为什么某些机器上系统会hang在IoCallDriver?只有重启，内附代码

wangyihong

为什么某些机器上系统会hang在IoCallDriver?只有重启，内附代码 [复制链接]

NTSTATUS
StartReadUrb(
        PDEVICE_EXTENSION Extension
        )
{                                                        // StartInterruptUrb

        // If the interrupt polling IRP is currently running, don't try to start
        // it again.
    USBD_PIPE_HANDLE PipeHandle;
        BOOLEAN startirp;
        KIRQL oldirql;
        PIRP Irp;
        PURB urb;
        PUSB_DATA_PIPE_CONTEXT rwcontext;
        PIO_STACK_LOCATION stack;
        NTSTATUS status;

        TRACE("Enter StartReadUrbnew() DO=%X\n",Extension->DeviceObject);
//        KeAcquireSpinLock(&Extension->polllock, &oldirql);
        if (Extension->readpending)
                startirp = FALSE;
        else
                startirp = TRUE, Extension->readpending = TRUE;
//        KeReleaseSpinLock(&Extension->polllock, oldirql);

        if (!startirp)
        {
                TRACE("Read Pending\n");
                return STATUS_DEVICE_BUSY;        // already pending
        }
        Irp = IoAllocateIrp(Extension->TopOfStackDeviceObject->StackSize + 1, FALSE);

        urb = ExAllocatePool(NonPagedPool,
                         sizeof(struct _URB_BULK_OR_INTERRUPT_TRANSFER));
       
        rwcontext = ExAllocatePool(NonPagedPool,
                sizeof(struct _USB_DATA_PIPE_CONTEXT));

        rwcontext->Extension = Extension;
        rwcontext->urb = urb;
       
        if(Extension->UsbInterface == NULL)
        {
                TRACE("Extension->UsbInterface is NULL\n");
                return STATUS_INSUFFICIENT_RESOURCES;
        }
    PipeHandle = Extension->UsbInterface->Pipes[Extension->DataInPipe].PipeHandle;

        ASSERT(Irp && urb);

        TRACE("Prepare data for StartReadUrb()\n");
        // Acquire the remove lock so we can't remove the device while the IRP
        // is still active.
/*
        NTSTATUS status = IoAcquireRemoveLock(&Extension->RemoveLock, Irp);
        if (!NT_SUCCESS(status))
                {
                Extension->pollpending = 0;
                return status;
                }
*/
        // Initialize the URB we use for reading the interrupt pipe

        UsbBuildInterruptOrBulkTransferRequest(
                urb,
                sizeof (struct _URB_BULK_OR_INTERRUPT_TRANSFER),
                PipeHandle,
                Extension->ReadData,
                NULL,
                InPipeMaxSize,
                USBD_TRANSFER_DIRECTION_IN | USBD_SHORT_TRANSFER_OK,
                NULL);

        // Initialize the IRP for an internal control request

        stack = IoGetNextIrpStackLocation(Irp);
        RtlZeroMemory(stack, sizeof(IO_STACK_LOCATION));
        stack->MajorFunction = IRP_MJ_INTERNAL_DEVICE_CONTROL;
        stack->Parameters.Others.Argument1 = urb;
        stack->Parameters.DeviceIoControl.IoControlCode = IOCTL_INTERNAL_USB_SUBMIT_URB;

        // Install "OnInterrupt" as the completion routine for the polling IRP.
       
        IoSetCompletionRoutine(
                Irp,
                (PIO_COMPLETION_ROUTINE) OnReadInterrupt,
                rwcontext,
                TRUE,
                TRUE,
                TRUE);
       
        // This IRP might have been cancelled the last time it was used, in which case
        // the cancel flag will still be on. Clear it to prevent USBD from thinking that it's
        // been cancelled again! A better way to do this would be to call IoReuseIrp,
        // but that function is not declared in WDM.H.

        Irp->Cancel = FALSE;

//        UsbCom_IncrementIoCount(Extension->DeviceObject); //

        TRACE("IoCallDriver\n");
        status = IoCallDriver(Extension->TopOfStackDeviceObject, Irp);
        TRACE("Exit StartReadUrbnew()\n");
        return status;
}       

经常走到status = IoCallDriver(Extension->TopOfStackDeviceObject, Irp);机器整个就hang掉了
请高手指点一二，什么原因会导致这种现象？

