Can I use any std: C++ or collection class like map or set or list?

NTDEV
1

I like to ignore a set of files in file system filter driver. Is there any way I can use the set or map ?

2

STL does not work in the kernel, mostly because C++ exceptions cannot be tolerated. You'll have to roll your own.

3

There are many examples of libraries, similar to STL, that implement these containers without using C++ exceptions.

Otherwise, you need to implement API for exception processing and link this library with your driver. There will be unresolved symbols at link stage for compiler added symbols to throw and catch C++ exceptions. You must also catch all C++ exceptions inside your module as kernel doesn't know how to deal with them. I think there should be some examples of such libraries in public domain.

4

We can disable exceptions in STL with /Kernel option.
Here is code from STL:

#ifndef _HAS_EXCEPTIONS // Predefine as 0 to disable exceptions
    #ifdef _KERNEL_MODE
        #define _HAS_EXCEPTIONS 0
    #else
        #define _HAS_EXCEPTIONS 1
    #endif /* _KERNEL_MODE */
#endif /* _HAS_EXCEPTIONS */


#if _HAS_EXCEPTIONS
#define _TRY_BEGIN try {
#define _CATCH(x) \
    }             \
    catch (x) {
#define _CATCH_ALL \
    }              \
    catch (...) {
#define _CATCH_END }

#define _RERAISE    throw
#define _THROW(...) throw(__VA_ARGS__)

#else // ^^^ _HAS_EXCEPTIONS / !_HAS_EXCEPTIONS vvv
#define _TRY_BEGIN \
    {              \
        if (1) {
#define _CATCH(x) \
    }             \
    else if (0) {
#define _CATCH_ALL \
    }              \
    else if (0) {
#define _CATCH_END \
    }              \
    }

For example GitHub - jxy-s/stlkrn: C++ STL in the Windows Kernel with C++ Exception Support is using STL but the exception handling is custom implementation. Or we can disable the exceptions.

5

STL uses exceptions handling to report errors from constructors and other functions which do not return values. If exception handling is disabled how a constructor will report an error? How a memory allocation failure will be processed? The only option is to BugCheck the system into BSOD from a custom memory allocator. I do not think this is a reasonable option for a driver.

1 Like
6

This is a good point. And indeed I opted to bugcheck. But in general if the system starts to fail memory allocations, a driver would hardly recover or continue to function properly. Maybe my decision is wrong, if it would prove it's not acceptable, then maybe I should use that custom implementation of exceptions ( vcrtl).

7

The usual way to do this in fs filters is to use the rtl generic table functions, see RtlInitializeGenericTableAvl.

8

it is important that drivers and other system level code does continue to function properly during low memory situations and when allocations fail. There are even tests for this in verifier.

9

Well, to be painfully literal, kernel drivers do not have to "continue to function properly" during low memory situations. That would be impossible for many drivers. What they have to do is "not crash".