microsoft / microsoft/Windows-driver-samples

[gpio/samples/simgpio]: Gpio sample uninstall break when driver verifier on

Open
#1,412 3 comments 0 reactions 1 assignee View on GitHub

@yinghany is already working on this.

Since Aug 19, 2026.

Dominant language
C
Stars
7.8k
Forks
5k
Avg merge
3d 17h
Merged PRs (30d)
7

Description

### Which is the area where the sample lives?

/gpio/

### Describe the issue

- The simgpio driver will make windows system enter nt!DbgBreakPoint when uninstall the driver with driver verifier on.

- Target windows arm64 version:

```
Edition Windows 11 Pro
Version 25H2
Installed on ‎4/‎1/‎2024
OS build 26200.8037
Experience Windows Feature Experience Pack 1000.26100.300.0
```

- Related module version:

```
0: kd> lm vm msgpioclx
Browse full module list
start end module name
fffff801`04640000 fffff801`04672000 msgpioclx (deferred)
Image path: msgpioclx.sys
Image name: msgpioclx.sys
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 5221700B (This is a reproducible build file hash, not a timestamp)
CheckSum: 0003CA2B
ImageSize: 00032000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
0: kd> lm vm Wdf01000
Browse full module list
start end module name
fffff803`b1ba0000 fffff803`b1c78000 Wdf01000 (private pdb symbols) C:\ProgramData\dbg\sym\Wdf01000.pdb\FC5A618EA01AE10F1BA582B4D6BE654F1\Wdf01000.pdb
Loaded symbol image file: Wdf01000.sys
Image path: Wdf01000.sys
Image name: Wdf01000.sys
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: E2256FA9 (This is a reproducible build file hash, not a timestamp)
CheckSum: 000E204F
ImageSize: 000D8000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:

