[gpio/samples/simgpio]: Gpio sample uninstall break when driver verifier on

[AlanoSong]

Which is the area where the sample lives?

/gpio/

Describe the issue

• The simgpio driver will make windows system enter nt!DbgBreakPoint when uninstall the driver with driver verifier on.

• Target windows arm64 version:

Edition	Windows 11 Pro
Version	25H2
Installed on	‎4/‎1/‎2024
OS build	26200.8037
Experience	Windows Feature Experience Pack 1000.26100.300.0

• Related module version:

0: kd> lm vm msgpioclx
Browse full module list
start             end                 module name
fffff801`04640000 fffff801`04672000   msgpioclx   (deferred)             
    Image path: msgpioclx.sys
    Image name: msgpioclx.sys
    Browse all global symbols  functions  data
    Image was built with /Brepro flag.
    Timestamp:        5221700B (This is a reproducible build file hash, not a timestamp)
    CheckSum:         0003CA2B
    ImageSize:        00032000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:
0: kd> lm vm Wdf01000
Browse full module list
start             end                 module name
fffff803`b1ba0000 fffff803`b1c78000   Wdf01000   (private pdb symbols)  C:\ProgramData\dbg\sym\Wdf01000.pdb\FC5A618EA01AE10F1BA582B4D6BE654F1\Wdf01000.pdb
    Loaded symbol image file: Wdf01000.sys
    Image path: Wdf01000.sys
    Image name: Wdf01000.sys
    Browse all global symbols  functions  data
    Image was built with /Brepro flag.
    Timestamp:        E2256FA9 (This is a reproducible build file hash, not a timestamp)
    CheckSum:         000E204F
    ImageSize:        000D8000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

• Install simgpio driver by pnputil command on target windows system: pnputil /add-driver simgpio.inf /install
• Enable driver verifier for this driver: verifier /standard /driver simgpio.sys
• Reboot system to make verifier work
• Try to uninstall simgpio.sys by pnputil command: pnputil /delete-driver oem1.inf /uninstall
• And we can see the following call stack in WinDbg, it seems that msgpioclx module try to get interrupt resource from Wdf01000 module resource but failed:

