merged trunk rev569

7 files changed, 658 insertions, 130 deletions

diff --git a/nova/virt/cpuinfo.xml.template b/nova/virt/cpuinfo.xml.template
new file mode 100644
index 000000000..48842b29d
--- /dev/null
+++ b/nova/virt/cpuinfo.xml.template
@@ -0,0 +1,9 @@
+<cpu>
+    <arch>$arch</arch>
+    <model>$model</model>
+    <vendor>$vendor</vendor>
+    <topology sockets="$topology.sockets" cores="$topology.cores" threads="$topology.threads"/>
+#for $var in $features
+    <features name="$var" />
+#end for
+</cpu>
diff --git a/nova/virt/disk.py b/nova/virt/disk.py
new file mode 100644
index 000000000..c5565abfa
--- /dev/null
+++ b/nova/virt/disk.py
@@ -0,0 +1,186 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+"""
+Utility methods to resize, repartition, and modify disk images.
+
+Includes injection of SSH PGP keys into authorized_keys file.
+
+"""
+
+import os
+import tempfile
+import time
+
+from nova import exception
+from nova import flags
+from nova import log as logging
+from nova import utils
+
+
+LOG = logging.getLogger('nova.compute.disk')
+FLAGS = flags.FLAGS
+flags.DEFINE_integer('minimum_root_size', 1024 * 1024 * 1024 * 10,
+                     'minimum size in bytes of root partition')
+flags.DEFINE_integer('block_size', 1024 * 1024 * 256,
+                     'block_size to use for dd')
+
+
+def extend(image, size):
+    """Increase image to size"""
+    file_size = os.path.getsize(image)
+    if file_size >= size:
+        return
+    utils.execute('truncate -s %s %s' % (size, image))
+    # NOTE(vish): attempts to resize filesystem
+    utils.execute('e2fsck -fp %s' % image, check_exit_code=False)
+    utils.execute('resize2fs %s' % image, check_exit_code=False)
+
+
+def inject_data(image, key=None, net=None, partition=None, nbd=False):
+    """Injects a ssh key and optionally net data into a disk image.
+
+    it will mount the image as a fully partitioned disk and attempt to inject
+    into the specified partition number.
+
+    If partition is not specified it mounts the image as a single partition.
+
+    """
+    device = _link_device(image, nbd)
+    try:
+        if not partition is None:
+            # create partition
+            out, err = utils.execute('sudo kpartx -a %s' % device)
+            if err:
+                raise exception.Error(_('Failed to load partition: %s') % err)
+            mapped_device = '/dev/mapper/%sp%s' % (device.split('/')[-1],
+                                                   partition)
+        else:
+            mapped_device = device
+
+        # We can only loopback mount raw images. If the device isn't there,
+        # it's normally because it's a .vmdk or a .vdi etc
+        if not os.path.exists(mapped_device):
+            raise exception.Error('Mapped device was not found (we can'
+                                  ' only inject raw disk images): %s' %
+                                  mapped_device)
+
+        # Configure ext2fs so that it doesn't auto-check every N boots
+        out, err = utils.execute('sudo tune2fs -c 0 -i 0 %s' % mapped_device)
+
+        tmpdir = tempfile.mkdtemp()
+        try:
+            # mount loopback to dir
+            out, err = utils.execute(
+                    'sudo mount %s %s' % (mapped_device, tmpdir))
+            if err:
+                raise exception.Error(_('Failed to mount filesystem: %s')
+                                      % err)
+
+            try:
+                if key:
+                    # inject key file
+                    _inject_key_into_fs(key, tmpdir)
+                if net:
+                    _inject_net_into_fs(net, tmpdir)
+            finally:
+                # unmount device
+                utils.execute('sudo umount %s' % mapped_device)
+        finally:
+            # remove temporary directory
+            utils.execute('rmdir %s' % tmpdir)
+            if not partition is None:
+                # remove partitions
+                utils.execute('sudo kpartx -d %s' % device)
+    finally:
+        _unlink_device(device, nbd)
+
+
+def _link_device(image, nbd):
+    """Link image to device using loopback or nbd"""
+    if nbd:
+        device = _allocate_device()
+        utils.execute('sudo qemu-nbd -c %s %s' % (device, image))
+        # NOTE(vish): this forks into another process, so give it a chance
+        #             to set up before continuuing
+        for i in xrange(10):
+            if os.path.exists("/sys/block/%s/pid" % os.path.basename(device)):
+                return device
+            time.sleep(1)
+        raise exception.Error(_('nbd device %s did not show up') % device)
+    else:
+        out, err = utils.execute('sudo losetup --find --show %s' % image)
+        if err:
+            raise exception.Error(_('Could not attach image to loopback: %s')
+                                  % err)
+        return out.strip()
+
+
+def _unlink_device(device, nbd):
+    """Unlink image from device using loopback or nbd"""
+    if nbd:
+        utils.execute('sudo qemu-nbd -d %s' % device)
+        _free_device(device)
+    else:
+        utils.execute('sudo losetup --detach %s' % device)
+
+
+_DEVICES = ['/dev/nbd%s' % i for i in xrange(16)]
+
+
+def _allocate_device():
+    # NOTE(vish): This assumes no other processes are allocating nbd devices.
+    #             It may race cause a race condition if multiple
+    #             workers are running on a given machine.
+    while True:
+        if not _DEVICES:
+            raise exception.Error(_('No free nbd devices'))
+        device = _DEVICES.pop()
+        if not os.path.exists("/sys/block/%s/pid" % os.path.basename(device)):
+            break
+    return device
+
+
+def _free_device(device):
+    _DEVICES.append(device)
+
+
+def _inject_key_into_fs(key, fs):
+    """Add the given public ssh key to root's authorized_keys.
+
+    key is an ssh key string.
+    fs is the path to the base of the filesystem into which to inject the key.
+    """
+    sshdir = os.path.join(fs, 'root', '.ssh')
+    utils.execute('sudo mkdir -p %s' % sshdir)  # existing dir doesn't matter
+    utils.execute('sudo chown root %s' % sshdir)
+    utils.execute('sudo chmod 700 %s' % sshdir)
+    keyfile = os.path.join(sshdir, 'authorized_keys')
+    utils.execute('sudo tee -a %s' % keyfile, '\n' + key.strip() + '\n')
+
+
+def _inject_net_into_fs(net, fs):
+    """Inject /etc/network/interfaces into the filesystem rooted at fs.
+
+    net is the contents of /etc/network/interfaces.
+    """
+    netdir = os.path.join(os.path.join(fs, 'etc'), 'network')
+    utils.execute('sudo mkdir -p %s' % netdir)  # existing dir doesn't matter
+    utils.execute('sudo chown root:root %s' % netdir)
+    utils.execute('sudo chmod 755 %s' % netdir)
+    netfile = os.path.join(netdir, 'interfaces')
+    utils.execute('sudo tee %s' % netfile, net)
diff --git a/nova/virt/fake.py b/nova/virt/fake.py
index 3b53f714f..b931e3638 100644
--- a/nova/virt/fake.py
+++ b/nova/virt/fake.py
@@ -98,7 +98,7 @@ class FakeConnection(object):
         the new instance.
 
