UMDF Control Requests

Hi,
My UMDF driver, based on the FX2 sample, is supposed to get a message from the firmware and return a SET_INTERFACE command to the USB (in order to change its alt settings).
I cannot use the interrupt pipe to get messages from the FW (as in the FX2), because it functions as HID and communicates directly with the HID driver.
And besides, I think its more appropriate that it should be a control messages.
The main question is - how do I send an IOCTL from the device to the host?
I thought of a few ways - please let me know which one is the most correct and easy to implement:

  1. In the end of the device configuration process, I will do a WINUSB_CONTROL_SETUP_PACKET_INIT and then a SendControlTransferSynchronously.
    The problem is, I don’t have access here to the output buffer, and I cannot allocate one of my own which the driver will relate to as the output buffer.
  2. Because I didn’t have a buffer - I tried to “ride” on the IOCTL_OSRUSBFX2_GET_CONFIG_DESCRIPTOR case in the control code switch. I tried re using the buffer which was used for getting the descriptor (without releasing the memory first). It failed, but i can’t tell why because i could not stop at a bp here (could be because it’s right after the enumeration process and the device cannot send a message yet).
  3. Maybe there is an opposite method for CMyControlQueue::OnDeviceIoControl which handles requests coming from the device? This way I will be able send messages on the control ep from the device to the host without being polled?
  4. Maybe I should add a read polling thread which poles on the control ep? Or send the message on the bulk pipe, and instead of OnRead of CMyReadWriteQueue I will add a thread which poles on the bulk ep and then transfers the message to CMyReadWriteQueue ?
    The difference between the other situation I handled so far was that previously the IOCTLS were initiated only from the application by DeviceIoControl (besides GET_DESCRIPTOR, which I don’t know who initiates it, and understanding it may help me solve my current issue), in my current situation I deal with events which happen internally in the driver or from the firmware side, and not from the app side.
    So my bottom line question is how do I send a message from the device to the host without being polled for it, or, alternatively, how do create an internal request, which creates an IOCTL to the device? Will one of the scenarios above work?
    Thanks,
    Gadi