```

- Install simgpio driver by pnputil command on target windows system: pnputil /add-driver simgpio.inf /install
- Enable driver verifier for this driver: verifier /standard /driver simgpio.sys
- Reboot system to make verifier work
- Try to uninstall simgpio.sys by pnputil command: pnputil /delete-driver oem1.inf /uninstall
- And we can see the following call stack in WinDbg, it seems that msgpioclx module try to get interrupt resource from Wdf01000 module resource but failed:

```
Break instruction exception - code 80000003 (first chance)
nt!DbgBreakPoint:
fffff803`b7f01370 d43e0000 brk #0xF000
7: kd> kb
# RetAddr : Args to Child : Call Site
00 fffff803`b1ba18b4 : ffffb808`c6898340 fffff803`b1bdc89c fffff801`00737973 00000001`00000001 : nt!DbgBreakPoint
01 (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!Mx::MxDbgBreakPoint+0xc [minkernel\wdf\framework\shared\inc\primitives\km\MxGeneralKm.h @ 156]
02 fffff803`b1bdc89c : ffffb808`c6898340 fffff803`b1bdc89c fffff801`00737973 00000001`00000001 : Wdf01000!FxVerifierDbgBreakPoint+0x54 [minkernel\wdf\framework\shared\inc\private\common\fxverifier.h @ 94]
03 (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxInterrupt::AcquireLock+0x174 [minkernel\wdf\framework\shared\irphandlers\pnp\interruptobject.cpp @ 1794]
04 fffff801`045b3c68 : 000044f4`7e611f68 00000000`00000000 ffffb808`c6898380 fffff801`045b3c68 : Wdf01000!imp_WdfInterruptAcquireLock+0x1bc [minkernel\wdf\framework\shared\irphandlers\pnp\fxinterruptapi.cpp @ 627]
05 fffff803`b1c2ac0c : ffffb808`c68983f0 fffff803`b1c2ac0c 01da8638`00000000 000044f4`7e611f68 : msgpioclx!GpioClxEvtDeviceReleaseHardware+0x178
06 fffff803`b1be39ac : ffffb808`c6898410 fffff803`b1be39ac ffffbb0b`81563090 ffffbb0b`815636c8 : Wdf01000!FxPnpDeviceReleaseHardware::InvokeClient+0x2c [minkernel\wdf\framework\shared\irphandlers\pnp\pnpcallbacks.cpp @ 557]
07 fffff803`b1c2a338 : ffffb808`c6898440 fffff803`b1c2a338 ffffbb0b`81563090 00000000`00000117 : Wdf01000!FxPrePostCallback::InvokeStateless+0x44 [minkernel\wdf\framework\shared\irphandlers\pnp\cxpnppowercallbacks.cpp @ 408]
08 (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxPnpDeviceReleaseHardware::Invoke+0x34 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpcallbacks.cpp @ 533]
09 fffff803`b1c29778 : ffffb808`c6898470 fffff803`b1c29778 ffffbb0b`81563090 00000000`00000117 : Wdf01000!FxPkgPnp::PnpReleaseHardware+0x50 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 3670]
0a fffff803`b1c288cc : ffffb808`c68984c0 fffff803`b1c288cc ffffbb0b`81563090 fffff803`b1c4b000 : Wdf01000!FxPkgPnp::PnpEventRemovingDisableInterfaces+0x18 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 2330]
0b fffff803`b1bddbc0 : fffff803`0000010e 00000000`00000000 00000000`00000000 00000000`00000000 : Wdf01000!FxPkgPnp::PnpEnterNewState+0x17c [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 1240]
0c fffff803`b1bdda3c : ffffbb0b`804f5060 fffff803`b856e66c ffffb808`c6898570 fffff803`b1bdda3c : Wdf01000!FxPkgPnp::PnpProcessEventInner+0x130 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 1154]
0d fffff803`b1c31310 : 00000000`00000008 ffffb808`c68985b8 ffffb808`c68985c0 fffff803`b1c31310 : Wdf01000!FxPkgPnp::PnpProcessEvent+0x18c [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 935]
0e fffff803`b1be0410 : ffffb808`c6898630 fffff803`b1be0410 00000000`81060001 ffffb808`c68985d8 : Wdf01000!FxPkgPnp::_PnpRemoveDevice+0xa0 [minkernel\wdf\framework\shared\irphandlers\pnp\fxpkgpnp.cpp @ 2603]
0f fffff803`b1bb9234 : ffffbb0b`81a28500 fffff803`b1bb9208 ffffbb0b`81a28500 ffffbb0b`804f5060 : Wdf01000!FxPkgPnp::Dispatch+0xf0 [minkernel\wdf\framework\shared\irphandlers\pnp\fxpkgpnp.cpp @ 794]
10 (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!DispatchWorker+0x28 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1587]
