In article <20110829151339.ga24...@asim.lip6.fr>, Manuel Bouyer <bou...@antioche.eu.org> wrote: >Hello, >I'm working on getting bpf(4) in a 64bit kernel play with a 32bit userland. >I've translated the ioctls, but I'm now stuck with read(). >read(2) on a bpf device returns wire packets (no problems with this) >with a bpf-specific header in front of each packet. This bpf header is: >struct bpf_hdr { > struct bpf_timeval bh_tstamp; /* time stamp */ > uint32_t bh_caplen; /* length of captured portion */ > uint32_t bh_datalen; /* original length of packet */ > uint16_t bh_hdrlen; /* length of bpf header (this struct > plus alignment padding) */ >}; >with: >struct bpf_timeval { > long tv_sec; > long tv_usec; >}; > >and this is the problem (sizeof(bpf_timeval) changes). >It doens't look easy to just move struct bpf_timeval to fixed-size types >(compat issues, I guess this would require a rename of open() or read()). >On the other hand, if bpf(4) did know if the program doing the >open() syscall is 32 or 64bits, it could appends the right header >(could also be done in read() but it's less easy: it would require >translating an existing buffer; while flagging it at open() time >allows to build the right buffer from start). >So: is there a way to know if the emulation used by a userland program >doing an open() is 32 or 64bit ?
Yes, look at PK_32 in the process flags. If you are going to do this, please look at what FreeBSD did with bpf_ts/bpf_xhdr and the time format changes and do the same (provide timespec/bintime etc). This is how they handle compatibility mode too. christos