - I write Open Source) if any of you may care to comment. Thank you all very much.