11 (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxDevice::Dispatch+0x28 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1601]
12 fffff803`b7f4a244 : ffffb808`c68986a0 fffff803`b7f4a244 ffffbb0b`81a28500 ffffbb0b`804f5060 : Wdf01000!FxDevice::DispatchWithLock+0x104 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1445]
13 fffff803`b87b55c4 : ffffb808`c68986b0 fffff803`b87b55c4 ffffb808`c6898700 fffff803`b7f48490 : nt!IopfCallDriver+0x7c
14 fffff803`b7f48490 : ffffb808`c6898700 fffff803`b7f48490 00000000`00000000 fffff803`b7f4371c : nt!IovCallDriver+0x7c
15 fffff803`b856e66c : ffffb808`c6898740 fffff803`b856e66c ffffbb0b`81a28500 ffffbb0b`804f5060 : nt!IofCallDriver+0x140
16 fffff803`b856e4b4 : ffffb808`c68987b0 fffff803`b856e4b4 00000000`c00000bb 00000000`00000000 : nt!IopSynchronousCall+0xd4
17 fffff803`b7f556fc : ffffb808`c6898860 fffff803`b7f556fc ffffcc8c`446697f0 00000000`00000000 : nt!IopRemoveDevice+0x114
18 fffff803`b854491c : ffffb808`c68988d0 fffff803`b854491c 00000000`00000000 fffff803`b8ace000 : nt!PnpRemoveLockedDeviceNode+0x1bc
19 fffff803`b8544af4 : ffffb808`c6898910 fffff803`b8544af4 00000000`00000001 00000000`00000000 : nt!PnpDeleteLockedDeviceNode+0x84
1a fffff803`b85627c0 : ffffb808`c68989a0 fffff803`b85627c0 00000002`7d372d01 00000000`00000015 : nt!PnpDeleteLockedDeviceNodes+0x154
1b fffff803`b8562c38 : ffffb808`c6898a80 fffff803`b8562c38 00000001`00000000 ffffbb0b`7d372d70 : nt!PnpProcessQueryRemoveAndEject+0x768
1c fffff803`b8561768 : ffffb808`c6898b00 fffff803`b8561768 ffffcc8c`446697f0 fffff803`b8b22000 : nt!PnpProcessTargetDeviceEvent+0xd8
1d fffff803`b807a61c : ffffcc8c`49d23d70 ffffbb0b`7d037ed0 00000000`00000000 00000000`00000000 : nt!PnpDeviceEventWorker+0x188
1e fffff803`b7ff3dec : fffff803`b8b14300 00000000`00000000 ffffbb0b`746b2d20 00000000`00000020 : nt!ExpWorkerThread+0x54c
1f fffff803`b832658c : 00000000`00000000 fffff803`b832658c fffff803`b8b09ab8 0000005b`fde966a2 : nt!PspSystemThreadStartup+0x7c
20 00000000`00000000 : ffffbb0b`74772b30 fffff803`b807a0d0 fffff803`b7ff3d70 00000000`00000000 : nt!KiStartSystemThread+0x24
7: kd> g
Break instruction exception - code 80000003 (first chance)
nt!DbgBreakPoint:
fffff803`b7f01370 d43e0000 brk #0xF000
7: kd> kb
# RetAddr : Args to Child : Call Site
00 fffff803`b1ba18b4 : ffffb808`c6898310 fffff803`b1be68e4 fffff801`00737973 000044f4`7ea98628 : nt!DbgBreakPoint
01 (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!Mx::MxDbgBreakPoint+0xc [minkernel\wdf\framework\shared\inc\primitives\km\MxGeneralKm.h @ 156]
02 fffff803`b1be68e4 : ffffb808`c6898310 fffff803`b1be68e4 fffff801`00737973 000044f4`7ea98628 : Wdf01000!FxVerifierDbgBreakPoint+0x54 [minkernel\wdf\framework\shared\inc\private\common\fxverifier.h @ 94]
03 fffff803`b1bdcb00 : ffffb808`c6898340 fffff803`b1bdcb00 ffffbb0b`815679d0 00000001`00000001 : Wdf01000!FxInterrupt::ReleaseLock+0xb4 [minkernel\wdf\framework\shared\irphandlers\pnp\interruptobject.cpp @ 1862]
04 fffff801`045b3cd4 : 000044f4`7e611f68 00000000`00000000 ffffb808`c6898380 fffff801`045b3cd4 : Wdf01000!imp_WdfInterruptReleaseLock+0x50 [minkernel\wdf\framework\shared\irphandlers\pnp\fxinterruptapi.cpp @ 674]
05 fffff803`b1c2ac0c : ffffb808`c68983f0 fffff803`b1c2ac0c 01da8638`00000000 000044f4`7e611f68 : msgpioclx!GpioClxEvtDeviceReleaseHardware+0x1e4
06 fffff803`b1be39ac : ffffb808`c6898410 fffff803`b1be39ac ffffbb0b`81563090 ffffbb0b`815636c8 : Wdf01000!FxPnpDeviceReleaseHardware::InvokeClient+0x2c [minkernel\wdf\framework\shared\irphandlers\pnp\pnpcallbacks.cpp @ 557]
07 fffff803`b1c2a338 : ffffb808`c6898440 fffff803`b1c2a338 ffffbb0b`81563090 00000000`00000117 : Wdf01000!FxPrePostCallback::InvokeStateless+0x44 [minkernel\wdf\framework\shared\irphandlers\pnp\cxpnppowercallbacks.cpp @ 408]
