PnpSurpriseRemove rule (wdm)

The PnpSurpriseRemove rule specifies that the driver does not call IoDeleteDevice or IoDetachDevice while processing an IRP_MN_SURPRISE_REMOVAL request.

The PnP manager sends the IRP_MN_SURPRISE_REMOVAL request to notify drivers that a device is no longer available for I/O operations and that it has probably been unexpectedly removed from the computer.

• All PnP drivers must handle IRP_MN_SURPRISE_REMOVAL request.
• The driver must not call IoDeleteDevice or IoDetachDevice on device objects until the IRP_MN_SURPRISE_REMOVAL IRP succeeds and all open handles to the device are closed.
• The PnP manager then sends an IRP_MN_REMOVE_DEVICE request to the device stack. In response to the remove IRP, drivers detach their device objects from the stack and delete them.

For more information about how a driver should respond to IRP_MN_SURPRISE_REMOVAL request, see Handling an IRP_MN_SURPRISE_REMOVAL Request

Driver model: WDM

How to test

At compile time
Run Static Driver Verifier and specify the PnpSurpriseRemove rule. Use the following steps to run an analysis of your code: Prepare your code (use role type declarations). Run Static Driver Verifier. View and analyze the results. For more information, see Using Static Driver Verifier to Find Defects in Drivers.

Applies to

IoDeleteDevice IoDetachDevice

See also

Handling an IRP_MN_SURPRISE_REMOVAL Request Analyzing a Driver Using Verification and Code Analysis Tools IRP_MN_SURPRISE_REMOVAL IRP_MN_REMOVE_DEVICE