         The work will be done asynchronously.  This function returns a
-        Deferred that allows the caller to detect when it is complete.
+        task that allows the caller to detect when it is complete.
 
         Once this successfully completes, the instance should be
         running (power_state.RUNNING).
@@ -122,7 +122,7 @@ class FakeConnection(object):
         The second parameter is the name of the snapshot.
 
         The work will be done asynchronously.  This function returns a
-        Deferred that allows the caller to detect when it is complete.
+        task that allows the caller to detect when it is complete.
         """
         pass
 
@@ -134,7 +134,20 @@ class FakeConnection(object):
         and so the instance is being specified as instance.name.
 
         The work will be done asynchronously.  This function returns a
-        Deferred that allows the caller to detect when it is complete.
+        task that allows the caller to detect when it is complete.
+        """
+        pass
+
+    def set_admin_password(self, instance, new_pass):
+        """
+        Set the root password on the specified instance.
+
+        The first parameter is an instance of nova.compute.service.Instance,
+        and so the instance is being specified as instance.name. The second
+        parameter is the value of the new password.
+
+        The work will be done asynchronously.  This function returns a
+        task that allows the caller to detect when it is complete.
         """
         pass
 
@@ -182,7 +195,7 @@ class FakeConnection(object):
         and so the instance is being specified as instance.name.
 
