4 ms·

Umm... what exactly is happening?

grzm 10y ago
I'm sure it would be helpful for those who might attempt to reiterate the submission if you described as much as you think you understand to provide some context.
- chris_wot 10y ago
  All right. I didn't understand a thing. Hope this helps.
  - fuzzfactor 10y ago
    Are you presently multibooting or planning to in the future? If so, do you use a Windows 10 (NT6) boot menu to select from other operating systems which incude Windows XP (or presumably other versions of NT5)? Then the defective Microsoft engineering described, applies to your use of XP after it is booted from the W10 menu. Looks like it may also apply to other Windows versions or operating systems like some Linux distributions, so beware. This bug was reported by user Brindusa Tot during operation of Mozilla Firefox. 2015-11-16 Confirmed with difficulty by engineer Yuhong Bao as a defect in the Windows 10 BOOTMGR routine. 2017-01-27 yuhong is on this thread, this is the kind of engineer I would want on my team. Further testing needs to be done to determine if there is an alternative BOOTMGR or procedure which does not suffer from this insidious failure. Mozilla is not a source of this defect at all. It's simply the Microsoft Windows 10 code that's failing to properly do what it says it does.
geofft 10y ago
If I'm understanding this right: - Firefox is seeing a crash associated with use of the AVX vector-processing (~= high-performance math) instructions - The AVX instructions use more registers, and registers need to be saved/restored during a context switch, so you can switch back to a program and have it be transparent. So you can only use AVX if the OS supports it, and promises to save/restore those registers in addition to regular registers when it does a context switch. The OS reports to the CPU "Yes, it's okay to let people use AVX" by setting a bit in a control register. Applications check that bit before using AVX instructions. - The crash is an illegal-operation exception, which should be impossible because Firefox checks to see if that bit is set before using those instructions. The answer to the mystery: Some people are using an old version of Windows, that does not support AVX, but with a bootloader from a new version of Windows. For whatever reason, the bootloader sets the "Yeah, AVX is fine" bit, and expects the new version of Windows to detect AVX and set support as appropriate. Old versions of Windows don't know about that bit, though, and never clear it. So Firefox proceeds to use AVX on a CPU that has no AVX support. This was discovered by someone mentioning that they were dual-booting Windows versions, and that the crash went away when restoring the older bootloader.
- yuhong 10y ago
  The newer BOOTMGR chains to the older NTLDR which in turns loads XP/Server 2003 or older, and they forgot to clear the bits when chaining.
  - daeken 10y ago
    It seems a bit odd that they'd be enabling AVX in the bootloader. Any idea why they do that? Seems like something for the kernel to do during initialization (like most other features), not the bootloader.
    - prodigal_erik 10y ago
      Does the bootloader choose a kernel entry point based on the CPU features?
      - yuhong 10y ago
        My understanding is that BOOTMGR goes to WINLOAD when booting Vista or later. The routine that ensures the correct CR4/XCR0 values in this case is called bootmgr!ArchRestoreProcessorFeatures and it is called just before bootmgr!BlBdStop in bootmgr!ArchExecuteTransition.
- aaronmdjones 10y ago
  "So Firefox proceeds to use AVX on a CPU that has no AVX support". To make it clear; it uses AVX on a CPU that does support it (otherwise you'd run into an illegal instruction error), but the OS doesn't. Firefox doesn't know this, however, because it thinks the OS set the bit that says it does.
  - geofft 10y ago
    Oh, does VZEROUPPER generate an illegal instruction if the OS has set the control register bit but has not called XSETBV? OK, that makes more sense.

grzm 10y ago

I'm sure it would be helpful for those who might attempt to reiterate the submission if you described as much as you think you understand to provide some context.

chris_wot 10y ago
All right. I didn't understand a thing. Hope this helps.
- fuzzfactor 10y ago
  Are you presently multibooting or planning to in the future? If so, do you use a Windows 10 (NT6) boot menu to select from other operating systems which incude Windows XP (or presumably other versions of NT5)? Then the defective Microsoft engineering described, applies to your use of XP after it is booted from the W10 menu. Looks like it may also apply to other Windows versions or operating systems like some Linux distributions, so beware. This bug was reported by user Brindusa Tot during operation of Mozilla Firefox. 2015-11-16 Confirmed with difficulty by engineer Yuhong Bao as a defect in the Windows 10 BOOTMGR routine. 2017-01-27 yuhong is on this thread, this is the kind of engineer I would want on my team. Further testing needs to be done to determine if there is an alternative BOOTMGR or procedure which does not suffer from this insidious failure. Mozilla is not a source of this defect at all. It's simply the Microsoft Windows 10 code that's failing to properly do what it says it does.

geofft 10y ago

If I'm understanding this right: - Firefox is seeing a crash associated with use of the AVX vector-processing (~= high-performance math) instructions - The AVX instructions use more registers, and registers need to be saved/restored during a context switch, so you can switch back to a program and have it be transparent. So you can only use AVX if the OS supports it, and promises to save/restore those registers in addition to regular registers when it does a context switch. The OS reports to the CPU "Yes, it's okay to let people use AVX" by setting a bit in a control register. Applications check that bit before using AVX instructions. - The crash is an illegal-operation exception, which should be impossible because Firefox checks to see if that bit is set before using those instructions. The answer to the mystery: Some people are using an old version of Windows, that does not support AVX, but with a bootloader from a new version of Windows. For whatever reason, the bootloader sets the "Yeah, AVX is fine" bit, and expects the new version of Windows to detect AVX and set support as appropriate. Old versions of Windows don't know about that bit, though, and never clear it. So Firefox proceeds to use AVX on a CPU that has no AVX support. This was discovered by someone mentioning that they were dual-booting Windows versions, and that the crash went away when restoring the older bootloader.

yuhong 10y ago
The newer BOOTMGR chains to the older NTLDR which in turns loads XP/Server 2003 or older, and they forgot to clear the bits when chaining.
- daeken 10y ago
  It seems a bit odd that they'd be enabling AVX in the bootloader. Any idea why they do that? Seems like something for the kernel to do during initialization (like most other features), not the bootloader.
  - prodigal_erik 10y ago
    Does the bootloader choose a kernel entry point based on the CPU features?
    - yuhong 10y ago
      My understanding is that BOOTMGR goes to WINLOAD when booting Vista or later. The routine that ensures the correct CR4/XCR0 values in this case is called bootmgr!ArchRestoreProcessorFeatures and it is called just before bootmgr!BlBdStop in bootmgr!ArchExecuteTransition.
aaronmdjones 10y ago
"So Firefox proceeds to use AVX on a CPU that has no AVX support". To make it clear; it uses AVX on a CPU that does support it (otherwise you'd run into an illegal instruction error), but the OS doesn't. Firefox doesn't know this, however, because it thinks the OS set the bit that says it does.
- geofft 10y ago
  Oh, does VZEROUPPER generate an illegal instruction if the OS has set the control register bit but has not called XSETBV? OK, that makes more sense.