Virtio when developing minifilter

NTDEV
1

Hi,

We are developing a minifilter but we want to use a cloud based solution for development and testing. Our company is very integrated into google and GCP. It appears that they use the virtio for the storage stack. So far this seems to work with our filter but some of the reading I have found seems to suggest that people have had some compatibility issues and that a hyperv solution may be simpler to use.

Does anyone have any recommendations to use or avoid virtio? I want to avoid adding additional complexity or inconsistency that we need to debug as the minifilter seems to have enough complexity on it’s own. Before we look into Azure I want to see if anyone has had issues with virtio.

Thanks for any suggestions.

1 Like
2

How the storage stack is implemented should not affect a filter driver above the filesystem layer. I would be surprised if there are really any compatibility issues. GCP thinks they fully support windows vms.

You might want to see if there is anything over on the NTFSD group here.

3

Interesting question — I’ve actually been working with minifilters recently too, and I’ve noticed that testing on VirtIO setups (especially under QEMU/KVM) sometimes introduces quirks you wouldn’t see on typical hardware or even on Hyper-V.

In my case, certain IRPs behaved slightly differently timing-wise, especially during file close or cleanup operations. Not sure if it's directly due to VirtIO drivers, but it's definitely something to watch out for when debugging.

Curious to hear if others here have run into specific issues or have any best practices when using VirtIO environments for filter driver development. Always good to compare notes!

4

If timing is an issue in your minifilter, you have defects being exposed by timing changes.

5

Thanks for the feedback. So far, we have not noticed too many issues except for the additional configs to get kdnet drivers to load correctly. Once this works it seems to be ok for us. However I was reading some older articles which seem to imply that it is simpler and more reliable to use a hyperv based solution. I wanted to verify if anyone has had issues with non Microsoft solutions.

For testing do people that use virtio have double the test coverage since you need to run all tests on both QEMU/KVM as well as the Microsoft solutions?

Thanks again for any feedback. We just want to make sure we are developing on a stable platform that we can ship and not dealing with other inconsistencies if we can avoid it.

6

A minifilter can be deployed on any windows image, physical or virtual, right? So yes, your test coverage should include standard virtualization platforms.

Debugging on hyper-v is much easier than most other virtualization platforms, as basically no other vendors care.

7

Thanks @Mark_Roddy this is basically what I am seeing too. I do not want to add the extra layer of complexity if it is not necessary. Thanks for the confirmation.