Evidence WinXP "security updates" may break Linux

**Henk Poley** · 05-27-2003, 01:50 PM

I've had strange problems with my networkcard on Morphix (but not on Knoppix) when I did a warm reboot from Win98.

**Harry Kuhman** · 05-28-2003, 10:12 PM

For anyone who missed it (mentioned here in another less read thread), Microsoft has pulled a "Windows Security Update" that was just released last Friday (long after this topic showed up here) because it was breaking networking on some systems. I can't help but wonder if it wasn't more of the kind of thing we have been seeing, but this time affected their own systems too. The story is at: http://news.yahoo.com/news?tmpl=stor..._bug&printer=1

I have been working with ethtool to try to understand why my NIC no longer starts up properly under KNoppix when it did six weeks ago. Using the command to dump the register settings I can see a number of registers are changed between when I first start and after I reset the nic with mii-tool. It still looks like an auto-negotiation issue to me, but it certainly could be that something else is keeping the auto-negotiation from happening (I do have some doubts about it being auto-negotiation because I can't rationalize how I can still receive packets with the unreset nic at 10 mbs, I just can't send packets with it). I'm posting the differences below (not all the register settings, which are much more detailed) in case they will help anyone else working on this or on the chance that someone can look at them and give me a better idea of what is going wrong. It's still a little long, but shouldn't be a problem unless you print this forum to read later:

Difference in register settings as reported by ethtool
between non-functional network and reset working network.
Not all regeister and not all decoded bits for shown registers
are listed here, mainly only differences in the register
values are shown.

After windows security update on power up (network not working):

Mac/BIU Registers
-----------------
0x00: CR (Command): 0x00000000
Receive Idle
0x04: CFG (Configuration): 0x8005e000
Auto-Negotiation Not Done
Half Duplex
10 Mb/s
0x10: ISR (Interrupt Status): 0x00018000
High Bits Error Interrupt: Active
Rx Status FIFO Overrun Interrupt: Active
0x18: IER (Interrupt Enable): 0x00000000
Interrupts Disabled
0x20: TXDP (Tx Descriptor Pointer): 0x19405260
0x24: TXCFG (Tx Config): 0x10f01002
Heartbeat Ignore Disabled
Carrier Sense Ignore Disabled
0x30: RXDP (Rx Descriptor Pointer): 0x00000000
0x34: RXCFG (Rx Config): 0x00700020
Tx Packets Rejected
0x3c: CCSR (CLKRUN Control/Status): 0x00008100
Power Management Enabled
0x40: WCSR (Wake-on-LAN Control/Status): 0x0000000a
0x44: PCR (Pause Control/Status): 0x00200000
Pause Negotiated
0x50: BRAR (Boot ROM Address): 0xffff0004
0x5c: MIBC (Mgmt Info Base Control): 0x00000002
Counters Frozen
0xe4: PHYCR (Phy Control): 0x00bf
Pause Compatible with Link Partner

Internal Phy Registers
----------------------
0x80: BMCR (Basic Mode Control): 0x0080
Auto-Negotiation Disabled
0x84: BMSR (Basic Mode Status): 0x784d
Auto-Negotiation Not Complete
0x90: ANAR (Autoneg Advertising): 0x05e1
Protocol Selector = 0x01 (1)
Advertising 10Base-T Half Duplex
Advertising 10Base-T Full Duplex
Advertising 100Base-TX Half Duplex
Advertising 100Base-TX Full Duplex
Advertising Pause
0xc0: PHYSTS (Phy Status): 0x0003
Link Up
10 Mb/s
Half Duplex
Auto-Negotiation Not Complete

'Magic' Phy Registers
---------------------
0xe4: PMDCSR: 0x109c
0xf4: DSPCFG: 0x5040
0xf8: SDCFG: 0x088c
0xfc: TSTDAT: 0x0000

After mii-tool -r and netcardconfig (network working):