Break instruction exception - code 80000003 (first chance)
nt!DbgBreakPoint:
fffff803`b7f01370 d43e0000 brk         #0xF000
7: kd> kb
 # RetAddr               : Args to Child                                                           : Call Site
00 fffff803`b1ba18b4     : ffffb808`c6898340 fffff803`b1bdc89c fffff801`00737973 00000001`00000001 : nt!DbgBreakPoint
01 (Inline Function)     : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!Mx::MxDbgBreakPoint+0xc [minkernel\wdf\framework\shared\inc\primitives\km\MxGeneralKm.h @ 156] 
02 fffff803`b1bdc89c     : ffffb808`c6898340 fffff803`b1bdc89c fffff801`00737973 00000001`00000001 : Wdf01000!FxVerifierDbgBreakPoint+0x54 [minkernel\wdf\framework\shared\inc\private\common\fxverifier.h @ 94] 
03 (Inline Function)     : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxInterrupt::AcquireLock+0x174 [minkernel\wdf\framework\shared\irphandlers\pnp\interruptobject.cpp @ 1794] 
04 fffff801`045b3c68     : 000044f4`7e611f68 00000000`00000000 ffffb808`c6898380 fffff801`045b3c68 : Wdf01000!imp_WdfInterruptAcquireLock+0x1bc [minkernel\wdf\framework\shared\irphandlers\pnp\fxinterruptapi.cpp @ 627] 
05 fffff803`b1c2ac0c     : ffffb808`c68983f0 fffff803`b1c2ac0c 01da8638`00000000 000044f4`7e611f68 : msgpioclx!GpioClxEvtDeviceReleaseHardware+0x178
06 fffff803`b1be39ac     : ffffb808`c6898410 fffff803`b1be39ac ffffbb0b`81563090 ffffbb0b`815636c8 : Wdf01000!FxPnpDeviceReleaseHardware::InvokeClient+0x2c [minkernel\wdf\framework\shared\irphandlers\pnp\pnpcallbacks.cpp @ 557] 
07 fffff803`b1c2a338     : ffffb808`c6898440 fffff803`b1c2a338 ffffbb0b`81563090 00000000`00000117 : Wdf01000!FxPrePostCallback::InvokeStateless+0x44 [minkernel\wdf\framework\shared\irphandlers\pnp\cxpnppowercallbacks.cpp @ 408] 
08 (Inline Function)     : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxPnpDeviceReleaseHardware::Invoke+0x34 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpcallbacks.cpp @ 533] 
09 fffff803`b1c29778     : ffffb808`c6898470 fffff803`b1c29778 ffffbb0b`81563090 00000000`00000117 : Wdf01000!FxPkgPnp::PnpReleaseHardware+0x50 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 3670] 
0a fffff803`b1c288cc     : ffffb808`c68984c0 fffff803`b1c288cc ffffbb0b`81563090 fffff803`b1c4b000 : Wdf01000!FxPkgPnp::PnpEventRemovingDisableInterfaces+0x18 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 2330] 
0b fffff803`b1bddbc0     : fffff803`0000010e 00000000`00000000 00000000`00000000 00000000`00000000 : Wdf01000!FxPkgPnp::PnpEnterNewState+0x17c [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 1240] 
0c fffff803`b1bdda3c     : ffffbb0b`804f5060 fffff803`b856e66c ffffb808`c6898570 fffff803`b1bdda3c : Wdf01000!FxPkgPnp::PnpProcessEventInner+0x130 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 1154] 
0d fffff803`b1c31310     : 00000000`00000008 ffffb808`c68985b8 ffffb808`c68985c0 fffff803`b1c31310 : Wdf01000!FxPkgPnp::PnpProcessEvent+0x18c [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 935] 
0e fffff803`b1be0410     : ffffb808`c6898630 fffff803`b1be0410 00000000`81060001 ffffb808`c68985d8 : Wdf01000!FxPkgPnp::_PnpRemoveDevice+0xa0 [minkernel\wdf\framework\shared\irphandlers\pnp\fxpkgpnp.cpp @ 2603] 
0f fffff803`b1bb9234     : ffffbb0b`81a28500 fffff803`b1bb9208 ffffbb0b`81a28500 ffffbb0b`804f5060 : Wdf01000!FxPkgPnp::Dispatch+0xf0 [minkernel\wdf\framework\shared\irphandlers\pnp\fxpkgpnp.cpp @ 794] 
10 (Inline Function)     : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!DispatchWorker+0x28 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1587] 
11 (Inline Function)     : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxDevice::Dispatch+0x28 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1601] 
12 fffff803`b7f4a244     : ffffb808`c68986a0 fffff803`b7f4a244 ffffbb0b`81a28500 ffffbb0b`804f5060 : Wdf01000!FxDevice::DispatchWithLock+0x104 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1445] 
13 fffff803`b87b55c4     : ffffb808`c68986b0 fffff803`b87b55c4 ffffb808`c6898700 fffff803`b7f48490 : nt!IopfCallDriver+0x7c
14 fffff803`b7f48490     : ffffb808`c6898700 fffff803`b7f48490 00000000`00000000 fffff803`b7f4371c : nt!IovCallDriver+0x7c
