MIPS

Windows NT supports the MIPS processor, as well as the DEC Alpha and others. For a parser to be MIPS-compliant, it must be careful about aligning its data structures. For example, if you have a structure that looks like:

{
    BYTE  b1;
    BYTE  b2;
    BYTE  b3;
    WORD  w1;
  ...} MyStruct;

  MyStruct *lpMyStruct;
 

or if the MyStruct structure is byte-aligned, you will run into trouble. If b1 is on a QUADWORD boundary, then the WORD w1 will be straddling the QUAD boundary and will cause an exception on a MIPS machine. For the internal data structures that the parser will use, you must always make sure that the data is QUAD-aligned.

The data that the parser is dealing with is another matter. You cannot force the data structure that defines a TCP/IP frame to be aligned in a MIPS-friendly format. There are two ways you can handle this. One is to move the data as an array of bytes into your WORD or DWORD structure before referencing it. Another, cleaner way to handle the problem is to let the compiler do it. For example, if you have a structure called MyParserOverlay that looks like this:

typedef struct _MyParserOverlay {
  BYTE  b1;
  BYTE  b2;
  BYTE  b3;
  WORD  w1;
} MyParserOverlay;
 

and you want to put this overlay on top of a stream of bytes that is part of a frame, the easy way is to define an unaligned pointer.

MyParserOveray UNALIGNED * lpMyParserOverlay = FramePointer;
 

The UNALIGNED keyword will allow you to reference w1 as follows:

if ( lpMyParserOverlay->w1 == 7)
...
 

The compiler at this point moves the bytes into a register a byte at a time and then compares the register to 7. The compiler knows whether the target build environment is big-endian or dword-aligned, and you no longer have to worry about it.

Also note that the Network Monitor code is written with the Intel platform as the target platform. You must tell the kernel when the data pointed at by a parser is byte-swapped. When Windows NT runs on a non-Intel format processor, the kernel takes care of not converting the byte-swapped values and converting the non-byte-swapped values. This implies that you should use the kernel default display formatters and specific formatters whenever possible. Changing the parser is not necessary.