[Winpcap-users] Winpcap in Intanium machine

[Gianluca Varenni]

----- Original Message ----- 
From: "Fish" <fish at infidels.org>
To: <winpcap-users at winpcap.org>
Sent: Friday, October 09, 2009 7:17 PM
Subject: Re: [Winpcap-users] Winpcap in Intanium machine


> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Gianluca Varenni wrote:
>
> [...]
>> The exception code 80000002 means
>> a.. 0x80000002: STATUS_DATATYPE_MISALIGNMENT indicates that an
>> unaligned data reference was encountered.
>>
>> and it's probably because the Itanium doesn't allow unaligned access
>> to memory (i.e. if you try to access a 64bit integer, its address
>> should be aligned to 64bit). x86 and x64 do not have such requirement,
>> and the WinPcap driver relies on that.
>
> Forgive me for asking, but WHY does WinPcap *rely* on unaligned access?!

There are a number of reasons for that, but one of them is simply that 
WinPcap was developed over the years by people (including myself) that were 
still learning about problems like misaligned access.
In general there are two reasons for misaligned access in the WinPcap 
driver:
1. due to an implementation choice, the packets are stored in the ring 
buffer without any padding, so the header prepended to each packet can start 
at a non-aligned address. This is what probably causes the crash that the OP 
is experiencing. This can be changed (by putting padding bytes at the right 
spots) but requires touching a very critical part of the capture engine (the 
ring buffer code).
2. when we access the packet contents for filtering, the header fields are 
inevitably misaligned. In that case the only solution would be using macros 
when reading the header fields from the packets to avoid misalignment errors 
on architectures like Itanium (this is exactly what wireshark does). Since 
we decided not to support Itanium, we relied on the fact that unaligned 
accesses are supported on x86/x64 (the platforms that we support).

I hope this answers your questions.

Have a nice day
GV


>
> Just because a particular CPU architecture doesn't *require* operand 
> alignment for certain instructions doesn't mean that one doesn't need to 
> bother trying to ensure that ALL of its data fields are properly aligned!
>
> I mean, it may work on certain architectures (such as x86 and x64) but you 
> WILL pay a significant performance penalty.
>
> And as the OP is discovering, on certain architectures (such as the 
> Itanium) such programs will not even run.
>
> I would personally treat that as a BUG that needs to be fixed.
>
> - -- 
> "Fish" (David B. Trout) - fish at softdevlabs.com
> Fight Spam! Join CAUCE! <http://www.cauce.org/>
> 7 reasons why HTML email is a bad thing
> http://www.georgedillon.com/web/html_email_is_evil.shtml
> PGP key fingerprints:
> DH/DSS: 9F9B BAB0 BA7F C458 1A89 FE26 48F5 D7F4 C4EE 3E2A
> RSA: 6B37 7110 7201 9917 9B0D 99E3 55DB 5D58 FADE 4A52
>
>
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Desktop 9.8.0 (Build 2158)
> Charset: utf-8
>
> wj8DBQFKz+7HSPXX9MTuPioRAiobAJ9NIIVSqrQyUw5RY8hiwYBc+Hu99ACfR5gL
> QHL3VOX5aY4NWoTpUHhuTJY=
> =gBx4
> -----END PGP SIGNATURE-----
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users