Mac/BIU Registers
-----------------
0x00: CR (Command): 0x00000004
Receive Active
0x04: CFG (Configuration): 0xe805e000
Auto-Negotiation Done
Full Duplex
100 Mb/s
0x10: ISR (Interrupt Status): 0x00000000
No Interrupts Active
0x18: IER (Interrupt Enable): 0x00000001
Interrupts Enabled
0x20: TXDP (Tx Descriptor Pointer): 0x116d3280
0x24: TXCFG (Tx Config): 0xd0f01002
Heartbeat Ignore Enabled
Carrier Sense Ignore Enabled
0x30: RXDP (Rx Descriptor Pointer): 0x116d30d0
0x34: RXCFG (Rx Config): 0x10700020
Tx Packets Accepted
0x3c: CCSR (CLKRUN Control/Status): 0x00008000
Power Management Disabled
0x40: WCSR (Wake-on-LAN Control/Status): 0x0200000a
Broadcast Packet Received
0x44: PCR (Pause Control/Status): 0x00000000
Pause Not Negotiated
0x50: BRAR (Boot ROM Address): 0xffff0010
0x5c: MIBC (Mgmt Info Base Control): 0x00000000

Internal Phy Registers
----------------------
0x80: BMCR (Basic Mode Control): 0x1000
Auto-Negotiation Enabled
0x84: BMSR (Basic Mode Status): 0x786d
Auto-Negotiation Complete
0x90: ANAR (Autoneg Advertising): 0x0181
Protocol Selector = 0x01 (1)
Advertising 100Base-TX Half Duplex
Advertising 100Base-TX Full Duplex
0xc0: PHYSTS (Phy Status): 0x0615
Link Up
100 Mb/s
Full Duplex
Auto-Negotiation Complete
0xe4: PHYCR (Phy Control): 0x003f
Not Pause Compatible with Link Partner

'Magic' Phy Registers
---------------------
0xe4: PMDCSR: 0x189c
0xf4: DSPCFG: 0x5040 <-(only this register not changed)
0xf8: SDCFG: 0x108c
0xfc: TSTDAT: 0x0024

[/b]

**JSearles** · 05-29-2003, 12:16 PM

Harry, thanks for being such a bulldog on this issue. I have been following it for just about a week. I just found out about Knoppix about 10 days ago. When I got my copy in the mail, I went straight to an old 98 PC. In less than 2 minutes I was on the internet via a wireless nic. To say that I am impressed is a gross understatement. If I were in M$ shoes, I would be very concerned. This is entirely too easy.

I said all of that to say that getting to the bottom of this issue is extremely important to me because of an upcoming project that could be incredibly simplified with Knoppix, but most of my users have XP home. I have a Dell XP ,Pro box with an Intel 8255x NIC that I really need to use Knoppix on, but am terrified. I have several computers in varying configurations and even more NIC cards that I could put at the disposal of this project if it would help. It seems though that you have already done a thorough job of rooting out the core issue. Now finding a solution is the key.

I am not a Linux techie, but I follow directions well. I have spent all of my professional life in the "M$atrix". Being welcomed into the "Real World" has been both a shock and a welcome relief.

Let me know if I can help.

**Harry Kuhman** · 05-30-2003, 08:53 AM

Originally Posted by JSearles

Let me know if I can help.

One thing you and everyone else can do to help, and this may very well help you a lot more than it helps me, is to record as much information as you can for your NIC now while it is still working. I've been using the card specific tools found at http://www.scyld.com/diag/ and I suggest starting there. Get the utility for your NIC, compile it, and save the register settings (-e and -ee options). I would suggest piping this and any other output you can get from the program to a text file on the hard drive for later reference. If I had this information for my new expensive notebook NIC I expect I could restore it to working, as it is I need to use a few commands to get things going each time I boot (at least they work, some users report they don't work for them).

