passthru中WIN32子系统调用问题

请教：

passthru 问题：
下载的源码，安装后驱动运行正常，产生的两个适配器工作正常，
STOP:0X0000000A(0XC10500DA,0X00000002,0X00000000,0X805037E6)
irql_not_less_or_equal
请教原因?

在Mpinitialize 中加入了一个device :::

...
pAdapt->Next = pAdaptList;
        pAdaptList = pAdapt;

        NdisReleaseSpinLock(&GlobalLock);
        
        //
        // Create an ioctl interface
        //
        (VOID)PtRegisterDevice();//;加入新设备

        Status = NDIS_STATUS_SUCCESS;
    }
    while (FALSE);

    //
    // If we had received an UnbindAdapter notification on the underlying
    // adapter, we would have blocked that thread waiting for the IM Init
    // process to complete. Wake up any such thread.
    //
    ASSERT(pAdapt->MiniportInitPending == TRUE);
    pAdapt->MiniportInitPending = FALSE;
    NdisSetEvent(&pAdapt->MiniportInitEvent);

    DBGPRINT(("<== Miniport Initialize: Adapt %p, Status %xn", pAdapt, Status));

    *OpenErrorStatus = Status;
    
    return Status;



//PtRegisterDevice
NDIS_STATUS
PtRegisterDevice(
    VOID
    )
/*++

Routine Description:

    Register an ioctl interface - a device object to be used for this
    purpose is created by NDIS when we call NdisMRegisterDevice.

    This routine is called whenever a new miniport instance is
    initialized. However, we only create one global device object,
    when the first miniport instance is initialized. This routine
    handles potential race conditions with PtDeregisterDevice via
    the ControlDeviceState and MiniportCount variables.

    NOTE: do not call this from DriverEntry; it will prevent the driver
    from being unloaded (e.g. on uninstall).

Arguments:

    None

Return Value:

    NDIS_STATUS_SUCCESS if we successfully register a device object.

--*/
{
    NDIS_STATUS            Status = NDIS_STATUS_SUCCESS;
    UNICODE_STRING         DeviceName;
    UNICODE_STRING         DeviceLinkUnicodeString;
    PDRIVER_DISPATCH       DispatchTable[IRP_MJ_MAXIMUM_FUNCTION+1];

    DBGPRINT(("==>PtRegisterDevicen"));

    NdisAcquireSpinLock(&GlobalLock);

    ++MiniportCount;
    
    if (1 == MiniportCount)
    {
        ASSERT(ControlDeviceState != PS_DEVICE_STATE_CREATING);

        //
        // Another thread could be running PtDeregisterDevice on
        // behalf of another miniport instance. If so, wait for
        // it to exit.
        //
        while (ControlDeviceState != PS_DEVICE_STATE_READY)
        {
            NdisReleaseSpinLock(&GlobalLock);
            NdisMSleep(1);
            NdisAcquireSpinLock(&GlobalLock);
        }

        ControlDeviceState = PS_DEVICE_STATE_CREATING;

        NdisReleaseSpinLock(&GlobalLock);

        NdisZeroMemory(DispatchTable, (IRP_MJ_MAXIMUM_FUNCTION+1) * sizeof(PDRIVER_DISPATCH));

// BEGIN_PTUSERIO
        DispatchTable[IRP_MJ_CREATE] = DevOpen;
        DispatchTable[IRP_MJ_CLEANUP] = DevCleanup;
        DispatchTable[IRP_MJ_CLOSE] = DevClose;
        DispatchTable[IRP_MJ_DEVICE_CONTROL] = DevIoControl;
// END_PTUSERIO

        NdisInitUnicodeString(&DeviceName, NTDEVICE_STRING);
        NdisInitUnicodeString(&DeviceLinkUnicodeString, LINKNAME_STRING);

        //
        // Create a device object and register our dispatch handlers
        //
        
        Status = NdisMRegisterDevice(
                    NdisWrapperHandle,
                    &DeviceName,
                    &DeviceLinkUnicodeString,
                    &DispatchTable[0],
                    &ControlDeviceObject,
                    &NdisDeviceHandle
                    );

        NdisAcquireSpinLock(&GlobalLock);

        ControlDeviceState = PS_DEVICE_STATE_READY;
    }

    NdisReleaseSpinLock(&GlobalLock);

    DBGPRINT(("<==PtRegisterDevice: %xn", Status));

    return (Status);
}

问题是:通过WIN32子系统调用DeviceIoControl 函数
(代码IOCTL_PTUSERIO_ENUMERATE)后,
出现蓝平,接着消失,死机.是何原因?
DevIoControl代码如下:

NTSTATUS
DevIoControl(
    IN PDEVICE_OBJECT    pDeviceObject,
    IN PIRP              pIrp
    )
/*++

Routine Description:

    This is the dispatch routine for handling device ioctl requests.