poonhm

附上log
Entering DriverEntry(), RegistryPath=
exiting DriverEntry
enter UsbCom_PnPAddDevice()
enter UsbCom_CreateDeviceObject()
Enter SerialGetRegistryKeyValue
***** DRV=862d4040 PDO=8626dde8 FDO=86268030 (\Device\SOPE1USB1) *****
SUCCEEDED  IoSetDeviceInterfaceState()
DO=86268030 SYMBOLIC LINK =
UsbCom_QueryCapabilities() ntStatus from IoCallDriver to PCI = 0x0
Enter UsbCom_SelfSuspendOrActivate(),fSuspend = 1
ABORTING UsbCom_SelfSuspendOrActivate()
exit UsbCom_PnPAddDevice() (0)
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor PowerSystemWorking, -- 18
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_RESOURCE_REQUIREMENTS, -- b
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp 2
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_FILTER_RESOURCE_REQUIREMENTS, -- d
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_START_DEVICE, -- 0
enter UsbCom_ProcessSysControlIrp()
enter UsbCom_StartDevice
UsbCom_ProcessSysControlIrp() Exit UsbCom_ProcessSysControlIrp 0
UsbCom_StartDevice() SUCCESS ExAllocatePool() for URB_CONTROL_DESCRIPTOR_REQUESTUsbCom_StartDevice() SUCESS ExAllocatePool() for deviceDescriptor
UsbCom_CallUSBD() (0) DO=86268030 Urb=87ad4fb0 Irp=87cdef20
Device Descriptor = 87918fe8, len 0x12
I82930 Device Descriptor:
-------------------------
bLength 18
bDescriptorType 0x1
bcdUSB 0x200
bDeviceClass 0x0
bDeviceSubClass 0x0
bDeviceProtocol 0x0
bMaxPacketSize0 0x40
idVendor 0xa5c
idProduct 0x2132
bcdDevice 0x202
iManufacturer 0x0
iProduct 0x0
iSerialNumber 0x0
bNumConfigurations 0x1
enter UsbCom_ConfigureDevice
UsbCom_CallUSBD() (1) DO=86268030 Urb=87e98fb0 Irp=87d22f20
UsbCom_CallUSBD() (2) DO=86268030 Urb=87e98fb0 Irp=8801cf20
UsbCom_SelectInterface() DO=86268030 Interfaces=1
UsbCom_CallUSBD() (3) DO=86268030 Urb=862794c8 Irp=877e0f20
---------
NumberOfPipes 0x3
Length 0x4c
Alt Setting 0x0
Interface Number 0x0
Class, subclass, protocol 0xff 0x0 0x0
---------
PipeType 0x3
EndpointAddress 0x81
MaxPacketSize 0x10
Interval 0x4
Handle 0x8630726c
MaximumTransferSize 0x400
InterruptPipe 0x0
---------
PipeType 0x2
EndpointAddress 0x2
MaxPacketSize 0x200
Interval 0x0
Handle 0x8630728c
MaximumTransferSize 0x400
DataOutPipe 0x1
---------
PipeType 0x2
EndpointAddress 0x82
MaxPacketSize 0x200
Interval 0x0
Handle 0x863072ac
MaximumTransferSize 0x400
DataInPipe 0x2
---------
SERIAL: The default interrupt read buffer size is: 0
------  The XoffLimit is                         : 0
------  The XonLimit is                          : 0
------  The pt 8 size is                         : 0
exit UsbCom_StartDevice (0)
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_CAPABILITIES, -- 9
[ss] Allow surprise removals --
Allow surprise removals
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_BUS_INFORMATION, -- 14
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp 2
UsbCom_ProcessPowerIrp() IRP_MJ_POWER
UsbCom_ProcessPowerIrp() UNKNOWN POWER MESSAGE (ff)
Exit UsbCom_ProcessPowerIrp()  ntStatus = 0xc00000bb
enter UsbCom_ProcessSysControlIrp()
UsbCom_ProcessSysControlIrp() Exit UsbCom_ProcessSysControlIrp 0
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MJ_INTERNAL_DEVICE_CONTROL, -- ff
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_DEVICE_RELATIONS, -- 7
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_DEVICE_RELATIONS, -- 7
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_DEVICE_TEXT, -- c
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_PNP_DEVICE_STATE, -- 13
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_DEVICE_RELATIONS, -- 7
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp 2
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_INTERFACE, -- 8
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_INTERFACE, -- 8
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp 0
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_DEVICE_RELATIONS, -- 7
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp 2
entering UsbCom_Create DO=86268030 Irp=87338eb8
exit UsbCom_Create 0
SERIAL: Dispatch InternalIoControl entry for: 87750ed8
USBSerial IOCTL: beginning set baud rate.
enter UsbCom_SetBaud() DO=86268030 Irp=87ef6ed8 BaudRate=1200
exit UsbCom_SetBaud() Status=00000000
SERIAL: Complete Irp: 882c2ed8

Enter SerialRead
Interrupt Buffer less than half full - Submitting next Read URB
Enter StartReadUrbnew() DO=86268030
Prepare data for StartReadUrb()
IoCallDriver

243663934

OnReadInterrupt执行了吗？是不是问题出在这里面？

lsbhjl

没执行OnReadInterrupt，直接就hang掉了，都没退出StartReadUrb

withoutpoem

汗。。太长了。。。
精神上支持你

liu21b

有些时候在IoCallDriver里面就会调完成例程，我的意思是你在完成例程中设置一个断点来调试。如果不是这个问题，就只能跟踪到IoCallDriver里面去查问题了。

99012606

没遇到过这种情况.

wangbaiqing

引用 5 楼 cnzdgs 的回复:
有些时候在IoCallDriver里面就会调完成例程，我的意思是你在完成例程中设置一个断点来调试。如果不是这个问题，就只能跟踪到IoCallDriver里面去查问题了。

我在完成例程里面有log，没有发现输出相关log.
有一点可能要说一下，我的writeUrb和ReadUrb之前都调用过spinlock，不知道会不会有影响，首先IRQ level会在Dispatch_level上面，另外不知道spinlock会不会有影响呢？

wutieying

谢谢各位，果然是IRQLevel太高引起的，我现在在PASSIVE_LEVEL下面调用就没有问题。
这个其实和每个系统也有关系。