Re: Intel X710  on Huawei server-malicious driver detection appear in the log

Hi Jrgallego,

    Thank you for the post and I am sorry to hear what happened. Please share where did you download the driver for the X710 network card? Please provide the link.

Regards,
Sharon T 

Driver link: https://my.vmware.com/web/vmware/details?downloadGroup=DT-ESXI65-INTEL-I40EN-158&productId=614https://my.vmware.com/web/vmware/details?downloadGroup=DT-ESXI65-INTEL-I40EN-158&productId=614

Hi Jrgallego,

Thank you for the information. Are these X710 network card Intel retail unit or OEM model?

For Intel retail version, you can check Board # (PBA) at this website List of Supported Retail Intel® Ethernet Adapters

If the NICs are OEM, they will have different Board# (PBA).

Or you can follow the Identify your adapter PCI Device ID in the website to check the Vendor and Device ID.

Regards,
Sharon T

Hi Jrgallego,

   We will be also checking here in case we have information to share. Thanks.

Regards,
Sharon T 

Hi Jrgallego,

 Thank you for the reply. I don't have information about the driver release, I need to double check. 

Regards,
Sharon T 

I am also experiencing the same issue with the driver putting the port into a failed mode (causing ESX top drop 100% of the packets on that nic)

ESXi 6.5 U1, 7967591

2018-04-20T17:50:11.627Z cpu20:66324)i40en: i40en_HandleMddEvent:6969: Malicious Driver Detection event 0x02 on TX queue 0 PF number 0x01 VF number 0x00

2018-04-20T17:50:11.627Z cpu20:66324)i40en: i40en_HandleMddEvent:6995: TX driver issue detected, PF reset issued

We have also tried different HP firmware and driver levels.  We are using the HP 562SFP+ and 562FLR-SFP+ cards (based on the Intel X710 chip).

Digging around I found this in the release notes from the Intel driver package:

In a virtualized environment, on Intel(R) Server Adapters that support SR-IOV,

the virtual function (VF) may be subject to malicious behavior.

Software-generated frames are not expected and can throttle traffic between the

host and the virtual switch, reducing performance. To resolve this issue,

configure all SR-IOV enabled ports for VLAN tagging. This configuration allows

unexpected, and potentially malicious, frames to be dropped.

I do have some options on our HP DL380 Gen10 servers that may fix the driver failing but we will not be able to additional testing for a few days at least.  I wanted to see if you have tried either enabling VLAN support for the NIC in the UEFI/BIOS or turning off SR-IOV entirely for the NIC/SYSTEM from the UEFI/BIOS?

Hi Jrgallego,

  Further checking, the information I received is Malicious Driver Detection is and open issue for ESX i40en driver version 1.5.8. The Malicious Driver Detection issue that we are aware of will be addressed in the next i40en driver release. The next driver is going through VMware Certification process and expected to release in a couple of weeks.   We will have an official statement on this issue by next week. Thank you for your patience on this matter. 

Regards,
Sharon T

Hi Jrgallego,

  Please refer to our latest update about the Malicious Driver Detection Event at 
https://communities.intel.com/community/tech/wired/blog/2018/05/23/malicious-driver-detection-mdd-event-resolved

   
Thanks,
Sharon T