Arguments:

    pDeviceObject - Pointer to the device object.

    pIrp - Pointer to the request packet.

Return Value:

    Status is returned.

--*/
{
    PIO_STACK_LOCATION  pIrpSp;
    NTSTATUS            NtStatus = STATUS_SUCCESS;
    ULONG               BytesReturned = 0;
    ULONG               FunctionCode;
    PUCHAR              ioBuffer = NULL;
    ULONG               inputBufferLength;
    ULONG               outputBufferLength;
    
    UNREFERENCED_PARAMETER(pDeviceObject);
    
    pIrpSp = IoGetCurrentIrpStackLocation(pIrp);
    
    ioBuffer = pIrp->AssociatedIrp.SystemBuffer;
    inputBufferLength  = pIrpSp->Parameters.DeviceIoControl.InputBufferLength;
    outputBufferLength = pIrpSp->Parameters.DeviceIoControl.OutputBufferLength;
    
    FunctionCode = pIrpSp->Parameters.DeviceIoControl.IoControlCode;
    
    DBGPRINT(("==>Pt DevIoControl: Context %pn", (pIrpSp->FileObject)->FsContext ));
    
    switch (FunctionCode)
    {
        case IOCTL_PTUSERIO_ENUMERATE:
         return( DevEnumerateBindings(
                  pDeviceObject,
                  pIrp
                  )
               );

        case IOCTL_PTUSERIO_OPEN_ADAPTER:
         return( DevOpenAdapter(
                  pDeviceObject,
                  pIrp,
                  FALSE        // Is Lower Adapter
                  )
               );

        case IOCTL_PTUSERIO_QUERY_INFORMATION:
         return( DevQueryInformation(
                  pDeviceObject,
                  pIrp,
                  FALSE        // Is Lower Adapter
                  )
               );

        case IOCTL_PTUSERIO_SET_INFORMATION:
        default:
            NtStatus = STATUS_NOT_SUPPORTED;
            break;
    }
    
    if (NtStatus != STATUS_PENDING)
    {
        pIrp->IoStatus.Information = BytesReturned;
        pIrp->IoStatus.Status = NtStatus;
        IoCompleteRequest(pIrp, IO_NO_INCREMENT);
    }
    
    DBGPRINT(("<== Pt DevIoControln"));
    
    return NtStatus;
}



谢谢！
 

[编辑 -  12/27/04 by  zhaoyanghong]

问题已经找到:
为下面语句造成:
DBGPRINT(( "Adding VA Name : %d, %d, 42%*.*ws42n",
            (*ppCursor)->DeviceName.Length,
            (*ppCursor)->DeviceName.MaximumLength,
            (*ppCursor)->DeviceName.Length/sizeof( wchar_t ),
            (*ppCursor)->DeviceName.Length/sizeof( wchar_t ),
            (*ppCursor)->DeviceName.Buffer
            ));

请教高人?分析原因?


[编辑 -  12/28/04 by  zhaoyanghong]

问题已经找到:
为下面语句造成:
DBGPRINT(( "Adding VA Name : %d, %d, \042%*.*ws\042\n",
            (*ppCursor)->DeviceName.Length,
            (*ppCursor)->DeviceName.MaximumLength,
            (*ppCursor)->DeviceName.Length/sizeof( wchar_t ),
            (*ppCursor)->DeviceName.Length/sizeof( wchar_t ),
            (*ppCursor)->DeviceName.Buffer
            ));

   我查了一下，原因应为：驱动程序在等于或高于DISPATCH_LEVEL的IRQL上访问了分页内存。
error code 0x0a
0X0000000A(0XC10500DA,0X00000002,0X00000000,0X805037E6)
被引用内存：0XC10500DA
引用IRQL ：2
读操作：0
引用内存：0X805037E6

这种问题很常见

麻烦查一下error code 0x1e的原因?