How to prevent the LWF from be paused?

NTDEV
1

We have been developed a virtual storage adapter driver that using LWF driver.
Sometimes NDIS pause LWF driver while windows is running so disks cannot be read or write.
NIC device is prevented from be removed by notifying that it is in paging path like below but LWF driver is not.

PIO_STACK_LOCATION nextIrpStack = IoGetNextIrpStackLocation(irp);
nextIrpStack->MajorFunction = IRP_MJ_PNP;
nextIrpStack->MinorFunction = IRP_MN_DEVICE_USAGE_NOTIFICATION;
nextIrpStack->Parameters.UsageNotification.InPath = true;
nextIrpStack->Parameters.UsageNotification.Type = DeviceUsageTypePaging;

When the LWF driver’s pause handler is called the stack trace is below.
I suppose some binding has been changed and NDIS is updating bindings (pause and restart).

nt!DbgBreakPointWithStatus
nt!KiBugCheckDebugBreak+0x12
nt!KeBugCheck2+0xdb2
nt!KeBugCheckEx+0x107
CloudNF!wBreak+0x29
CloudNF!HPauseHandler+0x5f
NDIS!ndisFInvokePause+0x8b
NDIS!ndisPauseFilterInner+0x170
NDIS!ndisPauseFilter+0xb4
NDIS!Ndis::BindEngine::Iterate+0x202
NDIS!Ndis::BindEngine::UpdateBindings+0x98
NDIS!Ndis::BindEngine::UpdateBindingsWorkItem+0x44
NDIS!KWorkItemBase<Ndis::BindEngine,KWorkItem<Ndis::BindEngine> >::CallbackThunk+0x11
nt!ExpWorkerThread+0x105
nt!PspSystemThreadStartup+0x55
nt!KiStartSystemThread+0x2a

These are filter logs and all protocols are paused.

"WFP 802.3 MAC Layer LightWeight Filter" -> Paused
"QoS Packet Scheduler" -> Paused
"Cloud NDIS LightWeight Filter" -> Pausing
"WFP Native MAC Layer LightWeight Filter" -> Running

Realtek PCIe GbE Family Controller-WFP 802.3 MAC Layer LightWeight Filter-0000

Ndis handle        ffff860ffdc6c620
Filter driver      ffff860ff7cb4da0 - WFP 802.3 MAC Layer LightWeight Filter
Module context     ffff860ffdc6d760
Miniport           ffff860ff7f501a0 - Realtek PCIe GbE Family Controller
Network interface  ffff860ffdc6c9a0

State              Paused
Datapath           Bypass mode
References         1
Flags              PAUSED

Higher filter      [None]
Lower filter       ffff860ffdc6ac30 - Realtek PCIe GbE Family Controller-QoS Packet Scheduler-0000

Realtek PCIe GbE Family Controller-QoS Packet Scheduler-0000

Ndis handle        ffff860ffdc6ac30
Filter driver      ffff860ff7e3a8e0 - QoS Packet Scheduler
Module context     ffff860ff7c798d0
Miniport           ffff860ff7f501a0 - Realtek PCIe GbE Family Controller
Network interface  ffff860ffdc6b760

State              Paused
Datapath           Send only
References         1
Flags              PAUSED
More flags         OID_TOP

Higher filter      ffff860ffdc6c620 - Realtek PCIe GbE Family Controller-WFP 802.3 MAC Layer LightWeight Filter-0000
Lower filter       ffff860ffdc68a20 - Realtek PCIe GbE Family Controller-Cloud NDIS LightWeight Filter-0000

Realtek PCIe GbE Family Controller-Cloud NDIS LightWeight Filter-0000

Ndis handle        ffff860ffdc68a20
Filter driver      ffff860ff7e17c90 - Cloud NDIS LightWeight Filter
Module context     ffff860ff6b71420
Miniport           ffff860ff7f501a0 - Realtek PCIe GbE Family Controller
Network interface  ffff860ffdc69760

State              Pausing
Datapath           Normal
References         1
Flags              PAUSING

Higher filter      ffff860ffdc6ac30 - Realtek PCIe GbE Family Controller-QoS Packet Scheduler-0000
Lower filter       ffff860ffdc66c20 - Realtek PCIe GbE Family Controller-WFP Native MAC Layer LightWeight Filter-0000

Realtek PCIe GbE Family Controller-WFP Native MAC Layer LightWeight Filter-0000

Ndis handle        ffff860ffdc66c20
Filter driver      ffff860ff7ccad70 - WFP Native MAC Layer LightWeight Filter
Module context     ffff860ffdc68620
Miniport           ffff860ff7f501a0 - Realtek PCIe GbE Family Controller
Network interface  ffff860ffdc68010

State              Running
Datapath           Normal
References         1
Flags              RUNNING

Higher filter      ffff860ffdc68a20 - Realtek PCIe GbE Family Controller-Cloud NDIS LightWeight Filter-0000
Lower filter       [None]
2

Well,in order to realise how absurd your question is, all you have to do is to consider the scenario when underlying NIC gets suspended for the reasons that are totally out of your control. This is what a pause handler is for, in the first place - its task is to take the appropriate steps in a situation like that…

Anton Bassov

3

@anton_bassov said:
Well,in order to realise how absurd your question is, all you have to do is to consider the scenario when underlying NIC gets suspended for the reasons that are totally out of your control. This is what a pause handler is for, in the first place - its task is to take the appropriate steps in a situation like that…

Anton Bassov

I have tested many times for many variable computers and got all same result with above. NIC never get suspended.
I know the pause handler cannot ignore or prevent the pause event but I would want to find out how NDIS not to pause the LWF driver on specific NIC.
(I think iSCSI driver does it in some way.)

4

Windows does not support driving the paging path from a LWF. The OS only supports this for iSCSI from the built-in TCPIP driver, which is special-cased in several ways. Unfortunately, you’ll have a great deal of difficulty eliminating all the 7B bugchecks if you try to do paging from any other network driver.