Evidence WinXP "security updates" may break Linux

[Harry Kuhman]

Ok, I'll give it a try later
What version of Knoppix did you use ? (as this thread is pretty old I guess it could have been 3.2 something...)

I did use several 3.2's and all worked fine. Did not use 3.3. But if you try 3.3 from the CD rather than the hard drive and it still fails, please post back just what failed and what message you got when it did and I'll try to duplicate it here with the current release. I'll then let you know if I saw the error or if I compiled fine, and if we both get the error when using CD I'll try to find out what is causing it.

My expectation is still that it's a HD install issue rather than a version issue; and I have not seen anything in the change lists that would seem to let 3.2 compile the code and 3.3 not.

[windos_no_thanks]

Haven't booted from CD yet (all my machines are busy doing something at the moment ) but one of my boxes is a Knoppix 3.2 HD install and it seems to compile the tools without errors. Also, after moving them to the box that failed to compile them the binaries still seem to run.
I dumped M$ way before XP so I don't have anything to test the sabotage theory with but I guess i could help out if someone who knows what his/her MAC address should be (usually printed on the box) needs to get some usable eeprom contents. Iv'e got a Netgear FA312 and a Netgear FA311.

[VTBassMatt]

Harry, et al--

Have there been any updates in progress on this issue? Here is my sad story:

I had a dualboot Windows/Mandrake (8ish? later upgraded to 9.2) setup; both Windows and MDK could talk to the network last summer in my apartment (receiving an IP via DHCP from a network infrastructure-type router, not one of these mini-home-router jobs).

Now, in my current setup, my connection comes in via cable modem to a Linksys 4-port router and then to my onboard VIA Rhine-II Ethernet port. Windows XP (with all updates) connects just fine, receiving an IP address, able to contact the router's web-server config tools, etc.

Linux distributions, on the other hand, are unable to acquire an IP address from the router. I tried a fresh install of Mandrake, a fresh install of Slackware, Knoppix 3.2 and 3.3, and the old install of Mandrake, and none can get an IP, talk to the web-based config tools, etc. They all have the correct driver (via-rhine) loaded, but DHCP broadcast fails. Here's the catch: I was able to use the links web browser in a Gentoo pre-installation environment! The reason I didn't stick with Gentoo involved some user error in setting up the bootloader, and I didn't feel like screwing around with it any more.

I'd really like to use Knoppix/Debian and ditch my Windows partition (finally) but I gotta have my network. Here are the commands I've tried and roughly the respones I got (sorry, I'm at work and not at my home PC):

pump -i eth0: error
"Use DHCP" choice using netcardconfig: DHCP broadcast failed
mii-tool -r: error, no MII interface found

I have not tried VIA's Rhine driver (rhinefet), nor have I tried booting with "knoppix expert". Finally, I have not tried ethtool yet. I will attempt all these over the weekend; any other advice that anyone can provide would be quite helpful. Especially information about how Gentoo sets up its networking differently--as I recall, it was autodetected and I did not have to do anything manually, although that could be a mistaken recollection.

Thanks!

[Harry Kuhman]

Harry, et al--

Have there been any updates in progress on this issue? ....

Sorry, I don't have any resolution. The person who was going to use some tools he had to monitor a new NIC in real time while Microsoft "security updates" were installed backed out due to concerns of jepordizing a business relationship. I'll admit I'm suprised so few people show an interest in this problem.

Certainly try expert mode, as we as the noapic cheat code. You posted a good deal of information, but I do have a couple of questions. I'm not clear on what the actual system is that you're seeing the problem on. If it's a desktop system (not a notebook), could you add an inexpensive NIC that has never experienced the "security updates"? Obviously have Knoppix in the drive before you do or otherwise be sure that the system never boots to Windows after the install until you can do all the Linux testing that you want to do.

Did the failure to connect to the Internet happen exacly when you changed from the old router to the Linksys? Is there any way you could get your hands on the router, or go where it is, just for a test? In my own experience I can tell you that, prior to installing the "security updates", for me Knoppix would talk to and do dhcp from a Linksys BEFSR41 V.2 router fine. I did have DHCP problems with Knoppix and a Belkin router, but that was just one of many problems I had with the Belkin router. Currently my notebook needs the work arounds with either a Linksys or an SMC wireless router attached to my DSL modem, my desktop (that has never run the security updates) boots fine to either.

While my problem with the Belkin router were DHCP failures, the problems booting the notebook now are more low level: I've sniffed the wire and can see that the NIC isn't being set up properly during it's innitial negoiation. If memory servers right the NIC is talking just fine, but isn't receiving properly. Looking at the configuration eeprom and how it can be used, this makes sense: the NIC could be in a mode where it just doesn't autonegoiate properly. For me the "sudo mii-tool -r" trick seems to reset the card and then I can talk fine, including do a dhcp negoitation. Obviously some NICs may be different, but the fact that Windows can bypass whatever has happened to your NIC configuration settings and force it to a working mode indicates that Linux should be able to do it too; although currently most (but not all) versions of Linux seem to trust that the NIC configuration is valid any use it by default.

Please keep us informed on any progress (or failure).

[VTBassMatt]

Alright... updates (none good, it seems):

First-- this is a desktop machine. It's a beige box originally created by a local computer company but let's just say they wouldn't accept it for repairs today even if it were still under warranty [new HD, motherboard, RAM, graphics, and sound]

Tried booting in expert mode and answering no to all the questions. This didn't fix anything, but after seeing the questions, I'm not surprised. They were questions about my SCSI subsystem (really my ATAPI CDRW drive, but that's how kernel 2.4 handles all ATAPI CDRWs), graphics card, mouse, etc.

