aboutsummaryrefslogtreecommitdiffstats
path: root/extras
Commit message (Collapse)AuthorAgeFilesLines
* mini-os: fix various memory leaks in various locationsMatthew Daley2013-09-212-2/+7
| | | | | | | | | | Coverity-ID: 1055827 Coverity-ID: 1055828 Coverity-ID: 1055829 Coverity-ID: 1055830 Coverity-ID: 1055831 Signed-off-by: Matthew Daley <mattjd@gmail.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os: fix various memory leaks in consfrontMatthew Daley2013-09-211-4/+5
| | | | | | | | Coverity-ID: 1055816 Coverity-ID: 1055817 Coverity-ID: 1055818 Signed-off-by: Matthew Daley <mattjd@gmail.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os: fix various memory leaks in pcifrontMatthew Daley2013-09-211-10/+19
| | | | | | Coverity-ID: 1055834-1055840 Signed-off-by: Matthew Daley <mattjd@gmail.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os: fix various memory leaks in netfrontMatthew Daley2013-09-211-6/+11
| | | | | | | Coverity-ID: 1055832 Coverity-ID: 1055833 Signed-off-by: Matthew Daley <mattjd@gmail.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os: fix various memory leaks in {fb, kbd}frontMatthew Daley2013-09-211-17/+31
| | | | | | Coverity-ID: 1055819-1055826 Signed-off-by: Matthew Daley <mattjd@gmail.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os: fix various memory leaks in blkfrontMatthew Daley2013-09-211-4/+7
| | | | | | | Coverity-ID: 1055814 Coverity-ID: 1055815 Signed-off-by: Matthew Daley <mattjd@gmail.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os: fix nodename generation in init_netfrontMatthew Daley2013-09-211-2/+4
| | | | | | | | Using strlen here makes no sense. Coverity-ID: 1056053 Signed-off-by: Matthew Daley <mattjd@gmail.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os: handle possibly overlong _nodename in init_consfrontMatthew Daley2013-09-131-2/+4
| | | | | | | | | The only current user that passes a non-NULL _nodename limits it to 64 bytes anyway. Coverity-ID: 1054993 Signed-off-by: Matthew Daley <mattjd@gmail.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os: fix use-after-free in xs_daemon_close event iterationMatthew Daley2013-09-131-2/+5
| | | | | | | | We need to get the next pointer before the freeing of the event. Coverity-ID: 1056173 Signed-off-by: Matthew Daley <mattjd@gmail.com> Acked-By: Samuel Thibault <samuel.thibault@ens-lyon.org>
* minios: fix xenbus_rm() calls in frontend driversBen Cressey2013-09-104-30/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The commit "minios: refactor xenbus state machine" caused "/state" to be appended to the local value of nodename. Previously the nodename variable pointed to dev->nodename. The xenbus_rm() calls were not updated to reflect this change, and refer to paths that do not exist. For example, shutdown_blkfront() for vbd 2049 would issue these calls: xenbus_rm(XBT_NIL, "device/vbd/2049/state/ring-ref"); xenbus_rm(XBT_NIL, "device/vbd/2049/state/event-channel"); This patch restores the previous behavior, issuing these calls instead: xenbus_rm(XBT_NIL, "device/vbd/2049/ring-ref"); xenbus_rm(XBT_NIL, "device/vbd/2049/event-channel"); This causes frontend drivers to not be properly reset when PV-GRUB exists. Some PV Linux drivers fail to re-initialize frontend devices if PV-GRUB leaves them in this state. Signed-off-by: Ben Cressey <bcressey@amazon.com> Reviewed-by: Matt Wilson <msw@amazon.com> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org> [msw: adjusted commit message to include consequences, split out changes into separate patches] Signed-off-by: Matt Wilson <msw@amazon.com>
* minios: clean up unneeded "err = NULL" in frontend driversBen Cressey2013-09-104-6/+0
| | | | | | | | | | | | | | | This patch removes cases where the error message pointer is already NULL and is then set to NULL. These are harmless, but suggest incorrect practice: the pointer should be passed to free() to deallocate memory prior to reassignment. There are no functional changes in this patch. Signed-off-by: Ben Cressey <bcressey@amazon.com> Reviewed-by: Matt Wilson <msw@amazon.com> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org> [msw: split a larger patch from Ben into this cleanup patch] Signed-off-by: Matt Wilson <msw@amazon.com>
* minios: clean up allocation of char arrays used for xenbus pathsMatt Wilson2013-09-105-16/+16
| | | | | | | | | | This patch cleans up instances of char array allocation where string lengths were manually counted to use strlen() instead. There are no functional changes in this patch. Signed-off-by: Matt Wilson <msw@amazon.com> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-By: Samuel Thibault <samuel.thibault@ens-lyon.org>
