> Source: [sk181544](https://support.checkpoint.com/results/sk/sk181544) # sk181544 - "kvm_mmu_page_fault" and "pmc_begin_audit_debug_store" errors in /var/log/messages | Property | Value | |----------|-------| | Solution ID | sk181544 | | Date Created | 2023-10-10 | | Last Modified | 2024-09-30 | | Technical Level | Advanced | | Products | Security Gateway | | Versions | R81.20 | | OS | Gaia | ## Symptoms - * /var/log/messages has a high volume of logs, such as:`kernel:error: PMC:24300 CPU_ID: 38 arch/x86/kvm/pmc.c, pmc_begin_audit_debug_store - Can't read the guest_ds_area 0xab000300 of cr3 0x7bc0280, exception = 5` * /var/log/messages has a high volume of logs, such as:`kernel:error: PMC:24300 CPU_ID: 38 arch/x86/kvm/pmc.c, pmc_get_bts_last_record - Can't read the guest_ds_area 0xab000300 of cr3 0x7bc0280, exception = 5` * /var/log/messages has a high volume of logs, such as:`kernel:------------[ cut here ]------------` ` kernel:WARNING: CPU: 38 PID: 24301 at arch/x86/kvm/mmu.c:5614 kvm_mmu_page_fault+0x291/0x3a0 [kvm]` ` kernel:Modules linked in: tun kvm_intel(E) kvm(E) irqbypass vrrp_lkmmod(POE) cppcap(OE) i2c_dev nct6775 hwmon_vid bonding adpmod(OE) 8021q mrp garp wrp(OE) bfd_lkmmod(POE) fw_39(POE) fw_38(POE) fw_37(POE) fw_36(POE) fw_35(POE) fw_34(POE) fw_33(POE) fw_32(POE) fw_31(POE) fw_30(POE) fw_29(POE) fw_28(POE) fw_27(POE) fw_26(POE) fw_25(POE) fw_24(POE) fw_23(POE) fw_22(POE) fw_21(POE) fw_20(POE) fw_19(POE) fw_18(POE) fw_17(POE) fw_16(POE) fw_15(POE) fw_14(POE) fw_13(POE) fw_12(POE) fw_11(POE) fw_10(POE) fw_9(POE) fw_8(POE) fw_7(POE) fw_6(POE) fw_5(POE) fw_4(POE) fw_3(POE) fw_2(POE) fw_1(POE) fw_0(POE) simmod_0(POE) bridge ipv6 stp llc ipsctlmod(OE) ip_gre ip_tunnel gre netloop ext3 jbd dm_multipath parport_pc lp parport sg iTCO_wdt iTCO_vendor_support ixgbe igb dca pcspkr acpi_power_meter hwmon wmi button i2c_algo_bit ptp pps_core i2c_i801 lpc_ich mfd_core dm_snapshot dm_bufio dm_zero dm_mirror dm_region_hash dm_log dm_mod ahci libahci libata sd_mod crc_t10dif crct10dif_common raid1 xfs [last unloaded: irqbypass]` ` kernel:CPU: 38 PID: 24301 Comm: qemu-system-x86 Kdump: loaded Tainted: P W OE ------------ 3.10.0-1160.15.2cpx86_64 #1` ` kernel:Hardware name: CheckPoint TT-40-00/To be filled by O.E.M., BIOS 5.6.5 06/18/2015` ` kernel:Call Trace:` ` kernel: [`] dump_stack+0x1e/0x20 kernel: [] __warn+0xd8/0x100 kernel: [] warn_slowpath_null+0x1d/0x20 kernel: [] kvm_mmu_page_fault+0x291/0x3a0 [kvm] kernel: [] ? __kvm_read_guest_page+0x3c/0x60 [kvm] kernel: [] ? kvm_vcpu_read_guest_page+0xbc/0xe0 [kvm] kernel: [] ? vmx_vcpu_run+0x3a7/0xb70 [kvm_intel] kernel: [] ? vmx_vcpu_r * `Issue found in R81.20 and not in any earlier version. A fresh install of the appliance does not solve the issue.` ## Cause This error message is related to the Kernel Virtual Machine (KVM) on an x86 architecture system, specifically involving Performance Monitoring Counters (PMC). * **kernel:error:** This indicates an error logged by the Linux kernel. * **PMC:24300 CPU_ID: 38:**This specifies the Performance Monitoring Counter (PMC) ID and the CPU ID where the error occurred. * **arch/x86/kvm/pmc.c:** This points to the file and line in the source code where the error happened. * **pmc_begin_audit_debug_store:** This is the function where the error occurred. * **Can't read the guest_ds_area 0xab000300 of cr3 0x7bc0280:**The kernel is unable to read a specific memory area (`guest_ds_area`) from a given control register (CR3) value. CR3 holds the base address of the page table used by the processor for virtual-to-physical address translations. * **exception = 5:**This refers to the type of exception that occurred. In x86 architecture, exception 5 typically corresponds to a "Bound Range Exceeded" exception, which occurs when a value falls outside a defined range.
The error message `kvm_mmu_page_fault` indicates a page fault that has occurred in the KVM Memory Management Unit (MMU). * **KVM (Kernel-based Virtual Machine):** KVM is a virtualization module in the Linux kernel that allows the kernel to act as a hypervisor, enabling virtual machines (VMs) to run. * **MMU (Memory Management Unit):** The MMU is responsible for handling virtual-to-physical address translations and managing memory protection in both the host and guest systems. * **Page Fault:**A page fault occurs when a program tries to access a section of memory that is not currently mapped to the virtual address space. ## Solution This solution requires authentication. Please log in to view the full solution. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content