Send UDP @ D0 exit

Newbie posting for the first time, so please be forgiving. We have an external board connected to our win 10 machine. When windows is shuting down (Power off) we need to send an UDP message to the external board (i.e. an power off message). Detecting when windows powers off in user space appears to be almost impossible (we don’t want to send the message if windows merely restarts). Anyway, I am exploring the possiblity to write a device driver that sends this message at D0 exit. My question is now: Is this to late when regarding other device drivers, is TCP/IP still up and running at this time? And finally do I need to develop a kernel mode device driver or is an user mode device driver enough.
Thanks in advance or any answers.

There is no guarantee that the networking stack is still up when your driver powers down. Have you looked at how feasible this is from an NT service?

Bent from my phone


From: xxxxx@lists.osr.com on behalf of xxxxx@spray.se
Sent: Tuesday, January 16, 2018 5:32:53 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Send UDP @ D0 exit

Newbie posting for the first time, so please be forgiving. We have an external board connected to our win 10 machine. When windows is shuting down (Power off) we need to send an UDP message to the external board (i.e. an power off message). Detecting when windows powers off in user space appears to be almost impossible (we don’t want to send the message if windows merely restarts). Anyway, I am exploring the possiblity to write a device driver that sends this message at D0 exit. My question is now: Is this to late when regarding other device drivers, is TCP/IP still up and running at this time? And finally do I need to develop a kernel mode device driver or is an user mode device driver enough.
Thanks in advance or any answers.


NTDEV is sponsored by OSR

Visit the list online at: https:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at https:

To unsubscribe, visit the List Server section of OSR Online at https:</https:></https:></https:>

xxxxx@spray.se wrote:

Newbie posting for the first time, so please be forgiving. We have an external board connected to our win 10 machine. When windows is shuting down (Power off) we need to send an UDP message to the external board (i.e. an power off message). Detecting when windows powers off in user space appears to be almost impossible (we don’t want to send the message if windows merely restarts).

How is your device connected to the Windows machine?  It would be a much
more reliable solution to use some hardware signal that power is being
removed.  If you have a PCIe connector or a USB connector, those can
both signal you when power is removed.

If the only connection is Ethernet, then how does your board get powered
on?  If power on is a manual procedure, then shouldn’t power off be a
manual procedure?


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Another option would be to send packets whenever the computer is NOT shutting down. By process of elimination, you can detect whenever the computer isn’t running. This approach is guaranteed to detect orderly shutdown, power accidentally unplugged, bugcheck, deadlock, livelock, paging death, network cable disconnect, etc.

You also don’t have to write that code yourself – plenty of software stacks have added a watchdog/heartbeat type feature. E.g., the LLDP protocol (which Windows includes built-in, but doesn’t have particularly great APIs for).

One little misconception: NDIS drivers do not exit D0 upon system shutdown. The driver instead remains in D0, right up to the moment where the system enters S5, and the CPU stops running driver code.

If you do want to send a packet only when the computer is shutting down, it’s a little tricky to do from kernel mode. NDIS notifies the NIC driver when the system shuts down, but it doesn’t notify the rest of the protocol stack. You’ll have to subscribe for your own notifications. Do not use IoRegisterShutdownNotification, since that notification will race with the notification sent to the NIC, and it’s not certain that you’ll be able to transmit that goodbye packet. Instead, you can either create a device and listen for IRP_MN_QUERY_POWER or subscribe to \Callback\PowerState, and look for (say) PO_CB_SYSTEM_STATE_LOCK.

Alternatively, you can send the packet from usermode. A simple win32 exe can listen for WM_ENDSESSION. Or you can write an NT service and RegisterServiceCtrlHandlerEx. With an NT service, at least, you can distinguish S3 from S4/S5. But I don’t know how to distinguish S4 from S5, if that’s important. (If this is *your* computer, you can just disable S4 by policy – problem solved!)

Let me try to explain how the system connects. The power switch is connected in parallel to both the PC and external board, and both the PC and the external board is powered by 12 Volt that is always on. In addition, there is a hardware signal connected between the boards (called PC sense). This wire is connected to USB power on the PC side and as an input on the FPGA on the external board. The problem today is that when the user powers off the PC, the PC sense signal is not going low until the PC is off. Between the time the PC turns off and the external board powers down (the external board runs Linux) there is a possibility that the users pushes the power on button. In this case the result is that the PC goes up and the Linux box enters power down. One possible solution would be that we attach an USB to parallel chip to the PC sense USB port. This would enable us to steer the PC sense signal from the PC via a device driver, but foremost we would like to have a software only solution if possible. A windows service will not work unless we can tell the difference between S4 and S5. I hope this makes it a little bit clearer.