XL710 Malicious Driver Detection Event Occured

[ihsu8]

Hello, I've got some abnormal event in XL710 like as below.

헤더 1

kernel: i40e 0000:03:00.0: Malicious Driver Detection event 0x02 on TX queue 12 PF number 0x00 VF number 0x00

kernel: i40e 0000:03:00.0: TX driver issue detected, PF reset issued

by upper msg, my XL710 NIC was reset, and then link down/up occured.

I want to know, what does means "Malicious Driver Detection in XL710",

And, What is trigging condition that situation?

Thank you

[EZheg]

And I bet this is FreeBSD you are getting these on.

[EZheg]

After some consideration I realized that this is probably Linux. Long story short: this isn't happening to you - that's what the Intel support told me whan I had a chat with them not long ago about the exactly same issue. Although some people tend to see this.

I guess it's a driver issue. I mean the Intel driver, since yours is too from Intel definitely. Use X710, at least is what I do. If you have an Intel manufactured card - you can try to persuade them this isn't your imagination and you're actually seeing this. Mine was Supermicro "manufactured", so Intel said that's their issue (spoling - Supermicro spent two months just top avoid the reproduction of this issue in their lab, probably because they do know where it leads - to the same support dead end) , in the same time support guy told me that "they have no issue reports with this error on the original Intel boards", so, again, if your board is manufactured by the Itel - you could try.

[idata]

Hi Hsuivan,

Thank you for the inquiry. Will check on this.rgds,wb

[idata]

HI Hsuivan,

Can you provide more information about what is the exact NVMe firmware version and the exact XL710 NIC model? Thanks,wb

[idata]

HI Hsuivan,

Please feel free to provide the firmware version.Thanks,wb

[EZheg]

Well, I'm not the original topic starter, but if you're still interested, here it is:

ixl0: mem 0xfb000000-0xfb7fffff,0xfb808000-0xfb80ffff irq 56 at device 0.0 numa-domain 1 on pci13

ixl0: Using MSIX interrupts with 9 vectors

ixl0: fw 5.0.40043 api 1.5 nvm 5.02 etid 80002391 oem 1.261.0

ixl0: PF-ID[0]: VFs 64, MSIX 129, VF MSIX 5, QPs 768, I2C

ixl0: Allocating 8 queues for PF LAN VSI; 8 queues active

ixl0: Ethernet address: 0c:c4:7a:19:71:e0

ixl0: PCI Express Bus: Speed 8.0GT/s Width x8

ixl0: SR-IOV ready

So it's 5.0.4, at least it's what the kernel shows.

nvmupdate64e shows different version, but also tells that update is not available:

./nvmupdate64e

Intel(R) Ethernet NVM Update Tool

NVMUpdate version 1.28.19.4

Copyright (C) 2013 - 2016 Intel Corporation.

WARNING: To avoid damage to your device, do not stop the update or reboot or power off the system during this update.

Inventory in progress. Please wait [|.........]

Num Description Ver. DevId S:B Status

=== ======================================== ===== ===== ====== ===============

01) Intel(R) 82599 10 Gigabit Dual Port 64.37 10FB 00:001 Update not

Network Connection available

02) Intel(R) Ethernet Controller XL710 for 5.02 1583 00:131 Update not

40GbE QSFP+ available

[idata]

Hi Hsuivan,

Thank you for the information. I will check if we have anything to share.rgdswb

[idata]

Hi Hsuivan,

Please try update the firmware to 5.05. Feel free to update me. https://downloadcenter.intel.com/download/24769/Non-Volatile-Memory-NVM-Update-Utility-for-Intel-Ethernet-Converged-Network-Adapter-XL710-and-X710-SeriesThanks,wb

[idata]

Hi Hsuivan,

Please feel free to update me the result.Thanks,wb

[JHart10]

Hi wb,

Having the same issue, I'll update the firmware on my card and give you an update. Links are in a 4-link Lagg running FreeBSD 10 using the ixl driver for the X710 on a Dell S4048-ON switch running FTOS 9.10P4

Running X710-DA4 - Firmware 4.40 a1.4 n04.53 e8000206d

[idata]

Hi Hsuivan,

Thank you for the information. Please do let me know the result if you upgraded the firmware to 5.05.thankswb

[idata]

Hi Hsuivan,

Please feel free to update me the result of the firmware update.Thanks,wb

[idata]

Hi Hsuivan,

Additional information for your reference. The malicious driver detection is a feature supported by the NIC, please refer to the information at http://www.intel.com/content/dam/www/public/us/en/documents/release-notes/xl710-ethernet-controller-feature-matrix.pdf http://www.intel.com/content/dam/www/public/us/en/documents/release-notes/xl710-ethernet-controller-feature-matrix.pdf This feature monitors queues and VFs for malformed descriptors that might indicate a malicious or buggy driver, which might be applicable in your case.Thanks,wb

[EZheg]

Yeah, but the thing is - we are using Intel drivers. Latest ones provided on the Intel site. So...

[idata]

Hi Hsuivan,

Have you updated the firmware? Thank you.rgds,wb

[idata]

Hi Hsuivan,

Please update me if you have updated the firmware and further assistance needed.rgds,wb

[CSmit29 · Accepted solution]

Malicious Driver Detection (MDD) Event - Resolved - New 1.7.11 i40en driver

How is this issue being addressed?

The Malicious Driver Detection issue that we are aware of is addressed in the 1.7.11 i40en driver release for ESXi 6.0, ESXi 6.5 and ESXi 6.7.

Available 1.7.11 i40en driver Download Links: For Intel Ethernet 700 Series Network Adapters ( X710, XL710, XXV710, and X722)

https://my.vmware.com/web/vmware/details%3FdownloadGroup%3DDT-ESXI60-INTEL-I40EN-1711%26productId%3D564 ESXi 6.0 i40en 1.7.11 Driver

https://my.vmware.com/web/vmware/details%3FdownloadGroup%3DDT-ESXI65-INTEL-I40EN-1711%26productId%3D614 ESXi 6.5 i40en 1.7.11 Driver

https://my.vmware.com/web/vmware/details%3FdownloadGroup%3DDT-ESXI67-INTEL-I40EN-1711%26productId%3D742 ESXi 6.7 i40en 1.7.11 Driver

For more information please see the blog post: /community/tech/wired/blog/2018/05/23/malicious-driver-detection-mdd-event-resolved Malicious Driver Detection (MDD) Event – Resolved