* minios: correct char array allocation for xenbus pathsMatt Wilson2013-09-105-10/+13
| | | | | | | | | | | | | | | | | | | The char arrays used to hold xenbus paths have historically been allocated by manually counting the length longest string constants included in constructing the path. This has led to improperly sized buffers, both too large (with little consequence) and too small (which obviously causes problems). This patch corrects the instances where the length was incorrectly calculated by using strlen() on the longest string constant used in building a xenbus path. A follow-on clean-up patch will change all instances to use strlen(). Signed-off-by: Ben Cressey <bcressey@amazon.com> Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-By: Samuel Thibault <samuel.thibault@ens-lyon.org> [msw: split this patch from a larger patch from Ben, reworked to use strlen()] Signed-off-by: Matt Wilson <msw@amazon.com>
* mini-os: eliminate duplicated definition of spin_unlock_waitChen Baozi2013-07-042-2/+2
| | | | | Signed-off-by: Chen Baozi <baozich@gmail.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* libxl: Restrict permissions on PV console device xenstore nodesIan Jackson2013-06-251-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Matthew Daley has observed that the PV console protocol places sensitive host state into a guest writeable xenstore locations, this includes: - The pty used to communicate between the console backend daemon and its client, allowing the guest administrator to read and write arbitrary host files. - The output file, allowing the guest administrator to write arbitrary host files or to target arbitrary qemu chardevs which include sockets, udp, ptr, pipes etc (see -chardev in qemu(1) for a more complete list). - The maximum buffer size, allowing the guest administrator to consume more resources than the host administrator has configured. - The backend to use (qemu vs xenconsoled), potentially allowing the guest administrator to confuse host software. So we arrange to make the sensitive keys in the xenstore frontend directory read only for the guest. This is safe since the xenstore permissions model, unlike POSIX directory permissions, does not allow the guest to remove and recreate a node if it has write access to the containing directory. There are a few associated wrinkles: - The primary PV console is "special". It's xenstore node is not under the usual /devices/ subtree and it does not use the customary xenstore state machine protocol. Unfortunately its directory is used for other things, including the vnc-port node, which we do not want the guest to be able to write to. Rather than trying to track down all the possible secondary uses of this directory just make it r/o to the guest. All newly created subdirectories inherit these permissions and so are now safe by default. - The other serial consoles do use the customary xenstore state machine and therefore need write access to at least the "protocol" and "state" nodes, however they may also want to use arbitrary "feature-foo" nodes (although I'm not aware of any) and therefore we cannot simply lock down the entire frontend directory. Instead we add support to libxl__device_generic_add for frontend keys which are explicitly read only and use that to lock down the sensitive keys. - Minios' console frontend wants to write the "type" node, which it has no business doing since this is a host/toolstack level decision. This fails now that the node has become read only to the PV guest. Since the toolstack already writes this node just remove the attempt to set it. This is a security issue, XSA-57. Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
* tpmif: fix identifier prefixesJan Beulich2013-06-213-17/+17
| | | | | | | | | | The definitions here shouldn't use vtpm_ or VPTM_ as their prefixes, the interface should instead make use of tpmif_ and TPMIF_. This fixes a build failure after syncing the public headers to linux-2.6.18-xen.hg (where a struct vtpm_state already exists). Signed-off-by: Jan Beulich <jbeulich@suse.com> Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* mini-os/x86-64 entry: check against nested events and try to fix upXu Zhang2013-04-221-14/+73
