为什么某些机器上系统会hang在IoCallDriver?只有重启，内附代码

[ObjLinking]

NTSTATUS
StartReadUrb(
PDEVICE_EXTENSION Extension
)
{ // StartInterruptUrb

// If the interrupt polling IRP is currently running, don't try to start
// it again.
USBD_PIPE_HANDLE PipeHandle;
BOOLEAN startirp;
KIRQL oldirql;
PIRP Irp;
PURB urb;
PUSB_DATA_PIPE_CONTEXT rwcontext;
PIO_STACK_LOCATION stack;
NTSTATUS status;

TRACE("Enter StartReadUrbnew() DO=%X\n",Extension->DeviceObject);
// KeAcquireSpinLock(&Extension->polllock, &oldirql);
if (Extension->readpending)
startirp = FALSE;
else
startirp = TRUE, Extension->readpending = TRUE;
// KeReleaseSpinLock(&Extension->polllock, oldirql);

if (!startirp)
{
TRACE("Read Pending\n");
return STATUS_DEVICE_BUSY; // already pending
}
Irp = IoAllocateIrp(Extension->TopOfStackDeviceObject->StackSize + 1, FALSE);

urb = ExAllocatePool(NonPagedPool,
sizeof(struct _URB_BULK_OR_INTERRUPT_TRANSFER));

rwcontext = ExAllocatePool(NonPagedPool,
sizeof(struct _USB_DATA_PIPE_CONTEXT));

rwcontext->Extension = Extension;
rwcontext->urb = urb;

if(Extension->UsbInterface == NULL)
{
TRACE("Extension->UsbInterface is NULL\n");
return STATUS_INSUFFICIENT_RESOURCES;
}
PipeHandle = Extension->UsbInterface->Pipes[Extension->DataInPipe].PipeHandle;

ASSERT(Irp && urb);

TRACE("Prepare data for StartReadUrb()\n");
// Acquire the remove lock so we can't remove the device while the IRP
// is still active.
/*
NTSTATUS status = IoAcquireRemoveLock(&Extension->RemoveLock, Irp);
if (!NT_SUCCESS(status))
{
Extension->pollpending = 0;
return status;
}
*/
// Initialize the URB we use for reading the interrupt pipe

UsbBuildInterruptOrBulkTransferRequest(
urb,
sizeof (struct _URB_BULK_OR_INTERRUPT_TRANSFER),
PipeHandle,
Extension->ReadData,
NULL,
InPipeMaxSize,
USBD_TRANSFER_DIRECTION_IN | USBD_SHORT_TRANSFER_OK,
NULL);

// Initialize the IRP for an internal control request

stack = IoGetNextIrpStackLocation(Irp);
RtlZeroMemory(stack, sizeof(IO_STACK_LOCATION));
stack->MajorFunction = IRP_MJ_INTERNAL_DEVICE_CONTROL;
stack->Parameters.Others.Argument1 = urb;
stack->Parameters.DeviceIoControl.IoControlCode = IOCTL_INTERNAL_USB_SUBMIT_URB;

// Install "OnInterrupt" as the completion routine for the polling IRP.

IoSetCompletionRoutine(
Irp,
(PIO_COMPLETION_ROUTINE) OnReadInterrupt,
rwcontext,
TRUE,
TRUE,
TRUE);

// This IRP might have been cancelled the last time it was used, in which case
// the cancel flag will still be on. Clear it to prevent USBD from thinking that it's
// been cancelled again! A better way to do this would be to call IoReuseIrp,
// but that function is not declared in WDM.H.

Irp->Cancel = FALSE;

// UsbCom_IncrementIoCount(Extension->DeviceObject); //

TRACE("IoCallDriver\n");
status = IoCallDriver(Extension->TopOfStackDeviceObject, Irp);
TRACE("Exit StartReadUrbnew()\n");
return status;
}

经常走到status = IoCallDriver(Extension->TopOfStackDeviceObject, Irp);机器整个就hang掉了
请高手指点一二，什么原因会导致这种现象？

[ObjLinking]