15 fffff803`b856e66c     : ffffb808`c6898740 fffff803`b856e66c ffffbb0b`81a28500 ffffbb0b`804f5060 : nt!IofCallDriver+0x140
16 fffff803`b856e4b4     : ffffb808`c68987b0 fffff803`b856e4b4 00000000`c00000bb 00000000`00000000 : nt!IopSynchronousCall+0xd4
17 fffff803`b7f556fc     : ffffb808`c6898860 fffff803`b7f556fc ffffcc8c`446697f0 00000000`00000000 : nt!IopRemoveDevice+0x114
18 fffff803`b854491c     : ffffb808`c68988d0 fffff803`b854491c 00000000`00000000 fffff803`b8ace000 : nt!PnpRemoveLockedDeviceNode+0x1bc
19 fffff803`b8544af4     : ffffb808`c6898910 fffff803`b8544af4 00000000`00000001 00000000`00000000 : nt!PnpDeleteLockedDeviceNode+0x84
1a fffff803`b85627c0     : ffffb808`c68989a0 fffff803`b85627c0 00000002`7d372d01 00000000`00000015 : nt!PnpDeleteLockedDeviceNodes+0x154
1b fffff803`b8562c38     : ffffb808`c6898a80 fffff803`b8562c38 00000001`00000000 ffffbb0b`7d372d70 : nt!PnpProcessQueryRemoveAndEject+0x768
1c fffff803`b8561768     : ffffb808`c6898b00 fffff803`b8561768 ffffcc8c`446697f0 fffff803`b8b22000 : nt!PnpProcessTargetDeviceEvent+0xd8
1d fffff803`b807a61c     : ffffcc8c`49d23d70 ffffbb0b`7d037ed0 00000000`00000000 00000000`00000000 : nt!PnpDeviceEventWorker+0x188
1e fffff803`b7ff3dec     : fffff803`b8b14300 00000000`00000000 ffffbb0b`746b2d20 00000000`00000020 : nt!ExpWorkerThread+0x54c
1f fffff803`b832658c     : 00000000`00000000 fffff803`b832658c fffff803`b8b09ab8 0000005b`fde966a2 : nt!PspSystemThreadStartup+0x7c
20 00000000`00000000     : ffffbb0b`74772b30 fffff803`b807a0d0 fffff803`b7ff3d70 00000000`00000000 : nt!KiStartSystemThread+0x24
7: kd> g
Break instruction exception - code 80000003 (first chance)
nt!DbgBreakPoint:
fffff803`b7f01370 d43e0000 brk         #0xF000
7: kd> kb
 # RetAddr               : Args to Child                                                           : Call Site
00 fffff803`b1ba18b4     : ffffb808`c6898310 fffff803`b1be68e4 fffff801`00737973 000044f4`7ea98628 : nt!DbgBreakPoint
01 (Inline Function)     : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!Mx::MxDbgBreakPoint+0xc [minkernel\wdf\framework\shared\inc\primitives\km\MxGeneralKm.h @ 156] 
02 fffff803`b1be68e4     : ffffb808`c6898310 fffff803`b1be68e4 fffff801`00737973 000044f4`7ea98628 : Wdf01000!FxVerifierDbgBreakPoint+0x54 [minkernel\wdf\framework\shared\inc\private\common\fxverifier.h @ 94] 
03 fffff803`b1bdcb00     : ffffb808`c6898340 fffff803`b1bdcb00 ffffbb0b`815679d0 00000001`00000001 : Wdf01000!FxInterrupt::ReleaseLock+0xb4 [minkernel\wdf\framework\shared\irphandlers\pnp\interruptobject.cpp @ 1862] 
04 fffff801`045b3cd4     : 000044f4`7e611f68 00000000`00000000 ffffb808`c6898380 fffff801`045b3cd4 : Wdf01000!imp_WdfInterruptReleaseLock+0x50 [minkernel\wdf\framework\shared\irphandlers\pnp\fxinterruptapi.cpp @ 674] 
05 fffff803`b1c2ac0c     : ffffb808`c68983f0 fffff803`b1c2ac0c 01da8638`00000000 000044f4`7e611f68 : msgpioclx!GpioClxEvtDeviceReleaseHardware+0x1e4
06 fffff803`b1be39ac     : ffffb808`c6898410 fffff803`b1be39ac ffffbb0b`81563090 ffffbb0b`815636c8 : Wdf01000!FxPnpDeviceReleaseHardware::InvokeClient+0x2c [minkernel\wdf\framework\shared\irphandlers\pnp\pnpcallbacks.cpp @ 557] 
07 fffff803`b1c2a338     : ffffb808`c6898440 fffff803`b1c2a338 ffffbb0b`81563090 00000000`00000117 : Wdf01000!FxPrePostCallback::InvokeStateless+0x44 [minkernel\wdf\framework\shared\irphandlers\pnp\cxpnppowercallbacks.cpp @ 408] 
08 (Inline Function)     : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxPnpDeviceReleaseHardware::Invoke+0x34 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpcallbacks.cpp @ 533] 
09 fffff803`b1c29778     : ffffb808`c6898470 fffff803`b1c29778 ffffbb0b`81563090 00000000`00000117 : Wdf01000!FxPkgPnp::PnpReleaseHardware+0x50 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 3670] 
0a fffff803`b1c288cc     : ffffb808`c68984c0 fffff803`b1c288cc ffffbb0b`81563090 fffff803`b1c4b000 : Wdf01000!FxPkgPnp::PnpEventRemovingDisableInterfaces+0x18 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 2330] 
0b fffff803`b1bddbc0     : fffff803`0000010e 00000000`00000000 00000000`00000000 00000000`00000000 : Wdf01000!FxPkgPnp::PnpEnterNewState+0x17c [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 1240] 