| | | | | | | | | | In hypervisor_callback, check against event re-entrant. If we came from the critical region in interrupt context, try to fix up by coalescing the two stack frames. The execution is resumed as if the second event never happened. Signed-off-by: Xu Zhang <xzhang@cs.uic.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os/x86-64 entry: defer RESTORE_REST until returnXu Zhang2013-04-221-8/+8
| | | | | | | | | | No need to do a RESTORE_REST at this point because if we saw pending events after we enabled event delivery, we have to do a SAVE_REST again. Instead, we do a "lazy" RESTORE_REST, deferring it until actual return. The offset of saved-on-stack rflags register is changed as well. Signed-off-by: Xu Zhang <xzhang@cs.uic.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os/x86-64 entry: remove unnecessary event blockingXu Zhang2013-04-221-1/+0
| | | | | | | | | | | | We don't need to block events here because: - if we came from "hypervisor_callback", events are disabled at this point, no need to block again; - if we came from "error_entry", we shouldn't touch event mask, for exception hanlding are meant to be interrupted by Xen events (virtual irq). Signed-off-by: Xu Zhang <xzhang@cs.uic.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os/x86-64 entry: code refactoring; no functional changesXu Zhang2013-04-221-56/+57
| | | | | | | | | Re-arrange assembly code blocks so that they are in called order instead of jumping around, enhancing readability. Macros are grouped together as well. Signed-off-by: Xu Zhang <xzhang@cs.uic.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os/x86-64 entry: define macros for registers partial save and restoreXu Zhang2013-04-221-15/+22
| | | | | | | | | | No functional changes. For saving and restoring registers rbx, rbp, and r12-r15, define and use macros SAVE_REST and RESTORE_REST respectively. Signed-off-by: Xu Zhang <xzhang@cs.uic.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os/x86-64 entry: code clean-ups; no functional changesXu Zhang2013-04-221-30/+31
| | | | | | | Make use of tabs and spaces consistent in arch/x86/x86_64.S Signed-off-by: Xu Zhang <xzhang@cs.uic.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os/tpmback: add tpmback_get_peercontextDaniel De Graaf2013-04-124-0/+36
| | | | | | | This allows the XSM label of the TPM's client domain to be retrieved. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* mini-os/tpmback: Replace UUID field with opaque pointerDaniel De Graaf2013-04-122-5/+35
| | | | | | | | Instead of only recording the UUID field, which may not be of interest to all tpmback implementations, provide a user-settable opaque pointer associated with the tpmback instance. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* mini-os/tpmback: set up callbacks before enumerationDaniel De Graaf2013-04-122-39/+4
| | | | | | | | | | | | The open/close callbacks in tpmback cannot be properly initalized in order to catch the initial enumeration events because init_tpmback clears the callbacks and then asynchronously starts the enumeration of existing tpmback devices. Fix this by passing the callbacks to init_tpmback so they can be installed before enumeration. This also removes the unused callbacks for suspend and resume. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* mini-os/tpm{back, front}: Allow device repoensDaniel De Graaf2013-04-122-3/+34
| | | | | | | | Allow the vtpm device to be disconnected and reconnected so that a bootloader (like pv-grub) can submit measurements and return the vtpm device to its initial state before booting the target kernel. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
* mini-os/tpm{back, front}: Change shared page ABIDaniel De Graaf2013-04-124-152/+166
| | | | | | | | | | | | | | | | | | | | | This changes the vTPM shared page ABI from a copy of the Xen network interface to a single-page interface that better reflects the expected behavior of a TPM: only a single request packet can be sent at any given time, and every packet sent generates a single response packet. This protocol change should also increase efficiency as it avoids mapping and unmapping grants when possible. The vtpm xenbus device now requires a feature-protocol-v2 node in xenstore to avoid conflicts with existing (xen-patched) kernels supporting the old interface. While the contents of the shared page have been defined to allow packets larger than a single page (actually 4088 bytes) by allowing the client to add extra grant references, the mapping of these extra references has not been implemented; a feature node in xenstore may be used in the future to indicate full support for the multi-page protocol. Most uses of the TPM should not require this feature. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Cc: Jan Beulich <JBeulich@suse.com>