附上log
Entering DriverEntry(), RegistryPath=
exiting DriverEntry
enter UsbCom_PnPAddDevice()
enter UsbCom_CreateDeviceObject()
Enter SerialGetRegistryKeyValue
***** DRV=862d4040 PDO=8626dde8 FDO=86268030 (\Device\SOPE1USB1) *****
SUCCEEDED IoSetDeviceInterfaceState()
DO=86268030 SYMBOLIC LINK =
UsbCom_QueryCapabilities() ntStatus from IoCallDriver to PCI = 0x0
Enter UsbCom_SelfSuspendOrActivate(),fSuspend = 1
ABORTING UsbCom_SelfSuspendOrActivate()
exit UsbCom_PnPAddDevice() (0)
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor PowerSystemWorking, -- 18
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_RESOURCE_REQUIREMENTS, -- b
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp 2
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_FILTER_RESOURCE_REQUIREMENTS, -- d
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_START_DEVICE, -- 0
enter UsbCom_ProcessSysControlIrp()
enter UsbCom_StartDevice
UsbCom_ProcessSysControlIrp() Exit UsbCom_ProcessSysControlIrp 0
UsbCom_StartDevice() SUCCESS ExAllocatePool() for URB_CONTROL_DESCRIPTOR_REQUESTUsbCom_StartDevice() SUCESS ExAllocatePool() for deviceDescriptor
UsbCom_CallUSBD() (0) DO=86268030 Urb=87ad4fb0 Irp=87cdef20
Device Descriptor = 87918fe8, len 0x12
I82930 Device Descriptor:
-------------------------
bLength 18
bDescriptorType 0x1
bcdUSB 0x200
bDeviceClass 0x0
bDeviceSubClass 0x0
bDeviceProtocol 0x0
bMaxPacketSize0 0x40
idVendor 0xa5c
idProduct 0x2132
bcdDevice 0x202
iManufacturer 0x0
iProduct 0x0
iSerialNumber 0x0
bNumConfigurations 0x1
enter UsbCom_ConfigureDevice
UsbCom_CallUSBD() (1) DO=86268030 Urb=87e98fb0 Irp=87d22f20
UsbCom_CallUSBD() (2) DO=86268030 Urb=87e98fb0 Irp=8801cf20
UsbCom_SelectInterface() DO=86268030 Interfaces=1
UsbCom_CallUSBD() (3) DO=86268030 Urb=862794c8 Irp=877e0f20
---------
NumberOfPipes 0x3
Length 0x4c
Alt Setting 0x0
Interface Number 0x0
Class, subclass, protocol 0xff 0x0 0x0
---------
PipeType 0x3
EndpointAddress 0x81
MaxPacketSize 0x10
Interval 0x4
Handle 0x8630726c
MaximumTransferSize 0x400
InterruptPipe 0x0
---------
PipeType 0x2
EndpointAddress 0x2
MaxPacketSize 0x200
Interval 0x0
Handle 0x8630728c
MaximumTransferSize 0x400
DataOutPipe 0x1
---------
PipeType 0x2
EndpointAddress 0x82
MaxPacketSize 0x200
Interval 0x0
Handle 0x863072ac
MaximumTransferSize 0x400
DataInPipe 0x2
---------
SERIAL: The default interrupt read buffer size is: 0
------ The XoffLimit is : 0
------ The XonLimit is : 0
------ The pt 8 size is : 0
exit UsbCom_StartDevice (0)
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_CAPABILITIES, -- 9
[ss] Allow surprise removals --
Allow surprise removals
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_BUS_INFORMATION, -- 14
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp 2
UsbCom_ProcessPowerIrp() IRP_MJ_POWER
UsbCom_ProcessPowerIrp() UNKNOWN POWER MESSAGE (ff)
Exit UsbCom_ProcessPowerIrp() ntStatus = 0xc00000bb
enter UsbCom_ProcessSysControlIrp()
UsbCom_ProcessSysControlIrp() Exit UsbCom_ProcessSysControlIrp 0
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MJ_INTERNAL_DEVICE_CONTROL, -- ff
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_DEVICE_RELATIONS, -- 7
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_DEVICE_RELATIONS, -- 7
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_DEVICE_TEXT, -- c
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_PNP_DEVICE_STATE, -- 13
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_DEVICE_RELATIONS, -- 7
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp 2
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_INTERFACE, -- 8
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp c00000bb
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_INTERFACE, -- 8
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp 0
enter UsbCom_ProcessPnPIrp() IRP_MJ_PNP, minor IRP_MN_QUERY_DEVICE_RELATIONS, -- 7
UsbCom_ProcessPnPIrp() Minor PnP IOCTL not handled
UsbCom_ProcessPnPIrp() Passing PnP Irp down, status = 0
UsbCom_ProcessPnPIrp() Exit UsbCom_ProcessPnPIrp 2
entering UsbCom_Create DO=86268030 Irp=87338eb8
exit UsbCom_Create 0
SERIAL: Dispatch InternalIoControl entry for: 87750ed8
USBSerial IOCTL: beginning set baud rate.
enter UsbCom_SetBaud() DO=86268030 Irp=87ef6ed8 BaudRate=1200
exit UsbCom_SetBaud() Status=00000000
SERIAL: Complete Irp: 882c2ed8

Enter SerialRead
Interrupt Buffer less than half full - Submitting next Read URB
Enter StartReadUrbnew() DO=86268030
Prepare data for StartReadUrb()
IoCallDriver

[cnzdgs]

OnReadInterrupt执行了吗？是不是问题出在这里面？

[ObjLinking]

没执行OnReadInterrupt，直接就hang掉了，都没退出StartReadUrb

[wxf0204]

汗。。太长了。。。
精神上支持你

[cnzdgs]

有些时候在IoCallDriver里面就会调完成例程，我的意思是你在完成例程中设置一个断点来调试。如果不是这个问题，就只能跟踪到IoCallDriver里面去查问题了。

[ObjLinking]

[Quote=引用 5 楼 cnzdgs 的回复:]
有些时候在IoCallDriver里面就会调完成例程，我的意思是你在完成例程中设置一个断点来调试。如果不是这个问题，就只能跟踪到IoCallDriver里面去查问题了。
[/Quote]我在完成例程里面有log，没有发现输出相关log.
有一点可能要说一下，我的writeUrb和ReadUrb之前都调用过spinlock，不知道会不会有影响，首先IRQ level会在Dispatch_level上面，另外不知道spinlock会不会有影响呢？

[meiZiNick]

没遇到过这种情况.

[ObjLinking]

谢谢各位，果然是IRQLevel太高引起的，我现在在PASSIVE_LEVEL下面调用就没有问题。
这个其实和每个系统也有关系。