>From: Arturo Borrero Gonzalez [mailto:art...@debian.org] > >@Matthew, we are wondering whether hyperscan is able to detect SSE3 support at >runtime in a given machine.
In Hyperscan v4.3 we don't have those cpuid tests. The next release (v4.4, due before the end of the year) will have these checks, with an API call to check that the current machine supports what target the Hyperscan library was built for. So means that Suricata could be linked to Hyperscan, and at runtime the machine can be checked to see if Hyperscan can be used. The next release will also have the ability to be built as a "fat" library. The Hyperscan runtime can be built in a number of configurations for different levels of instruction set features (SSSE3, SSSE4.2+POPCNT, AVX2), and combined in the one library, and then use the GCC ifunc ("resolver") attribute to select the correct implementation at runtime, or if there is no SSSE3 a version of the runtime API that returns an error instead of ungracious SIGILL. We still require a minimum of SSSE3, but the hope is that this will simplify things for users. I'm hoping to get that into our devel branch on Github soon so it can be tested more widely. Matt.