Driver Services

A service is an application that runs as a background process, rather than being under the direct control of an interactive user. Services are long-running executable applications that run in their own Windows sessions and execute even when no user is logged on to the system. Services run in the security context of three predefined user accounts - System, Network Service and Local Service, or any specific user account that may be different from the logged-on user or the default computer account.

A service application conforms to the interface rules of the Service Control Manager (SCM). It can be started automatically at system boot, by a user through the Services control panel applet, or by an application that uses the service functions. A driver service conforms to the device driver protocols. It is similar to a service application, but it does not interact with the SCM.

The HKLM\SYSTEM\CurrentControlSet\Services registry Key stores information about each service on the system that govern the startup and running of Windows Services.

  1. ServiceType Specifies the type of service as follows:

    • SERVICE_KERNEL_DRIVER (0x1) - Kernel device driver.
    • SERVICE_WIN32_OWN_PROCESS - Microsoft Win32 service that is installed for a device.
    • SERVICE_WIN32_SHARE_PROCESS (0x20) - A Win32 service that can share a process with other Win32 services.
    • SERVICE_INTERACTIVE_PROCESS - Win32 service which can interact with the desktop.
    • SERVICE_FILE_SYSTEM_DRIVER - Highest level network driver, such as a redirector, or a file system driver.
  2. ServiceName Each driver has a key of the form HKLM\SYSTEM\CurrentControlSet\Services\DriverName. The PnP manager passes this path of a driver in the RegistryPath parameter when it calls the driver's DriverEntry routine. A driver can store global driver-defined data under its key in the Services tree. Information that is stored under this key is available to the driver during its initialization.

  3. DisplayName Specifies a friendly name for the service/driver

  4. DescriptionThis string gives the user more information about the service

  5. StartType Specifies when to start the driver. SERVICE_BOOT_START Indicates a driver started by the operating system loader. This value must be used for drivers of devices required for loading the operating system. SERVICE_SYSTEM_START Indicates a driver started during operating system initialization. This value should be used by PnP drivers that do device detection during initialization but are not required to load the system. SERVICE_AUTO_START Indicates a driver started by the service control manager during system startup. This value should never be used in the INF files for WDM or PnP device drivers. SERVICE_DEMAND_START Indicates a driver started on demand, either by the PnP manager when the corresponding device is enumerated or possibly by the service control manager in response to an explicit user demand for a non-PnP device. This value should be used in the INF files for all WDM drivers of devices that are not required to load the system and for all PnP device drivers that are neither required to load the system nor engaged in device detection. SERVICE_DISABLED Indicates a driver that cannot be started. This value can be used to temporarily disable the driver services for a device. However, a device/driver cannot be installed if this value is specified in the service-install section of its INF file.

  6. Dependencies Each depend-on-item-name item in a dependencies list specifies the name of a service or load-order group on which the device/driver depends. If the depend-on-item-name specifies a service, the service that must be running before this driver is started. A depend-on-item-name can specify a load order group on which this device/driver depends. Such a driver is started only if at least one member of the specified group was started.

  7. ImagePath A value entry that specifies the fully qualified path of the driver's image file. Windows creates this value by using the requiredServiceBinary entry in the driver's INF file. This entry is in the service-install-section referenced by the driver's INF AddService directive. A typical value for this path is %SystemRoot%\system32\Drivers\DriverName.sys, where DriverName is the name of the driver's Serviceskey.

  8. Parameters A key that is used to store driver-specific data. For some types of drivers, the system expects to find specific value entries. You can add value entries to this subkey using AddReg entries in the driver's INF file.
  9. Performance A key that specifies information for optional performance monitoring. The values under this key specify the name of the driver's performance DLL and the names of certain exported functions in that DLL. You can add value entries to this subkey using AddReg entries in the driver's INF file.

Specifying Driver Load Order

The operating system loads drivers according to the service-install-section StartType value, as follows:

  • During the system boot start phase, the operating system loads all (SERVICE_BOOT_START) drivers.
  • During the system start phase, the operating system first loads all WDM and PnP drivers for which the PnP manager finds device nodes (devnodes) in the registry ..\Enum tree (whether their INF files specify SERVICE_SYSTEM_START or SERVICE_DEMAND_START).Then the operating system loads all remaining SERVICE_SYSTEM_START drivers.
  • During the system auto-start phase, the operating system loads all remaining SERVICE_AUTO_START drivers.