ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Enabling linux kernel jit compiler from dumpcap?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 23 Aug 2013 13:22:28 -0700
On Aug 23, 2013, at 1:01 PM, Réczey Bálint <rbalint@xxxxxxxxx> wrote:

> FreeBSD has a different implementation AFAIK

The first implementation was the WinPcap one, for x86-32 or IA-32 or whatever you want to call the 32-bit version of x86.

The FreeBSD people picked that one up, added x86-64 support, and, if I remember, didn't bother to cite the WinPcap folks (Loris Degioanni was a bit annoyed at that, as I remember).

Both have BSDish licenses, which probably got in the way of adopting them for Linux, so I suspect the Linux implementation is independent (just as its implementation of the BPF interpreter is different).

> and covers fewer architectures.

Linux's JIT also handles PPC, although, as POWER/PowerPC/Power ISA has fixed-length instructions, it's apparently not vulnerable to the attack mentioned in the post Jakub cited.  If they decided to support S/3x0-64^Wz/Architecture, that *would* be vulnerable (as would 68k and VAX, among others).