0c fffff803`b1bdda3c     : ffffbb0b`804f5060 fffff803`b856e66c ffffb808`c6898570 fffff803`b1bdda3c : Wdf01000!FxPkgPnp::PnpProcessEventInner+0x130 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 1154] 
0d fffff803`b1c31310     : 00000000`00000008 ffffb808`c68985b8 ffffb808`c68985c0 fffff803`b1c31310 : Wdf01000!FxPkgPnp::PnpProcessEvent+0x18c [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 935] 
0e fffff803`b1be0410     : ffffb808`c6898630 fffff803`b1be0410 00000000`81060001 ffffb808`c68985d8 : Wdf01000!FxPkgPnp::_PnpRemoveDevice+0xa0 [minkernel\wdf\framework\shared\irphandlers\pnp\fxpkgpnp.cpp @ 2603] 
0f fffff803`b1bb9234     : ffffbb0b`81a28500 fffff803`b1bb9208 ffffbb0b`81a28500 ffffbb0b`804f5060 : Wdf01000!FxPkgPnp::Dispatch+0xf0 [minkernel\wdf\framework\shared\irphandlers\pnp\fxpkgpnp.cpp @ 794] 
10 (Inline Function)     : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!DispatchWorker+0x28 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1587] 
11 (Inline Function)     : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxDevice::Dispatch+0x28 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1601] 
12 fffff803`b7f4a244     : ffffb808`c68986a0 fffff803`b7f4a244 ffffbb0b`81a28500 ffffbb0b`804f5060 : Wdf01000!FxDevice::DispatchWithLock+0x104 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1445] 
13 fffff803`b87b55c4     : ffffb808`c68986b0 fffff803`b87b55c4 ffffb808`c6898700 fffff803`b7f48490 : nt!IopfCallDriver+0x7c
14 fffff803`b7f48490     : ffffb808`c6898700 fffff803`b7f48490 00000000`00000000 fffff803`b7f4371c : nt!IovCallDriver+0x7c
15 fffff803`b856e66c     : ffffb808`c6898740 fffff803`b856e66c ffffbb0b`81a28500 ffffbb0b`804f5060 : nt!IofCallDriver+0x140
16 fffff803`b856e4b4     : ffffb808`c68987b0 fffff803`b856e4b4 00000000`c00000bb 00000000`00000000 : nt!IopSynchronousCall+0xd4
17 fffff803`b7f556fc     : ffffb808`c6898860 fffff803`b7f556fc ffffcc8c`446697f0 00000000`00000000 : nt!IopRemoveDevice+0x114
18 fffff803`b854491c     : ffffb808`c68988d0 fffff803`b854491c 00000000`00000000 fffff803`b8ace000 : nt!PnpRemoveLockedDeviceNode+0x1bc
19 fffff803`b8544af4     : ffffb808`c6898910 fffff803`b8544af4 00000000`00000001 00000000`00000000 : nt!PnpDeleteLockedDeviceNode+0x84
1a fffff803`b85627c0     : ffffb808`c68989a0 fffff803`b85627c0 00000002`7d372d01 00000000`00000015 : nt!PnpDeleteLockedDeviceNodes+0x154
1b fffff803`b8562c38     : ffffb808`c6898a80 fffff803`b8562c38 00000001`00000000 ffffbb0b`7d372d70 : nt!PnpProcessQueryRemoveAndEject+0x768
1c fffff803`b8561768     : ffffb808`c6898b00 fffff803`b8561768 ffffcc8c`446697f0 fffff803`b8b22000 : nt!PnpProcessTargetDeviceEvent+0xd8
1d fffff803`b807a61c     : ffffcc8c`49d23d70 ffffbb0b`7d037ed0 00000000`00000000 00000000`00000000 : nt!PnpDeviceEventWorker+0x188
1e fffff803`b7ff3dec     : fffff803`b8b14300 00000000`00000000 ffffbb0b`746b2d20 00000000`00000020 : nt!ExpWorkerThread+0x54c
1f fffff803`b832658c     : 00000000`00000000 fffff803`b832658c fffff803`b8b09ab8 0000005b`fde966a2 : nt!PspSystemThreadStartup+0x7c
20 00000000`00000000     : ffffbb0b`74772b30 fffff803`b807a0d0 fffff803`b7ff3d70 00000000`00000000 : nt!KiStartSystemThread+0x24

[AlanoSong]

5an7y-Microsoft
Can you help checking this problem? Thanks a lot.

[AlanoSong]

So far, I have tested the Windows 24h2 arm64 version and 25h2 arm64 version, and both of them have the same problem.

Furthermore, I conducted an experiment:
removing all the functional code in the simgpio code, and only focused on the installation and uninstallation process of the driver.
The same problem still occurred. It seems that after the simgpio driver enables verifier verification, the verifier process for msgpioclx.sys will also be enabled synchronously, thereby exposing the resource interaction issue between msgpioclx.sys and wdf01000.sys.

So I think the root cause of this problem lies in the interaction between msgpioclx.sys and wdf01000.sys?
(This is just a conjecture)

[5an7y-Microsoft]

@microsoft/device-enumeration-and-interconnect can you please take a look at this issue?