Have not tried the noapic cheat--too tired of dealing with this to try tonight.

I have another NIC, but I can't be sure that I didn't do some XP updates with it. It's the NIC that came with the machine (originally Windows 2000, got a new hard drive and installed XP instead); I subsequently replaced the motherboard while at my apartment this summer. The new motherboard had onboard Ethernet so I didn't bother to reinstall the PCI NIC, however, it most likely had both 2K and XP updates brought over it.

The mii-tool -r command does not work (either with sudo or in a root console). Also, very little of the ethtool commands seem to work. For instance, ethtool -e doesn't work. Only ethtool eth0 and ethtool -s eth0 seem to work at all. ethtool reports autonegotiation enabled, all four speed/duplex combinations, and that a link is detected. ifup and ifdown report that eth0 is not configured. netcardconfig still cannot do the DHCP broadcast. lspci -v seems to find the card just fine. mii-tool fails with very odd errors, almost as if the card itself is malfunctioning, but clearly it's not, as I'm posting this from my WinXP install on the same hardware.

I will try to redownload and boot from the Gentoo CD which, as you will recall, allowed me to access the net, and run similar diagnostics from it to see if I can find anything different. Thanks for keeping up with this, and if you make any breakthroughs, please let me know about them!!

Regards,
Matt

[VTBassMatt]

In searching for that Gentoo CD (which I have not found yet), I came across this thread: http://forums.gentoo.org/viewtopic.php?t=113390. I am going to try looking in BIOS for a way to reset my onboard NIC (I don't know why this didn't occur to me earlier... probably because it works in Windows but not in Knoppix).

[VTBassMatt]

OK, well, I need to investigate more to discover what's really going on, but the noapic cheat worked! Thanks, everyone, for looking into this, and if I can be of any more service, don't hesitate to ask. Good luck, everyone!

[spatest]

Harry,
Seems that many out there are having a problem with this. Since there seems to many variables perhaps it would be worthwhile to put together some type of matrix to further isolate the problem area. It seems that we need some good hard data to verify and validate what is happening here. Tests should be repeatable with expected results.
I have a spare nic card and would be willing to do some testing for the cause... Your thoughts?

Todd

[Harry Kuhman]

I have a spare nic card and would be willing to do some testing for the cause... Your thoughts?

I would be glad to see someone do some tests and hopefully duplicate the failure in a known and controled situation. While there are reports of people seeing the problem under Win98, I've only seen it under XP. I've never installed any '98 "security update", so I wouldn't expect to have seen it under '98 myself unless it was due to code that was in '98 when it was released. All indications are that it's something much newer than that. Since I don't know how to triger it in Win98, I'll hope you have XP and give my thoughts on the best way to try to duplicate this under XP.

Understand that not all NICs my be affected by this, so failure to duplicate the problem doesn't indicate much unless you use one of the cards known to be affected. Still, I think it's a great idea to try it with the card you have and try to prove the cause. Here are my suggestions:

• Download and compile all of the utilities for your new NIC before you install it. see http://www.scyld.com/diag/index.html
  
  Put the Knoppix CD in your drive befor you install the NIC, just to be sure that you don't boot XP before you get a chance to test things under Knoppix.
  
  Install the new NIC in your desktop. Be sure to unplug the power supply from AC; don't just count on it being powered "off".
  
  Boot into Knoppix and confirm that the NIC works (it certainly should).
  
  Use the utilites you have to make a record of the contents of the configuration eeprom on the NIC.
  
  You are now ready to boot XP. Do so, confirm that you can use the NIC under XP.
  
  I would switch back to Knoppix right away and see if the NIC still works. I expect it will.
  
  Reboot WinXP. Download and install all of the "security updates" for XP. I would love to know which update it is, but don't know any way to accept and install the updates one by one (understand that I've only ever installed the updates once, after my NIC stopped working I stopped accepting them). At this point it's far more impotrtant to confirm the problem than to ID the specific "update" anyway.
  
  Boot Knoppix and test the NIC again.
  
  If you have already accepted and installed some updates before you started, it could well be that the update only gets the NIC that was in the system at the time and doesn't keep checking the NIC. If this seems to be what happens, then my suggestion would be to reinstall XP fresh and have another go at the "security updates". I can understand the reluctance to do this if it would affect a lot of data and other installed programs on your system. Swapping out the hard drive and installing to a different hard drive might be an option in this case (Xp could be installed on a hard drive of a size of just a few gig for this test).
  
  If you can duplicate the problem, the use the same tool to dump the NIC eeprom again.
  
  Obviously, post any and all results, including the type of NIC you used.

I hope you do make some tests. Please post back whatever results you have, positive or negative. Good Luck.

[whitefang]

Hi
First I'm not Knoppix user
Second I have not experienced XP security update bug yet.
It does not seem to me that NIC eeprom settings
have anything to do with 'security'
except for the case of 'Wake On LAN'.
I mentioned a 'Wake ON LAN Password Register' in previous posts
Another thing I've mentioned in mii-diag dumps posted
is 'RX Inderruts Disabled' - this might be another way to prevent
the machine from powering up on 'Wake Packet' arrival at the NIC
Also a good reason to be able only to transmit packets and not to receive a single frame.
It also might be that using 'noacpi' boot option would in some
cases workaround the problem(if the NIC supports WOL only if ACPI is configured, and otherwise ignores EEPROM WOL related settings)
This might be a wrong direction though.
I'll try with mii-diag,rtl8139-diag,via-diag
and installing latest XP updates, and post again later
But i think rtl8139 and via-rhine II are not affected.(just for the record of affected cards list).