* mini-os: implement poll(2)Wei Liu2013-04-112-1/+117
| | | | | | | | It is just a wrapper around select(2). This implementation mimics Linux's do_poll. Signed-off-by: Wei Liu <wei.liu2@citrix.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* Fix emacs local variable block to use correct C style variable.David Vrabel2013-02-215-5/+5
| | | | | | | The emacs variable to set the C style from a local variable block is c-file-style, not c-set-style. Signed-off-by: David Vrabel <david.vrabel@citrix.com
* mini-os: build fixes for lwip 1.3.2David Vrabel2013-01-305-8/+22
| | | | | | | | | | | | | Various fixes to mini-os needed to build lwip 1.3.2: - Don't build the tests. - Add BSD-style endianness macros to endian.h. - free() is called via a function pointer so it needs to be a real function. Do the same for malloc() and realloc(). Signed-off-by: David Vrabel <david.vrabel@citrix.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Committed-by: Keir Fraser <keir@xen.org>
* mini-os: Fix test application link when various fronts are not enabled.Samuel Thibault2013-01-091-3/+31
| | | | | | | | When fronts are not enabled, the test application needs to disable the corresponding tests. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Committed-by: Keir Fraser <keir@xen.org>
* mini-os: Notify shutdown through weak function call instead of wake queueSamuel Thibault2013-01-093-13/+21
| | | | | | | | | To allow for more flexibility, this notifies domain shutdown through a function rather than a wake queue, to let the application use a wake queue only if it wishes. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Committed-by: Keir Fraser <keir@xen.org>
* mini-os: drop shutdown variables when CONFIG_XENBUS=nSamuel Thibault2012-12-061-0/+2
| | | | | | | | | Shutdown variables are meaningless when CONFIG_XENBUS=n since no shutdown event will ever happen. Better make sure that no code tries to use it and never get the hoped shutdown event. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Committed-by: Keir Fraser <keir@xen.org>
* mini-os: shutdown_thread depends on xenbusDaniel De Graaf2012-11-301-0/+4
| | | | | | | | This fixes the build of the xenstore stub domain, which should never be shut down and so does not need this feature. Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov> Committed-by: Keir Fraser <keir@xen.org>
* minios/console: console_input() weak referenceAndrew Cooper2012-11-301-3/+7
| | | | | | | | | | In exactly the same style as app_main() in kernel.c, create a weak reference console_input() function for applications to override to quickly gain access to the console. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Committed-by: Keir Fraser <keir@xen.org>
* [minios] Add xenbus shutdown control supportSamuel Thibault2012-11-305-24/+128
| | | | | | | | | | | | Add a thread watching the xenbus shutdown control path and notifies a wait queue. Add HYPERVISOR_shutdown convenient inline for minios shutdown. Add proper shutdown to the minios test application. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Committed-by: Keir Fraser <keir@xen.org>
* [minios] Fix test application link when pcifront is not enabledSamuel Thibault2012-11-301-0/+6
| | | | | | | | When pcifront is not enabled, the test application needs to disable the PCI test. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Committed-by: Keir Fraser <keir@xen.org>
* minios: Update mini-os license to support GPL featuresMatthew Fioravante2012-11-191-0/+13
| | | | | | | | | | This patch updates extras/mini-os/COPYING to explain which optional features are GPL and what the implications of enabling them are. Signed-off-by: Matthew Fioravante <matthew.fioravante@jhuapl.edu> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* minios: fix bug in lseek for mini-osMatthew Fioravante2012-11-191-29/+38
| | | | | | | | | | lseek always used files[fd].file.offset. It should use the offset of whatever union member is actually being used. Signed-off-by: Matthew Fioravante <matthew.fioravante@jhuapl.edu> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* minios: add tpmfront, tpm_tis, and tpmback driversMatthew Fioravante2012-11-139-0/+3399