08 (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxPnpDeviceReleaseHardware::Invoke+0x34 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpcallbacks.cpp @ 533]
09 fffff803`b1c29778 : ffffb808`c6898470 fffff803`b1c29778 ffffbb0b`81563090 00000000`00000117 : Wdf01000!FxPkgPnp::PnpReleaseHardware+0x50 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 3670]
0a fffff803`b1c288cc : ffffb808`c68984c0 fffff803`b1c288cc ffffbb0b`81563090 fffff803`b1c4b000 : Wdf01000!FxPkgPnp::PnpEventRemovingDisableInterfaces+0x18 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 2330]
0b fffff803`b1bddbc0 : fffff803`0000010e 00000000`00000000 00000000`00000000 00000000`00000000 : Wdf01000!FxPkgPnp::PnpEnterNewState+0x17c [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 1240]
0c fffff803`b1bdda3c : ffffbb0b`804f5060 fffff803`b856e66c ffffb808`c6898570 fffff803`b1bdda3c : Wdf01000!FxPkgPnp::PnpProcessEventInner+0x130 [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 1154]
0d fffff803`b1c31310 : 00000000`00000008 ffffb808`c68985b8 ffffb808`c68985c0 fffff803`b1c31310 : Wdf01000!FxPkgPnp::PnpProcessEvent+0x18c [minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 935]
0e fffff803`b1be0410 : ffffb808`c6898630 fffff803`b1be0410 00000000`81060001 ffffb808`c68985d8 : Wdf01000!FxPkgPnp::_PnpRemoveDevice+0xa0 [minkernel\wdf\framework\shared\irphandlers\pnp\fxpkgpnp.cpp @ 2603]
0f fffff803`b1bb9234 : ffffbb0b`81a28500 fffff803`b1bb9208 ffffbb0b`81a28500 ffffbb0b`804f5060 : Wdf01000!FxPkgPnp::Dispatch+0xf0 [minkernel\wdf\framework\shared\irphandlers\pnp\fxpkgpnp.cpp @ 794]
10 (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!DispatchWorker+0x28 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1587]
11 (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxDevice::Dispatch+0x28 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1601]
12 fffff803`b7f4a244 : ffffb808`c68986a0 fffff803`b7f4a244 ffffbb0b`81a28500 ffffbb0b`804f5060 : Wdf01000!FxDevice::DispatchWithLock+0x104 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1445]
13 fffff803`b87b55c4 : ffffb808`c68986b0 fffff803`b87b55c4 ffffb808`c6898700 fffff803`b7f48490 : nt!IopfCallDriver+0x7c
14 fffff803`b7f48490 : ffffb808`c6898700 fffff803`b7f48490 00000000`00000000 fffff803`b7f4371c : nt!IovCallDriver+0x7c
15 fffff803`b856e66c : ffffb808`c6898740 fffff803`b856e66c ffffbb0b`81a28500 ffffbb0b`804f5060 : nt!IofCallDriver+0x140
16 fffff803`b856e4b4 : ffffb808`c68987b0 fffff803`b856e4b4 00000000`c00000bb 00000000`00000000 : nt!IopSynchronousCall+0xd4
17 fffff803`b7f556fc : ffffb808`c6898860 fffff803`b7f556fc ffffcc8c`446697f0 00000000`00000000 : nt!IopRemoveDevice+0x114
18 fffff803`b854491c : ffffb808`c68988d0 fffff803`b854491c 00000000`00000000 fffff803`b8ace000 : nt!PnpRemoveLockedDeviceNode+0x1bc
19 fffff803`b8544af4 : ffffb808`c6898910 fffff803`b8544af4 00000000`00000001 00000000`00000000 : nt!PnpDeleteLockedDeviceNode+0x84
1a fffff803`b85627c0 : ffffb808`c68989a0 fffff803`b85627c0 00000002`7d372d01 00000000`00000015 : nt!PnpDeleteLockedDeviceNodes+0x154
1b fffff803`b8562c38 : ffffb808`c6898a80 fffff803`b8562c38 00000001`00000000 ffffbb0b`7d372d70 : nt!PnpProcessQueryRemoveAndEject+0x768
1c fffff803`b8561768 : ffffb808`c6898b00 fffff803`b8561768 ffffcc8c`446697f0 fffff803`b8b22000 : nt!PnpProcessTargetDeviceEvent+0xd8
1d fffff803`b807a61c : ffffcc8c`49d23d70 ffffbb0b`7d037ed0 00000000`00000000 00000000`00000000 : nt!PnpDeviceEventWorker+0x188
1e fffff803`b7ff3dec : fffff803`b8b14300 00000000`00000000 ffffbb0b`746b2d20 00000000`00000020 : nt!ExpWorkerThread+0x54c
1f fffff803`b832658c : 00000000`00000000 fffff803`b832658c fffff803`b8b09ab8 0000005b`fde966a2 : nt!PspSystemThreadStartup+0x7c
20 00000000`00000000 : ffffbb0b`74772b30 fffff803`b807a0d0 fffff803`b7ff3d70 00000000`00000000 : nt!KiStartSystemThread+0x24

```

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.