Preview Tool

Cisco Bug: CSCvu18143 - JI 2866147 - CPU cache corruption

Last Modified

Sep 27, 2020

Products (11)

  • Cisco ASR 9000 Series Aggregation Services Routers
  • Cisco ASR 9910 Router
  • Cisco ASR 9922 Router
  • Cisco IOS XR Software
  • Cisco ASR 9010 Router
  • Cisco ASR 9904 Router
  • Cisco ASR 9006 Router
  • Cisco ASR 9001 Router
  • Cisco ASR 9901 Router
  • Cisco ASR 9906 Router
View all products in Bug Search Tool Login Required

Known Affected Releases


Description (partial)


Kernel Crash
Exception at 0xfe6c50fa signal 5 c=2 f=0

According both AMD and Intel specs, the  processor may cache translations required for prefetches and for accesses that are a result of speculative execution that would never actually occur in the executed code path. In some latest AMD processors, we have seen that the TLB entries of msg xfer slots not currently being used are cached by the CPU with some stale PTE values. This happens because after we use the msg xfer slots, we leave the slots stay there untouched, the present bit is still on with the PDE entry. If the memory pointed to by the PDE is freed, it can be filled with anything, if the values happens to turn on the global bit, the speculative TLB caching can follow the valid PDE entry to load it into TLB buffer, the TLB then can never be flushed by reloading CR3. This will cause corrupted data or EFAULT when we use the slot next time. We need to implement the vmm_unmap_xfer to clear the PDE entries for the xfer slot to prevent the speculative TLB caching.

normal operation
Bug details contain sensitive information and therefore require a account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.