Send Events to a Windows Service from Kernel Mode

Question

I am writing a piece of software that consists of a kernel mode driver and a user mode Windows service. The kernel driver needs to notify the service of different events and information, which the service will then process.

My question is this: What is the best way to set up this communication? I know it is possible to get a message from the kernel using a minifilter and FilterGetMessage(), but this would require polling the kernel for new data. I need a system that lets the kernel notify the service when there is new data to process.

As a side note, the service itself is using the producer consumer pattern, so there will be a thread devoted only to getting data from the kernel and putting into a queue for another set of worker threads to process. Any thoughts on this design are also welcome.

Answer 1

Why not just use ReadFile or DeviceIoControl on the service side? Simple IRP on the driver side, complete it when you have something to report. The service will need to spin up a thread or use an I/O completion callback. And CancelIo to cancel the blocking call when the service exits.