| | | | | | | | | | | | | | | | | | | | This patch adds 3 new drivers to mini-os. tpmfront - paravirtualized tpm frontend driver tpmback - paravirtualized tpm backend driver tpm_tis - hardware tpm driver Unfortunately these drivers were derived from GPL licensed linux kernel drivers so they must carry the GPL license. However, since mini-os now supports conditional compilation, hopefully these drivers can be included into the xen tree and conditionally removed from non-gpl projects. By default they are disabled in the makefile. Signed-off-by: Matthew Fioravante <matthew.fioravante@jhuapl.edu> Acked-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* minios: add xenbus_read_uuidMatthew Fioravante2012-11-132-0/+31
| | | | | | | | | Similar to xenbus_read_integer, this function reads a xenstore path and parses it as a uuid. See include/xenbus.h for details. Signed-off-by: Matthew Fioravante <matthew.fioravante@jhuapl.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* minios: Disable -DGNT_DEBUG and -DGNTMAP_DEBUGMatthew Fioravante2012-11-131-2/+2
| | | | | | | | | Disabling the above flags in default mini-os build. They generate a lot of spam. Signed-off-by: Matthew Fioravante <matthew.fioravante@jhuapl.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* minios: add select definition to sys/time.h when HAVE_LIBC is definedMatthew Fioravante2012-10-092-1/+5
| | | | | | | | | | This patch adds the select function to sys/time.h when HAVE_LIBC is defined, which is according to standard (see the select() manpage). It also removes a redudant lwip include from posix/sys/select.h. Signed-off-by: Matthew Fioravante <matthew.fioravante@jhuapl.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* minios: add posix io for blkfrontMatthew Fioravante2012-10-094-2/+224
| | | | | | | | | This patch adds posix io support (read,write,lseek) to block devices using blkfront. Signed-off-by: Matthew Fioravante <matthew.fioravante@jhuapl.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyons.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* minios: setup fpu and sse in mini-osMatthew Fioravante2012-10-081-0/+20
| | | | | | | | | | This patch adds floating point and sse support to mini-os by initializing the floating point unit and the see unit during domain boot up. Signed-off-by: Matthew Fioravante <matthew.fioravante@jhuapl.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyons.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* minios: add CONFIG_XC conditionalMatthew Fioravante2012-10-082-1/+9
| | | | | | | | | This patch adds a CONFIG_XC option to mini-os, to allow conditional support for libxc for mini-os domains. Signed-off-by: Matthew Fioravante <matthew.fioravante@jhuapl.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyons.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* minios: Disable the mfn_is_ram() check, it doesn't work correctly on all systemsMatthew Fioravante2012-10-083-30/+0
| | | | | | | | | This patch disables the mfn_is_ram check in mini-os. The current check is insufficient and fails on some systems with larger than 4gb memory. Signed-off-by: Matthew Fioravante <matthew.fioravante@jhuapl.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyons.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* minios: Add endian, byteswap, and wordsize macros to mini-osMatthew Fioravante2012-10-086-25/+92
| | | | | | | | This patch addes byte swapping macros and endian support to mini-os. Signed-off-by: Matthew Fioravante <matthew.fioravante@jhuapl.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyons.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* minios: Add ioread/iowrite functions to mini-osMatthew Fioravante2012-10-082-0/+51
| | | | | | | | | | | This patch adds iowritexx() and ioreadxx() functions for interacting with hardware memory to mini-os. The functions are available in a header iorw.h Signed-off-by: Matthew Fioravante <matthew.fioravante@jhuapl.edu> Acked-by: Samuel Thibault <samuel.thibault@ens-lyons.org> Reviewed-by: George Dunlap <george.dunlap@eu.citrix.com> Committed-by: Ian Campbell <ian.campbell@citrix.com>
* tools: drop ia64 supportIan Campbell2012-09-1244-7009/+5
| | | | | | | | | | | | | | | | | Removed support from libxc and mini-os. This also took me under xen/include/public via various symlinks. Dropped tools/debugger/xenitp entirely, it was described upon commit as: "Xenitp is a low-level debugger for ia64" and doesn't appear to be linked into the build anywhere. 99 files changed, 14 insertions(+), 32361 deletions(-) Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Acked-by: Keir Fraser <keir@xen.org> Committed-by: Ian Campbell <ian.campbell@citrix.com>