There is also a utility called ethtool that has been in Knoppix since the 3-May-03 release. If you have an older version, I suggest upgrading. ethtool will print out some very detailed register information, and well as claiming to print out eeprom info. Unfortunately, in my case the eeprom info does not match what the nic specific diagnostic reported, and it looks like ethtool is wrong, but at this point I would still reecord any and all information I could get ethtool to pump out about the NIC.

Hopefully you will not see the problem and will not need the information, but it's far better to get it now than curse not having it later like I'm doing. (You've been warned, I wasn't). It would have been very handy to the cause if "KMAN" had recorded this, if his problem posted tonight turns out to be the same problem.

And of course, if you do see a loss of the ability to connect on the network, try to write down everything you know you did to the system since it last connected to the network with Knoppix. This includes any bootable CDs including other versions of Knoppix or other bootable Linux versions, and anything booted from your hard disk. If you can remember anything you ran or did on-line, make a note of it. Try to ping any other local system you might have, or if you have no local network record an ip address of a close machine at your ISP and try to ping that. If the ping fails, look for and report any error messages you are seeing on your network connection.

Another thing I would appreciate if you or anyone else can do is search as many Linux forums and news groups as you can looking for other indications that people are seeing this. If it is really what I think it is there should be lots of traffic about it, but I have looked and I'm not finding that. Maybe I'm just doing a bad job of searching, would like to know. On the other hand, it wouldn't affect anyone except dual boot people (users replacing Windows with Linux might find that their nic doesn't work, but only dual boot people can know it worked yesterday and not today, and only CD boot people will be certain that their Linux wasn't changed), so users like Knoppix users are more likely to be experiencing the problem than Linux users at large if it is related to something another OS does.

**kingarthur** · 05-30-2003, 01:51 PM

Hi folks,

perhaps I haven't spent enough time to go through all posts but enough to realize that networking connection is a real (and most important!) problem with Knoppix HD install...
I have installed on separate HD's Win95 and the Knoppix ISO-3.2 in order to keep the win harddisk untouched as well as practice a bit.
Sad as it is, I have gone nuts to work around my networking problem only to realize that this is common: booting up from CD everithing is OK; after installing on HD, internet browsing is gone.
By the way, this is important, I am using dial-up connection hence no relation with NIC eproms.... Sorry to disappoint a lot of you

Nothing to do also with XP security issue as well as good old Bill Gates....
Any comments out there?

Pieter

**stevethayne** · 05-30-2003, 07:39 PM

Harry (and others)
Have used 3 of the 4 versions of Morphix. Each of them connected to the net fine on first try. Each of them failed to connect on a subsequent immediate boot without having booted into Windows first. Went back to a new cd of Knoppix (newer version), connected fine to the net. I left it running for 2 days - net connection maintained fine. Rebooted today, could not get a connect to the net - again without having first booted into windows. I genuinely don't understand this. Could Knoppix and it's variants
be relying on something present on the network after a windows boot that isn't there after a knoppix boot and connect? Could my provider be actively blocking Knoppix connections once they're identified as such? Any ideas?

**Harry Kuhman** · 05-30-2003, 07:51 PM

Originally Posted by stevethayne

Harry (and others)
Have used 3 of the 4 versions of Morphix. Each of them connected to the net fine on first try. Each of them failed to connect on a subsequent immediate boot without having booted into Windows first. Went back to a new cd of Knoppix (newer version), connected fine to the net. I left it running for 2 days - net connection maintained fine. Rebooted today, could not get a connect to the net - again without having first booted into windows. I genuinely don't understand this. Could Knoppix and it's variants
be relying on something present on the network after a windows boot that isn't there after a knoppix boot and connect? Could my provider be actively blocking Knoppix connections once they're identified as such? Any ideas?

This is pretty much the opposite of the problem I've been tracking here (you might even want to start a new thread on it).

I think we need more details on your setup before we can come up with good theories. How do you "connect to the net? DSL? Cable modem? Do you have a router, hub or any sort of local network? Can you ping local machines and just not get to the internet or is all networking down? How do you log in to your network connection (if you do at all)? By something in Windows and Knoppix or by a setup in a DSL router like the Linksys? (I'm wondering if Windows is logging in OK but Knoppix isn't) Are you even connecting through eth0 or through something else like a modem? If eth0 then please tell us what you get when you fail and then run ifconfig eth0 and run any other diags you can and see if there is a clue as well.

