Surprise Removal of Devices

NTDEV
1

Hi,
I’m using KMDF for writing a virtual Bus driver and then creating PDO’s
for devices that can be removed gracefully using the “Safely Remove
Hardware” dialog box or the device can be ripped out at any time. “Just
like USB devices”.
Problem is that when I just rip the device out, I get a Error in Event
Viewer from the PNP Manager. It says the device was removed in an unsafe
manner.
Now this doesn’t seem to happen with regular USB devices (i.e. no event
viewer messages when you remove a flash drive without telling the
system).

I am using the following combination of PnpCaps:
pnpCaps.Removable = WdfTrue;
pnpCaps.EjectSupported = WdfFalse;
pnpCaps.SurpriseRemovalOK = WdfFalse;

If I put SurpriseRemovalOK = WdfTrue, then I don’t even get the Safely
Remove icon in sys tray. But if I use it was False, then I get the error
in Event Viewer.

What am I missing?

thanks
-pankaj

2

You are not missing anything. A Removable device was surprise removed, the event log is telling you as such. If you are marked as Removable and S.R. false, it is unsafe to s.r. the device and the log entry reflects that.

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Pankaj Garg
Sent: Monday, October 29, 2007 11:40 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Surprise Removal of Devices

Hi,
I’m using KMDF for writing a virtual Bus driver and then creating PDO’s
for devices that can be removed gracefully using the “Safely Remove
Hardware” dialog box or the device can be ripped out at any time. “Just
like USB devices”.
Problem is that when I just rip the device out, I get a Error in Event
Viewer from the PNP Manager. It says the device was removed in an unsafe
manner.
Now this doesn’t seem to happen with regular USB devices (i.e. no event
viewer messages when you remove a flash drive without telling the
system).

I am using the following combination of PnpCaps:
pnpCaps.Removable = WdfTrue;
pnpCaps.EjectSupported = WdfFalse;
pnpCaps.SurpriseRemovalOK = WdfFalse;

If I put SurpriseRemovalOK = WdfTrue, then I don’t even get the Safely
Remove icon in sys tray. But if I use it was False, then I get the error
in Event Viewer.

What am I missing?

thanks
-pankaj

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

Thanks Doron.

That’s the thing. I don’t want to get that message in Event Log. Windows
doesn’t do it if you remove USB flash drives.
If I set SurpriseRemoval = True then I don’t get the “Safely Remove
Hardware” option, but no message this time. But I want the "Safely
remove hardware for sure.

It seems like I can’t replicate windows own USB behavior. I can either
get “Safely Remove Hardware” option or I have to live with errors on
Event Viewer.

My original questions actually was to ask if somehow I can fix this
problem and what am I missing…A special function call or some special
flag somewhere that’ll fix it.

-pankaj

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, October 29, 2007 1:47 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Surprise Removal of Devices

You are not missing anything. A Removable device was surprise removed,
the event log is telling you as such. If you are marked as Removable
and S.R. false, it is unsafe to s.r. the device and the log entry
reflects that.

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Pankaj Garg
Sent: Monday, October 29, 2007 11:40 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Surprise Removal of Devices

Hi,
I’m using KMDF for writing a virtual Bus driver and then creating PDO’s
for devices that can be removed gracefully using the “Safely Remove
Hardware” dialog box or the device can be ripped out at any time. “Just
like USB devices”.
Problem is that when I just rip the device out, I get a Error in Event
Viewer from the PNP Manager. It says the device was removed in an unsafe
manner.
Now this doesn’t seem to happen with regular USB devices (i.e. no event
viewer messages when you remove a flash drive without telling the
system).

I am using the following combination of PnpCaps:
pnpCaps.Removable = WdfTrue;
pnpCaps.EjectSupported = WdfFalse;
pnpCaps.SurpriseRemovalOK = WdfFalse;

If I put SurpriseRemovalOK = WdfTrue, then I don’t even get the Safely
Remove icon in sys tray. But if I use it was False, then I get the error
in Event Viewer.

What am I missing?

thanks
-pankaj

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

Pankaj Garg wrote:

That’s the thing. I don’t want to get that message in Event Log. Windows
doesn’t do it if you remove USB flash drives.
If I set SurpriseRemoval = True then I don’t get the “Safely Remove
Hardware” option, but no message this time. But I want the "Safely
remove hardware for sure.

It seems like I can’t replicate windows own USB behavior. I can either
get “Safely Remove Hardware” option or I have to live with errors on
Event Viewer.

My original questions actually was to ask if somehow I can fix this
problem and what am I missing…A special function call or some special
flag somewhere that’ll fix it.

