WMI event enabled before explicit consumer starts

NTDEV
1

Hi,

I have a driver that needs to talk to some user mode code by firing WMI
events.

The DDK docs say the event GUID should not be enabled by the OS until any
consumer of this event is actually looking for the event (via
IRP_MN_ENABLE_EVENTS). Since it’s a custom event and GUID, my user mode app
(currently a chunk of script code) should be the only consumer. What I’m
seeing is the event GUID is enabled almost immediately after driver start,
and events get fired and lost before my user mode app is even up and
running. What I want is the event to not get enabled in the driver until the
user mode code is listening, and using the IRP_MN_ENABLE_EVENTS to cause the
driver to fire all events that happened before the user mode app was
listening, effectively syncing the user mode app with the current state in
the driver.

Is immediate enabling of all WMI events expected behavior in a driver and
the docs are just a little bit inaccurate, or am I setting/not setting
something needed to get delayed event activation?

  • Jan
2

Quoting Jan Bottorff :

I do not think your driver should try to send events until it has been notified
that it can. Create flag. Set flag according to your WmiEventControl handler.
Then your event firing routine should fail itself if the flag says so.

> Hi,
>
>
>
> I have a driver that needs to talk to some user mode code by firing WMI
> events.
>
>
>
> The DDK docs say the event GUID should not be enabled by the OS until any
> consumer of this event is actually looking for the event (via
> IRP_MN_ENABLE_EVENTS). Since it’s a custom event and GUID, my user mode app
> (currently a chunk of script code) should be the only consumer. What I’m
> seeing is the event GUID is enabled almost immediately after driver start,
> and events get fired and lost before my user mode app is even up and
> running. What I want is the event to not get enabled in the driver until the
> user mode code is listening, and using the IRP_MN_ENABLE_EVENTS to cause the
> driver to fire all events that happened before the user mode app was
> listening, effectively syncing the user mode app with the current state in
> the driver.
>
>
>
> Is immediate enabling of all WMI events expected behavior in a driver and
> the docs are just a little bit inaccurate, or am I setting/not setting
> something needed to get delayed event activation?
>
>
>
> - Jan
>
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

–

3

what is the full callstack when you are getting the enable that is not coming from your app? you might have to run a .reload in the context of that enable call to see the UM stack (if one is present).

d