**kingarthur** · 05-30-2003, 10:37 PM

To Harry and Steve and all others....
I can't see myself as a Linux guru (far, far from that)

however after 19 years of computing and a full one devoted to Debian/Linux on several ports I tell you boys, this is the strangest thing I have ever seen so far...
The last few days I have been posting also on the Italian-Debian ML to find out a solution but nothing so far.
At least, here I found a kind of reassuring learning that I am not fighting alone on this issue....

I have been trying very hard on getting this machine to work testing with the network and changing everything I could possibly think of so far with my (limited) means: Dialup connection works fine, I can ping into my ISP but that's about all I can. Tried several different modems, internal external, still nothing apparently changes.
I also tried NAT forwarding through other UNIX but also this doesn't seem to work even though I can browse the local (home) web server ????
So it seems to affect all NICs at least on my set-up.
To give you the full picture, my windows95 is installed on a (slave) ide hard disk as I wanted to keep everithing untouched on this HD which used to be the Master before I got my hands on it and added another HD fully devoted to Knoppix...
I find it very difficult to see any relation with this problem and Microsoft unless they manage to install a anti-linux virus world wide...

Please let me know if I am the only one having this problem apparently not related to Windows...
However, better would be getting a solution for it as this is a friend's PC which I wanted to turn to Linux....

Bye for now
Pieter

**zipster** · 06-02-2003, 06:02 PM

WEll, add me to this list I guess. For a few weeks I have been telling my friends that I have somehow broken Knoppix"Crazy" they called me. Here is my story.
I run XP Home on my HP laptop - with the same National Semi DP83815 lan card. I had enjoyed knoppix so much that I took the dive partitioned my HD and installed it, I couldnt connect after that, so off I went to find out that one has to turn-on networking in debian by default, ok, did so and went out on the net and happily apt-getted (apt-got?). So after a few days of regular use I boot into Windows and nothing, no net at all. Hmm.. Boot up knoppix, no net either. Well, lots of places to jack in so I try different cable and a new port into windows, nothing. Then back to knoppix, back to windows, windows once more - finally! Boot 4 on windows gets me to the net, knoppix never does. the mii-tool -r netcardconfig trick works for me(as you would expect)
So, not meaning to troll here but I have yet to see this mentioned. Could it be knoppix? As I understand it, this is Debian unstable, and it booted and ran just fine, until after the apt-get update ran. I find it odd that some of the posters have run into this issue with windows 98 and xp systems not set to auto-update. I used an older knoppix (which sadly I cannot recall which one - certainly pre-May) to installl from and I am curious if this isnt the issue. Again - dont get me wrong, I dislike 'ol Bill as much as the next linux hacker, but this does seem to be sort of an odd ranging problem.
So then, I guess the question is what knoppix are you using?? I will try to find all the old downloads and burn/boot and post the results back here. I truely like this distro, and would love to see it back on my laptop (BTW - Mandrake 9.1, which I dumped on there - sees the net just fine) so I will let you know what I find.

-Penguinly Yours
-Zipster

**stevethayne** · 06-02-2003, 06:30 PM

Hi Harry,

I connect through a cable modem (Surfboard it says on the box!) there's no login to the broadband service. Knoppix and Morphix find both ethernet cards on my system, eth 0 and eth 1, and I connect through one of these. There's no local network, it's a standalone computer. Will keep trying with Knoppix, and try to find more info re ifconfig. My plan is also to install another ethernet card (I had two identical, part of a phone networking kit) and try to use Knoppix through that. What I need though is really idiot proof instructions as to how to compare the eeprom settings and anything else on the 2 cards, so that if the previously unused one works, we can see why - can anyone help with this?

Thanks,

Steve.