What you are saying, I think, is that you have a device that sometimes
can be safely removed, and sometimes cannot. Windows certainly will
give you an event log message if you yank a flash drive in some
circumstances, like before the data is flushed. You need the “Safely
Remove Hardware” option, but sometimes it’s OK to yank the device
without it.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

5

If you plug in a flash drive in windows, and plug it out while not in
the middle of a transfer, there is no error message in Event Viewer.
I am seeing the error message with my device. I can attribute the error
message to the fact that SurpriseRemoval is set to False. But then if I
set it to True I loose the “Safely Remove Hardware” from system tray.

I wanna have both. Just like normal USB devices…

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tim Roberts
Sent: Monday, October 29, 2007 2:45 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Surprise Removal of Devices

Pankaj Garg wrote:

That’s the thing. I don’t want to get that message in Event Log.
Windows
doesn’t do it if you remove USB flash drives.
If I set SurpriseRemoval = True then I don’t get the “Safely Remove
Hardware” option, but no message this time. But I want the "Safely
remove hardware for sure.

It seems like I can’t replicate windows own USB behavior. I can either
get “Safely Remove Hardware” option or I have to live with errors on
Event Viewer.

My original questions actually was to ask if somehow I can fix this
problem and what am I missing…A special function call or some
special
flag somewhere that’ll fix it.

What you are saying, I think, is that you have a device that sometimes
can be safely removed, and sometimes cannot. Windows certainly will
give you an event log message if you yank a flash drive in some
circumstances, like before the data is flushed. You need the “Safely
Remove Hardware” option, but sometimes it’s OK to yank the device
without it.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

this is entirely based on the pnp caps reported for the device. are you comparing the desired behavior that you want against a USB mass storage device that is fixed (let’s say a hard drive) vs removable media (let’s say a card reader)? the usb storage driver will report different caps based on the media state. you can open up device manager, view the properties of the device (and the disk it enumerates) and goto the details tab. choose “Capabilities” in the list box. what caps are reported for the usb mass storage device?

d

From: xxxxx@lists.osr.com [xxxxx@lists.osr.com] On Behalf Of Tim Roberts [xxxxx@probo.com]
Sent: Monday, October 29, 2007 2:45 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Surprise Removal of Devices

Pankaj Garg wrote:

That’s the thing. I don’t want to get that message in Event Log. Windows
doesn’t do it if you remove USB flash drives.
If I set SurpriseRemoval = True then I don’t get the “Safely Remove
Hardware” option, but no message this time. But I want the "Safely
remove hardware for sure.

It seems like I can’t replicate windows own USB behavior. I can either
get “Safely Remove Hardware” option or I have to live with errors on
Event Viewer.

My original questions actually was to ask if somehow I can fix this
problem and what am I missing…A special function call or some special
flag somewhere that’ll fix it.

What you are saying, I think, is that you have a device that sometimes
can be safely removed, and sometimes cannot. Windows certainly will
give you an event log message if you yank a flash drive in some
circumstances, like before the data is flushed. You need the “Safely
Remove Hardware” option, but sometimes it’s OK to yank the device
without it.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

7

there is no such thing as a normal usb device behavior. it depends on the type of device plugged in. see my other response, i bet there are different caps reported based on the media type of the usb mass storage device you are testing with.

d

From: xxxxx@lists.osr.com [xxxxx@lists.osr.com] On Behalf Of Pankaj Garg [xxxxx@panologic.com]
Sent: Monday, October 29, 2007 4:36 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Surprise Removal of Devices

If you plug in a flash drive in windows, and plug it out while not in
the middle of a transfer, there is no error message in Event Viewer.
I am seeing the error message with my device. I can attribute the error
message to the fact that SurpriseRemoval is set to False. But then if I
set it to True I loose the “Safely Remove Hardware” from system tray.

I wanna have both. Just like normal USB devices…

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tim Roberts
Sent: Monday, October 29, 2007 2:45 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Surprise Removal of Devices

Pankaj Garg wrote:

That’s the thing. I don’t want to get that message in Event Log.
Windows
doesn’t do it if you remove USB flash drives.
If I set SurpriseRemoval = True then I don’t get the “Safely Remove
Hardware” option, but no message this time. But I want the "Safely
remove hardware for sure.

It seems like I can’t replicate windows own USB behavior. I can either
get “Safely Remove Hardware” option or I have to live with errors on
Event Viewer.

My original questions actually was to ask if somehow I can fix this
problem and what am I missing…A special function call or some
special
flag somewhere that’ll fix it.

What you are saying, I think, is that you have a device that sometimes
can be safely removed, and sometimes cannot. Windows certainly will
give you an event log message if you yank a flash drive in some
circumstances, like before the data is flushed. You need the “Safely
Remove Hardware” option, but sometimes it’s OK to yank the device
without it.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer