advisory, added to svn:

type: security
subject: Updated kernel packages fix security vulnerabilities
CVE:
 - CVE-2021-28711
 - CVE-2021-28712
 - CVE-2021-28713
 - CVE-2021-28714
 - CVE-2021-28715
src:
  8:
   core:
     - kernel-5.15.11-2.mga8
     - kmod-virtualbox-6.1.30-1.6.mga8
     - kmod-xtables-addons-3.18-1.40.mga8
description: |
  This kernel update is based on upstream 5.15.11 and fixes atleast the
  following security issues:

  Potentially malicious XEN PV backends can cause guest DoS due to unhardened
  frontends in the guests, even though this ought to have been prevented by
  containing them within a driver domain. This update fixes the issue tracked
  as XSA-391: blkfront (CVE-2021-28711), netfront (CVE-2021-28712),
  hvc_xen (CVE-2021-28713).

  The Linux kernel's xen-netback backend driver can be forced by guests to
  queue arbitrary amounts of network data, finally causing an out of memory
  situation in the domain the backend is running in (usually dom0). This
  update fixes the issues tracked as XSA-392 (CVE-2021-28714, CVE-2021-28715).

  In addition to the upstream changes, we also have added the following fixes:
  - ALSA: hda/hdmi: Disable silent stream on GLK
  - arm64: vdso32: require CROSS_COMPILE_COMPAT for gcc+bfd
  - ext4: check for inconsistent extents between index and leaf block
  - ext4: check for out-of-order index extents in ext4_valid_extent_entries()
  - ext4: prevent partial update of the extent blocks
  - HID: intel-ish-hid: ipc: Specify no cache snooping on TGL and ADL
  - HID: potential dereference of null pointer
  - iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
  - KVM: VMX: clear vmx_x86_ops.sync_pir_to_irr if APICv is disabled
  - net: amd-xgbe: Add Support for Yellow Carp Ethernet device
  - net: usb: lan78xx: add Allied Telesis AT29M2-AF
  - netfs: fix parameter of cleanup()
  - NFSD: Fix READDIR buffer overflow
  - PM: sleep: Fix error handling in dpm_prepare()
  - rtw89: 8852a: correct bit definition of dfs_en
  - revert: "rtw88: 8821c: disable the ASPM of RTL8821CE"
  - rtw88: add quirk to disable pci caps on HP 250 G7 Notebook PC
  - rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE
  - rtw88: don't check CRC of VHT-SIG-B in 802.11ac signal
  - rtw88: 8822c: update rx settings to prevent potential hw deadlock

  For other upstream fixes, see the referenced changelogs.
references:
 - https://bugs.mageia.org/show_bug.cgi?id=29813
 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.11
 - https://xenbits.xen.org/xsa/advisory-391.html
 - https://xenbits.xen.org/xsa/advisory-392.html

Keywords: (none) => advisory

MGA8-64, AMD K6-9225, APU, Gnome, laptop

The following 3 packages are going to be installed:

- cpupower-5.15.11-2.mga8.x86_64
- kernel-desktop-5.15.11-2.mga8-1-1.mga8.x86_64
- kernel-desktop-latest-5.15.11-2.mga8.x86_64

76MB of additional disk space will be used.

--rebooted--

wifi works
suspend works
firefox works
libreoffice works

working as designed.

CC: (none) => brtians1

MGA8-64,AMD x3-450, Nvidia 730GT (390) - running Plasma

The following 12 packages are going to be installed:

- cpupower-5.15.11-2.mga8.x86_64
- dkms-nvidia390-390.147-1.mga8.nonfree.x86_64
- kernel-desktop-5.15.11-2.mga8-1-1.mga8.x86_64
- kernel-desktop-devel-5.15.11-2.mga8-1-1.mga8.x86_64
- kernel-desktop-devel-latest-5.15.11-2.mga8.x86_64
- kernel-desktop-latest-5.15.11-2.mga8.x86_64
- nvidia390-cuda-opencl-390.147-1.mga8.nonfree.x86_64
- nvidia390-doc-html-390.147-1.mga8.nonfree.x86_64
- nvidia390-utils-390.147-1.mga8.nonfree.x86_64
- virtualbox-kernel-5.15.11-desktop-2.mga8-6.1.30-1.6.mga8.x86_64
- virtualbox-kernel-desktop-latest-6.1.30-1.6.mga8.x86_64
- x11-driver-video-nvidia390-390.147-1.mga8.nonfree.x86_64

126MB of additional disk space will be used.

-- rebooted

$ uname -a
Linux localhost 5.15.11-desktop-2.mga8 #1 SMP Fri Dec 24 13:58:31 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

# lsmod | grep nvidia
nvidia_uvm            933888  0
nvidia_drm             53248  1
drm_kms_helper        307200  1 nvidia_drm
nvidia_modeset       1060864  20 nvidia_drm
nvidia              15888384  685 nvidia_uvm,nvidia_modeset
ipmi_msghandler        69632  2 ipmi_devintf,nvidia
drm                   622592  4 drm_kms_helper,nvidia_drm

- video driver is working
- browser is working
- suspend works
- hosting VirtualBox is working

works for me.

 a new kernel is coming with another added fix

Keywords: (none) => feedback

addendum to advisory:


  In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11,
  there is an out-of-bounds memory access when an inode has an invalid last
  xattr entry (CVE-2021-45469).

  restored legacy NTLM support in cifs (mga#29641)


new rpms to test:

SRPMS:
kernel-5.15.11-3.mga8.src.rpm
kmod-virtualbox-6.1.30-1.7.mga8.src.rpm
kmod-xtables-addons-3.18-1.41.mga8.src.rpm



i586:
bpftool-5.15.11-3.mga8.i586.rpm
cpupower-5.15.11-3.mga8.i586.rpm
cpupower-devel-5.15.11-3.mga8.i586.rpm
kernel-desktop-5.15.11-3.mga8-1-1.mga8.i586.rpm
kernel-desktop586-5.15.11-3.mga8-1-1.mga8.i586.rpm
kernel-desktop586-devel-5.15.11-3.mga8-1-1.mga8.i586.rpm
kernel-desktop586-devel-latest-5.15.11-3.mga8.i586.rpm
kernel-desktop586-latest-5.15.11-3.mga8.i586.rpm
kernel-desktop-devel-5.15.11-3.mga8-1-1.mga8.i586.rpm
kernel-desktop-devel-latest-5.15.11-3.mga8.i586.rpm
kernel-desktop-latest-5.15.11-3.mga8.i586.rpm
kernel-doc-5.15.11-3.mga8.noarch.rpm
kernel-server-5.15.11-3.mga8-1-1.mga8.i586.rpm
kernel-server-devel-5.15.11-3.mga8-1-1.mga8.i586.rpm
kernel-server-devel-latest-5.15.11-3.mga8.i586.rpm
kernel-server-latest-5.15.11-3.mga8.i586.rpm
kernel-source-5.15.11-3.mga8-1-1.mga8.noarch.rpm
kernel-source-latest-5.15.11-3.mga8.noarch.rpm
kernel-userspace-headers-5.15.11-3.mga8.i586.rpm
libbpf0-5.15.11-3.mga8.i586.rpm
libbpf-devel-5.15.11-3.mga8.i586.rpm
perf-5.15.11-3.mga8.i586.rpm

xtables-addons-kernel-5.15.11-desktop-3.mga8-3.18-1.41.mga8.i586.rpm
xtables-addons-kernel-5.15.11-desktop586-3.mga8-3.18-1.41.mga8.i586.rpm
xtables-addons-kernel-5.15.11-server-3.mga8-3.18-1.41.mga8.i586.rpm
xtables-addons-kernel-desktop586-latest-3.18-1.41.mga8.i586.rpm
xtables-addons-kernel-desktop-latest-3.18-1.41.mga8.i586.rpm
xtables-addons-kernel-server-latest-3.18-1.41.mga8.i586.rpm



x86_64:
bpftool-5.15.11-3.mga8.x86_64.rpm
cpupower-5.15.11-3.mga8.x86_64.rpm
cpupower-devel-5.15.11-3.mga8.x86_64.rpm
kernel-desktop-5.15.11-3.mga8-1-1.mga8.x86_64.rpm
kernel-desktop-devel-5.15.11-3.mga8-1-1.mga8.x86_64.rpm
kernel-desktop-devel-latest-5.15.11-3.mga8.x86_64.rpm
kernel-desktop-latest-5.15.11-3.mga8.x86_64.rpm
kernel-doc-5.15.11-3.mga8.noarch.rpm
kernel-server-5.15.11-3.mga8-1-1.mga8.x86_64.rpm
kernel-server-devel-5.15.11-3.mga8-1-1.mga8.x86_64.rpm
kernel-server-devel-latest-5.15.11-3.mga8.x86_64.rpm
kernel-server-latest-5.15.11-3.mga8.x86_64.rpm
kernel-source-5.15.11-3.mga8-1-1.mga8.noarch.rpm
kernel-source-latest-5.15.11-3.mga8.noarch.rpm
kernel-userspace-headers-5.15.11-3.mga8.x86_64.rpm
lib64bpf0-5.15.11-3.mga8.x86_64.rpm
lib64bpf-devel-5.15.11-3.mga8.x86_64.rpm
perf-5.15.11-3.mga8.x86_64.rpm

virtualbox-kernel-5.15.11-desktop-3.mga8-6.1.30-1.7.mga8.x86_64.rpm
virtualbox-kernel-5.15.11-server-3.mga8-6.1.30-1.7.mga8.x86_64.rpm
virtualbox-kernel-desktop-latest-6.1.30-1.7.mga8.x86_64.rpm
virtualbox-kernel-server-latest-6.1.30-1.7.mga8.x86_64.rpm

xtables-addons-kernel-5.15.11-desktop-3.mga8-3.18-1.41.mga8.x86_64.rpm
xtables-addons-kernel-5.15.11-server-3.mga8-3.18-1.41.mga8.x86_64.rpm
xtables-addons-kernel-desktop-latest-3.18-1.41.mga8.x86_64.rpm
xtables-addons-kernel-server-latest-3.18-1.41.mga8.x86_64.rpm

Keywords: feedback => (none)

MGA8-64, AMD x3-450, Nvidia 730GT (390), Plasma


The following 9 packages are going to be installed:

- dkms-nvidia390-390.147-1.mga8.nonfree.x86_64
- kernel-desktop-5.15.11-3.mga8-1-1.mga8.x86_64
- kernel-desktop-devel-5.15.11-3.mga8-1-1.mga8.x86_64
- kernel-desktop-devel-latest-5.15.11-3.mga8.x86_64
- kernel-desktop-latest-5.15.11-3.mga8.x86_64
- nvidia390-cuda-opencl-390.147-1.mga8.nonfree.x86_64
- nvidia390-doc-html-390.147-1.mga8.nonfree.x86_64
- nvidia390-utils-390.147-1.mga8.nonfree.x86_64
- x11-driver-video-nvidia390-390.147-1.mga8.nonfree.x86_64

126MB of additional disk space will be used.


-- rebooted

$ uname -a
Linux localhost 5.15.11-desktop-3.mga8 #1 SMP Sat Dec 25 10:44:47 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

# lsmod | grep nvidia
nvidia_uvm            933888  0
nvidia_drm             53248  1
drm_kms_helper        307200  1 nvidia_drm
nvidia_modeset       1060864  22 nvidia_drm
nvidia              15888384  785 nvidia_uvm,nvidia_modeset
ipmi_msghandler        69632  2 ipmi_devintf,nvidia
drm                   622592  4 drm_kms_helper,nvidia_drm

- libreoffice working as expected
- firefox working
- audo works/videos are smooth

Clean update of 24 packages, server and desktop kernels.
Reboot OK with wifi network live and NAS drive on line.
Kernel: 5.15.11-desktop-3.mga8 x86_64
Intel Core i9-7900X
NVIDIA GP102 [GeForce GTX 1080 Ti] driver: nvidia v: 470.94

bluetooth audio working without a hitch.
nvidia tests OK.
$ stress -c 5 -i 2 -m 3 -d 2 -t 25
stress: info: [57491] dispatching hogs: 5 cpu, 2 io, 3 vm, 2 hdd
stress: FAIL: [57499] (563) mkstemp failed: Permission denied
stress: FAIL: [57491] (394) <-- worker 57499 returned error 1
stress: WARN: [57491] (396) now reaping child worker processes
stress: FAIL: [57491] (451) failed run completed in 0s
$ stress -c 4 -t 25
stress: info: [63763] dispatching hogs: 4 cpu, 0 io, 0 vm, 0 hdd
stress: info: [63763] successful run completed in 25s
Other stress tests succeeded individually but the disk i/o failed:
$ stress -d 3 -t 20
stress: info: [86777] dispatching hogs: 0 cpu, 0 io, 0 vm, 3 hdd
stress: FAIL: [86780] (563) mkstemp failed: Permission denied
stress: FAIL: [86777] (394) <-- worker 86780 returned error 1
stress: WARN: [86777] (396) now reaping child worker processes
stress: FAIL: [86777] (451) failed run completed in 0s

devtmpfs                   16G     0   16G   0% /dev
tmpfs                      16G     0   16G   0% /dev/shm
tmpfs                      16G  1.8M   16G   1% /run
tmpfs                      16G     0   16G   0% /tmp
tmpfs                     2.0G   24M  2.0G   2% /home/lcl/.cache
tmpfs                     3.2G  132K  3.2G   1% /run/user/1000

/dev/sda3                  53G   17G   34G  33% /

$ dmesg
[   30.271901] FS-Cache: Duplicate cookie detected
[   30.271904] FS-Cache: O-cookie c=00000003 [p=00000002 fl=222 nc=0 na=1]
[   30.271906] FS-Cache: O-cookie d=00000000a3b5de30{NFS.server} n=00000000629cc5b6
[   30.271908] FS-Cache: O-key=[16] '040000000200000002000801c0a801e0'
[   30.271913] FS-Cache: N-cookie c=00000004 [p=00000002 fl=2 nc=0 na=1]
[   30.271914] FS-Cache: N-cookie d=00000000a3b5de30{NFS.server} n=0000000022f589e8
[   30.271915] FS-Cache: N-key=[16] '040000000200000002000801c0a801e0'
[   30.275068] FS-Cache: Duplicate cookie detected
[   30.275071] FS-Cache: O-cookie c=00000005 [p=00000002 fl=222 nc=0 na=1]
[   30.275073] FS-Cache: O-cookie d=00000000a3b5de30{NFS.server}
[...]
$ sudo stress -d 2 -t 10
stress: info: [139101] dispatching hogs: 0 cpu, 0 io, 0 vm, 2 hdd
stress: info: [139101] successful run completed in 10s

Everything else is behaving normally.

CC: (none) => tarazed25

Installed all desktop kernel and rebooted smoothly.
5.15.11-desktop-3.mga8, x86_64
Quad Core Intel Core i7-4790
NVIDIA GM204 [GeForce GTX 970] driver: nvidia v: 470.74

NFS shares and NAS drive folders mounted.
Bluetooth USB audio available on demand.
Ran scheduled updates.

$ stress -c 4 -i 3 -m 3 -t 25
stress: info: [68063] dispatching hogs: 4 cpu, 3 io, 3 vm, 0
$ stress -d 4 -t 20
stress: info: [72637] dispatching hogs: 0 cpu, 0 io, 0 vm, 4 hdd
stress: info: [72637] successful run completed in 20s

No problem there.
Other desktop applications working as expected.

No regressions noticed.

Tested in x86-64 on a desktop, a laptop, and in a vb guest.
Tested aarch64 on rpi4b, and i586 in a vb guest.

CC: (none) => davidwhodgins

Installed desktop and server kernels with the other packages excluding virtualbox.  Smooth reboot.
5.15.11-desktop-3.mga8, x86_64
6-Core Intel Core i7-10710U
Intel Comet Lake UHD Graphics driver: i915
Intel Comet Lake PCH-LP CNVi WiFi driver: iwlwifi
Intel Ethernet I219-V driver: e1000e

The Mate desktop is running as expected.  Bluetooth and pulseaudio working fine together - Youtube video in firefox.  NAS drive mounted - Windows controller accessible via firefox.  This machine is the fileserver for the network.  NFS shares accessible on other machines.

$ glmark2
    OpenGL Information
    GL_VENDOR:     Intel
    GL_RENDERER:   Mesa Intel(R) UHD Graphics (CML GT2)
    GL_VERSION:    4.6 (Compatibility Profile) Mesa 21.3.2

Ran to completion.

stress tests OK - monitored via gkrellm.  Everything else OK so far.

MGA8-32, Mate, AMD x2-3800, 6150le graphics (Nouveau)

Installed cpupower and kernel server

# uname -a
Linux localhost.localdomain 5.15.11-server-3.mga8 #1 SMP Sat Dec 25 12:10:06 UTC 2021 i686 i686 i386 GNU/Linux


using this as nextcloud test server - working as expected.
graphics working
machine is booting

OK here, tested with recently updated nvidia-current

Installed:

- cpupower-5.15.11-3.mga8.x86_64
- kernel-desktop-5.15.11-3.mga8-1-1.mga8.x86_64
- kernel-desktop-devel-5.15.11-3.mga8-1-1.mga8.x86_64
- kernel-desktop-devel-latest-5.15.11-3.mga8.x86_64
- kernel-desktop-latest-5.15.11-3.mga8.x86_64
- kernel-userspace-headers-5.15.11-3.mga8.x86_64
- virtualbox-kernel-5.15.11-desktop-3.mga8-6.1.30-1.7.mga8.x86_64
- virtualbox-kernel-desktop-latest-6.1.30-1.7.mga8.x86_64


rebooted,

$ uname -a
Linux svarten.tribun 5.15.11-desktop-3.mga8 #1 SMP Sat Dec 25 10:44:47 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

$ dkms status showing OK

BOINC detects CUDA and OpenCL (but no work to test)


Hardware: My workstation "svarten": Mainboard: Sabertooth P67, CPU: i7-3770, RAM 16G, GM107 [GeForce GTX 750] using nvidia-current; GeForce 635 series and later, 4k display.  Disk&Filesystem: SSD with /boot/EFI and ext4 /boot, LUKS{LVM {swap, ext4 /home & / } and a spinner at /mnt/spinner


Tested:  Plasma desktop; using Thunderbird, LibreOffice, Ktorrent, Nextcloud client, Firefox ESR, flatpak Firefox, flatpak Spotify, java program FriBOK, ...
Stress test: While working with other things BOINC use all cores to 100%, videos do not stutter in Chromium, nor Firefox ESR but do in flatpak version.
 VirtualBox: Launched my usual MSW7pro-64, tests OK: bidirectional clipboard, shared folders write protected and not, USB2 memory stick read&write (using upstream extension pack), drag file from Dolphin to Windows Explorer, Windows update, video playing in Firefox and Chrome while CPU is heavily loaded.

CC: (none) => fri

MGA8-64 Plasma on Lenovo B50 in Dutch
No installattion issues for:
bpftool-5.15.11-3.mga8.x86_64.rpm
cpupower-5.15.11-3.mga8.x86_64.rpm
cpupower-devel-5.15.11-3.mga8.x86_64.rpm
kernel-doc-5.15.11-3.mga8.noarch.rpm
kernel-server-5.15.11-3.mga8-1-1.mga8.x86_64.rpm
kernel-server-devel-5.15.11-3.mga8-1-1.mga8.x86_64.rpm
kernel-server-devel-latest-5.15.11-3.mga8.x86_64.rpm
kernel-server-latest-5.15.11-3.mga8.x86_64.rpm
kernel-userspace-headers-5.15.11-3.mga8.x86_64.rpm
lib64bpf-devel-5.15.11-3.mga8.x86_64.rpm
lib64bpf0-5.15.11-3.mga8.x86_64.rpm
perf-5.15.11-3.mga8.x86_64.rpm
xtables-addons-kernel-5.15.11-server-3.mga8-3.18-1.41.mga8.x86_64.rpm
xtables-addons-kernel-server-latest-3.18-1.41.mga8.x86_64.rpm

Rebooted and found no problems with wifi, intrenet accessn file types odt, ods, odb, odp, pdf, ogg. Access fto nfsshares from desktop PC iss OK.
Was this kernel supposed to solve some cifs problem??? Tested installation from samba update lately:
# systemctl -l status smb
● smb.service - Samba SMB Daemon
     Loaded: loaded (/usr/lib/systemd/system/smb.service; disabled; vendor preset: disabled)
     Active: active (running) since Mon 2021-12-27 10:12:45 CET; 1min 1s ago
       Docs: man:smbd(8)
             man:samba(7)
             man:smb.conf(5)
   Main PID: 7232 (smbd)
     Status: "smbd: ready to serve connections..."
      Tasks: 4 (limit: 9397)
     Memory: 10.9M
        CPU: 70ms
     CGroup: /system.slice/smb.service
             ├─7232 /usr/sbin/smbd --foreground --no-process-group
             ├─7234 /usr/sbin/smbd --foreground --no-process-group
             ├─7235 /usr/sbin/smbd --foreground --no-process-group
             └─7236 /usr/sbin/smbd --foreground --no-process-group

dec 27 10:12:45 mach5.hviaene.thuis systemd[1]: Starting Samba SMB Daemon...
dec 27 10:12:45 mach5.hviaene.thuis smbd[7232]: [2021/12/27 10:12:45.995141,  0] ../../lib/util/become_daemon.c:135(daemon_ready)
dec 27 10:12:45 mach5.hviaene.thuis smbd[7232]:   daemon_ready: daemon 'smbd' finished starting up and ready to serve connections
dec 27 10:12:45 mach5.hviaene.thuis systemd[1]: Started Samba SMB Daemon.

Tested connection to SMB shares issued by desktop PC using smbclient: works OK.
Used smbclient on desktop PC to connect to smb shares on this laptop, also OK.

CC: (none) => herman.viaene

Dell Inspiron 5100, 32-bit P4, 2GB RAM, Radeon RV200 graphics, Atheros-based wifi, 32-bit Xfce system using the desktop kernel.

No installation issues. After reboot, changed cursor theme, watched a few seconds of two videos in Parole, checked local TV weather site in Firefox. The last seemed a little slow to render, but then I noticed that Adblock Plus had blocked 36 ads, which is probably enough to explain it. Used MCC to install the Xfce weather panel app, and removed some old kernels.

No issues noted.

CC: (none) => andrewsfarm

This has been running for three days on Quad Core Intel Core i7 with nvidia GTX970, driver nvidia 470.94 ,without any issues.

Thanks for the tests, flushing out

Keywords: (none) => validated_update
Whiteboard: (none) => MGA8-64-OK, MGA8-32-OK
CC: (none) => sysadmin-bugs

Just a little slow with this report, but...

Intel i5-2500, Intel graphics, normally wired Internet but also has the rtl8192eu driver installed, 64-bit Plasma system using the server kernel.

I had not used this install in a while, and it needed to be updated to the 5.15.10 kernel first. I checked for operation of the rtl8192eu device, and proceeded with that update. After the reboot, everything OK, including the operation of the wifi device. For the record, this particular install is using the net_applet to make connections.

Used qarepo to get the 64-bit packages, then went on with the update, with no installation issues. The rtl8192eu driver module appeared to build and install properly. After the reboot I checked, and everything again seems OK, including the rtl8192eu driver. However...

Another set of hardware, this time an AMD Phenom II X4 910, AMD HD 8490 graphics, 64-bit Plasam install using the desktop kernel. Normally, this install uses an Atheros-based wifi PCI card to connect to the Internet, but it can also use the rtl8192eu device. It uses Network Manager to manage wifi.

This install had already been using the 5.15.10 kernel, but I had never checked the rtl8192eu driver on that one. The update to the 5.15.11 kernel went smoothly, and the rtl8192eu driver appeared to build normally. However, Network Manager refuses to connect using the rtl device. Other than that, it seems OK.

Since it works on one machine and not the other, I doubt that the kernel is at fault. There are other differences between the two installs that need to be investigated. Once I have done that, I will open a new bug about the rtl8192eu driver with those results.

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0588.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Just noting that I (and maybe someone else) forgot to test update lib64bpf0

I did not notice i have had it installed before, but now it was.

With regard to Comment 17, the rtl8192eu device not working on the AMD-based hardware was apparently due to the way I had Network Manager set up. I found my error, corrected it, and it now seems to work.