Surprise Removal and User mode driver crash

Hi,

We have developed a WBF driver for fingerprint. Occasionally we are observing below issue.
Details are from event viewer

  1. Surprise removal
    USB device draining system power when system is idle.
    Removal action failed: SkippedAsPersistentIoObserved
    Source : USB-USBHUB3
    Task category: Surprise Removal

then crash event
2. A problem has occurred with one or more user-mode drivers and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices.
Task category: User-mode Driver problems.

Not able to capture details in the driver logs.
How to find the root cause ? What could be possible issue.
Please help.

Regards,
Umesh

There are quite a few reasons for a surprise removal event, all of which are outside of your control. I would first see if you can get a surprise removal notification from the PnP stack (UMDF v2 drivers can) and also firewall your driver to be able to handle resources that go away (try/ catch, device interface notifications, etc.) … is the crash happening in your WBF driver, or somewhere else in the stack?

How I can check whether crash happened in the WBF driver?

Attach a kernel mode debugger through windbg.exe and an external cable such as USB, Ethernet or a similar connection.

With the kernel mode debugger attached, see what the result is from !analyze -v

Since this is a UMDF driver, you probably also want to add calls to DebugBreak and maybe even WPP tracing or calls to OutputDebugString in the driver through the calls to Surprise Removal and possibly other PNP callbacks. In this call:

https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdfdevice/nf-wdfdevice-wdfdeviceinitsetpnppowereventcallbacks

You can implement a callback to SurpriseRemoval through setting the member EvtDeviceSurpriseRemoval in the structure PnpPowerEventCallbacks.