Understanding When Remove IRPs Are Issued

The following figure shows the typical sequence of IRPs involved in removing the drivers for a device.

The following notes correspond to the circled numbers in the previous figure:

1. Query remove

   The PnP manager issues an IRP_MN_QUERY_REMOVE_DEVICE to ask whether a device can be removed without disrupting the machine. It also sends this IRP when a user requests to update driver(s) for the device and (on Windows 2000 and later) when Device Manager disables the device. (On Windows 98/Me, the PnP manager sends stop IRPs in this situation; see Stopping a Device for details.)

   If all drivers in the device stack return STATUS_SUCCESS, the drivers have put the device into the remove-pending state. In this state, the drivers must not start any operations that prevent the device from being removed.

   In this "clean" removal case, the PnP manager sends a query-remove IRP before it sends a remove IRP. See step 5 for a description of "surprise" removal.

   Although it is not shown in the above diagram, a bus driver might receive an IRP_MN_QUERY_REMOVE_DEVICE for a device that is not started. This can happen if a user requests to dynamically remove a device that is physically present on the machine but is disabled.

2. Remove after successful query

   The PnP manager issues an IRP_MN_REMOVE_DEVICE to remove the drivers for a device.

   Drivers must succeed this request. The drivers for the device perform any necessary clean-up, detach from the device stack, and delete the FDO and any filter DOs. The parent bus driver retains the PDO until the user physically removes the device from the machine.

   Note that drivers might receive an IRP_MN_STOP_DEVICE prior to a remove IRP, but it is not required. On Windows 2000 and later, IRP_MN_STOP_DEVICE is used only to pause a device for resource rebalancing; it is not a step toward removal. If a user removes the device hardware while the device is stopped, the PnP manager sends a remove IRP at some point after the stop IRP, but a stop is not a prerequisite for a remove.

3. Reenumerate the device

   If the device is reenumerated after drivers have deleted their device objects, the PnP manager calls the drivers' AddDevice routines and issues an IRP_MN_START_DEVICE to reinstate the device. (Also see the Device States from the PnP Perspective figure.)

4. Cancel a query remove

   The PnP manager issues an IRP_MN_CANCEL_REMOVE_DEVICE to cancel a query-remove request.

   In response to an IRP_MN_CANCEL_REMOVE_DEVICE, the drivers return the device to its started state.

5. Surprise remove (Windows 2000 and later versions of Windows)

   On Windows 2000 and later systems, if a user unplugs a device from the machine without using the Unplug or Eject Hardware program, the PnP manager sends an IRP_MN_SURPRISE_REMOVAL IRP.

   This case is called "surprise" removal because the drivers receive no advance warning.

   In response to an IRP_MN_SURPRISE_REMOVAL IRP, the drivers for the device fail any outstanding I/O and release the hardware resources used by the device. The drivers must ensure that no components attempt to access the device because it is no longer present.

   All drivers must handle an IRP_MN_SURPRISE_REMOVAL IRP and must set status to STATUS_SUCCESS.

   An IRP_MN_SURPRISE_REMOVAL cannot be canceled.

6. Remove after surprise remove (Windows 2000 and later versions of Windows)

   When all open handles to the device are closed, the PnP manager sends an IRP_MN_REMOVE_DEVICE request to the drivers for the device. Each driver detaches from the device stack and deletes its device object.

7. Surprise remove (Windows 98/Me)

   On Windows 98/Me, a driver does not receive an IRP_MN_SURPRISE_REMOVAL when a device is removed without warning. The PnP manager sends only an IRP_MN_REMOVE_DEVICE. WDM drivers must have code to handle both an IRP_MN_SURPRISE_REMOVAL followed by an IRP_MN_REMOVE_DEVICE (the Windows 2000 and later behavior for surprise removal) and an IRP_MN_REMOVE_DEVICE without a prior surprise-remove IRP (the Windows 98/Me behavior).

8. Remove after a failed start (Windows 2000 and later)

   If one of the drivers for a device fails an IRP_MN_START_DEVICE, the PnP manager sends an IRP_MN_REMOVE_DEVICE request to the device stack. Such a remove IRP ensures that all drivers for the device are notified that the device was not successfully started. In response to the IRP_MN_REMOVE_DEVICE IRP, the drivers for the device undo their start operations (if they succeeded the start IRP) and undo their AddDevice operations. The PnP manager marks such a device as "failed start."

   This behavior applies to Windows 2000 and later platforms only. On Windows 98/Me, the PnP manager sends an IRP_MN_STOP_DEVICE in response to a failed start.

A driver for a PnP device can receive an IRP_MN_SURPRISE_REMOVAL in more situations than those shown in the figure illustrating typical remove IRP transitions. For example, a user could insert a PC Card into the machine and then remove it before the device is started. In that case, the PnP manager issues a surprise-remove IRP after the drivers' AddDevice routines are called but before issuing the IRP_MN_START_DEVICE request. A driver for a PnP device must be prepared to handle remove IRPs at any time after the driver's AddDevice routine is called.