Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Evaluating performance of minifilter

KeternaKeterna Member Posts: 18

Dear fellow developers,

Over the past months, I have written a minifilter which registers some IRP and some system hooks such as PsSetCreateProcessNotifyRoutine_and _ObCallbacks. I would like to evaluate/benchmark the potential loss of time that the driver may have introduced one installed on a system (due to the synchronous code executed, maybe bad coding practices, etc.). Is there a standard approach to evaluate the performance of a minifilter ? My intuitive idea was to perform a lot of file system interactions (e.g., opening/reading/writing/closing files) and processes interactions with and without the driver and compare the results, but I'm not sure if the signal-to-noise ratio would be meaningful enough.

Any thoughts ?

Thanks !

Comments

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,299

    There is no easy answer. Ideally you'd have a series of workloads that mimic the real systems you're going to run on and could take measurements based on those. With a filter often the answer to "which workloads do you want to support?" is "all of them", which isn't very helpful...

    IOzone provides a utility called fileop that does a decent job of generating and measuring a bunch of file system operations. Sounds like you have more than just a file system filter, so you could extend this idea to measure HANDLE/process creation (it comes with source also so that saves you from having to start from scratch). By no means is it perfect and just because you have good fileop numbers doesn't mean you're in the clear, but it's an easy to capture data point.

    If you want to look more at your impact on the system you might want to look into trying standard PC benchmarks with and without your software (e.g. something like PCMark). This can give you a good feel on the application level impact of your software, but the downside is that if you lower the score you really have NO idea what the hell the tests are doing (which is why we're not big on doing this here at OSR).

    Also, don't underestimate dogfooding as a way to get a feel of the performance of your filter. You could nail every performance metric under the sun and it won't matter much to the user if drag and drop in Explorer is suddenly 50% slower. Sometimes nothing beats just using a system with your software on it to get a feel for its real world impact.

    -scott
    OSR

  • KeternaKeterna Member Posts: 18

    Hey Scott ! Many thanks for your great explanation on the status of drivers benchmarking. I decided to write a little application which performs a lot of CreateFile/ReadFile/CloseFile and got very interesting results. I'll probably to do the same for process interactions/creations as well. :)

    Cheers !

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA