用usb verifier测试中遇到的问题（70分，痛苦中）

各位高手：
    有一个极度恼人的问题：我在用USB VERIFIER测试驱动的时候，测试机器出现重起。我用windbg跟踪发现问题在于：我自己建立了一个IRP，往下发送，
mini*.dmp显示：
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.

Probably caused by : usbehci.sys ( usbehci!EHCI_PollActiveAsyncEndpoint+6a )

注明：我的设备插在一块 NEC 的PCI转到USB的板卡上，usbehci.sys 就是这块卡的驱动。
希望高手指点一下。

[编辑 -  5/27/04 by  mycookie]

我看过了在枚举的时候系统会调用这个地方（只要是USB设备）平时在传输数据的时候不会调用但在加了USB VERIFIER后就出现这个问题）

*** Fatal System Error: 0x000000d1
                       (0x00000008,0x00000002,0x00000000,0xF87FF37A)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrnlmp.exe -
Loading Kernel Symbols
..............................................................................................
Loading unloaded module list
......
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {8, 2, 0, f87ff37a}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** ERROR: Module load completed but symbols could not be loaded for usbehci.sys
Probably caused by : usbehci.sys ( usbehci+237a )

Followup: MachineOwner
---------

nt!DbgBreakPointWithStatus+0x4:
8051d4b0 cc               int     3
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000008, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f87ff37a, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


READ_ADDRESS: unable to get nt!MmPoolCodeEnd
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSpecialPoolStart
unable to get nt!MmPagedPoolStart
unable to get nt!MiSessionPoolStart
unable to get nt!MiSessionPoolEnd
unable to get nt!MmNonPagedPoolExpansionStart
unable to get nt!MmPoolCodeStart
 00000008

CURRENT_IRQL:  2

FAULTING_IP:
usbehci+237a
f87ff37a f6470880         test    byte ptr [edi+0x8],0x80

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xD1

如果可以把usbehci的EHCI_PollActiveAsyncEndpoint函数贴出来

Probably caused by : usbehci.sys ( usbehci!EHCI_PollActiveAsyncEndpoint+6a )
那行代码是什么？

dear all:
  哪位仁慈的大哥能指点一下,是固件的问题吗？

[编辑 -  6/9/04 by  mycookie]

上面是DDK 例子吧。我早就看过了，
我用的是
requestBuffer = ExAllocatePool(NonPagedPool , requestBufferLength);

难道有什么问题吗？

示例代码：

   bootSector = ExAllocatePool(
      NonPagedPoolCacheAligned,
      BOOT_SECTOR_SIZE
      );
   if (!bootSector)
   {
      return STATUS_INSUFFICIENT_RESOURCES;
   }

   offset.LowPart = offset.HighPart = 0;
   irp = IoBuildAsynchronousFsdRequest(
      IRP_MJ_READ,
      DisketteExtension->DeviceObject,
      bootSector,
      BOOT_SECTOR_SIZE,
      &offset,
      NULL);

我检查过了我的参数没有指向NULL，不会要我把整个irp放在nonpage上吧！

IRP也必须在NonPagedPool中，用ExAllocatePool或ExAllocatePoolWithTag分配（指定NonPagedPool参数）。

楼上大哥：
    你告诉我该如何把整个IRP放在NONPAGE上。
              


             谢谢！

我检查过了我的参数没有指向NULL，不会要我把整个irp放在nonpage上吧！

我是用

requestBuffer是nonpage，irp是不是也要放在nonpage中
irp = IoBuildAsynchronousFsdRequest(
READER_EXTENSION(UsbIoControlCode),//IRP_MJ_WRITE,
NextStackDevice,
requestBuffer,
requestBufferLength,//sizeof(requestBuffer)
&startingOffset,
       &ioStatus
       );

从出错的信息看，应该是内存的问题。
可能原因：

1. 你的IRP创建在PagedPool中

2. 某些指针是空指针.