         The work will be done asynchronously.  This function returns a
-        Deferred that allows the caller to detect when it is complete.
+        task that allows the caller to detect when it is complete.
         """
         del self.instances[instance.name]
 
diff --git a/nova/virt/libvirt.xml.template b/nova/virt/libvirt.xml.template
index 2eb7d9488..de06a1eb0 100644
--- a/nova/virt/libvirt.xml.template
+++ b/nova/virt/libvirt.xml.template
@@ -7,13 +7,13 @@
     #set $disk_bus = 'uml'
         <type>uml</type>
         <kernel>/usr/bin/linux</kernel>
-        <root>/dev/ubda1</root>
+        <root>/dev/ubda</root>
 #else
     #if $type == 'xen'
         #set $disk_prefix = 'sd'
         #set $disk_bus = 'scsi'
             <type>linux</type>
-            <root>/dev/xvda1</root>
+            <root>/dev/xvda</root>
     #else
         #set $disk_prefix = 'vd'
         #set $disk_bus = 'virtio'
@@ -28,7 +28,7 @@
             #if $type == 'xen'
                 <cmdline>ro</cmdline>
             #else
-                <cmdline>root=/dev/vda1 console=ttyS0</cmdline>
+                <cmdline>root=/dev/vda console=ttyS0</cmdline>
             #end if
             #if $getVar('ramdisk', None)
                 <initrd>${ramdisk}</initrd>
@@ -46,18 +46,28 @@
     <devices>
 #if $getVar('rescue', False)
         <disk type='file'>
+            <driver type='${driver_type}'/>
             <source file='${basepath}/rescue-disk'/>
             <target dev='${disk_prefix}a' bus='${disk_bus}'/>
         </disk>
         <disk type='file'>
+            <driver type='${driver_type}'/>
             <source file='${basepath}/disk'/>
             <target dev='${disk_prefix}b' bus='${disk_bus}'/>
         </disk>
 #else
         <disk type='file'>
+            <driver type='${driver_type}'/>
             <source file='${basepath}/disk'/>
             <target dev='${disk_prefix}a' bus='${disk_bus}'/>
         </disk>
+    #if $getVar('local', False)
+        <disk type='file'>
+            <driver type='${driver_type}'/>
+            <source file='${basepath}/local'/>
+            <target dev='${disk_prefix}b' bus='${disk_bus}'/>
+        </disk>
+    #end if
 #end if
         <interface type='bridge'>
             <source bridge='${bridge_name}'/>
@@ -66,6 +76,7 @@
             <filterref filter="nova-instance-${name}">
                 <parameter name="IP" value="${ip_address}" />
                 <parameter name="DHCPSERVER" value="${dhcp_server}" />
+                <parameter name="RASERVER" value="${ra_server}" />
 #if $getVar('extra_params', False)
                 ${extra_params}
 #end if
diff --git a/nova/virt/libvirt_conn.py b/nova/virt/libvirt_conn.py
index 93e768ae9..541432ce3 100644
--- a/nova/virt/libvirt_conn.py
+++ b/nova/virt/libvirt_conn.py
@@ -61,9 +61,9 @@ from nova import log as logging
 from nova import utils
 #from nova.api import context
 from nova.auth import manager
-from nova.compute import disk
 from nova.compute import instance_types
 from nova.compute import power_state
+from nova.virt import disk
 from nova.virt import images
 
 libvirt = None
@@ -107,6 +107,9 @@ flags.DEFINE_string('live_migration_timeout_sec', 10,
 flags.DEFINE_bool('allow_project_net_traffic',
                   True,
                   'Whether to allow in project network traffic')
+flags.DEFINE_bool('use_cow_images',
+                  True,
+                  'Whether to use cow images')
 flags.DEFINE_string('ajaxterm_portrange',
                     '10000-12000',
                     'Range of ports that ajaxterm should randomly try to bind')
@@ -114,11 +117,6 @@ flags.DEFINE_string('firewall_driver',
                     'nova.virt.libvirt_conn.IptablesFirewallDriver',
                     'Firewall driver (defaults to iptables)')
 
-class cpuinfo:
-    arch = ''
-    vendor = ''
-    def __init__(self): pass
-    
 
 def get_connection(read_only):
     # These are loaded late so that there's no need to install these
@@ -148,6 +146,16 @@ def _get_net_and_mask(cidr):
     return str(net.net()), str(net.netmask())
 
 
+def _get_net_and_prefixlen(cidr):
+    net = IPy.IP(cidr)
+    return str(net.net()), str(net.prefixlen())
+
+
+def _get_ip_version(cidr):
+        net = IPy.IP(cidr)
+        return int(net.version())
+
+
 class LibvirtConnection(object):
 
     def __init__(self, read_only):
@@ -394,7 +402,6 @@ class LibvirtConnection(object):
                               instance['id'],
                               power_state.NOSTATE,
                               'launching')
-
         self.nwfilter.setup_basic_filtering(instance)
         self.firewall_driver.prepare_instance_filter(instance)
         self._create_image(instance, xml)
@@ -502,19 +509,57 @@ class LibvirtConnection(object):
         subprocess.Popen(cmd, shell=True)
         return {'token': token, 'host': host, 'port': port}
 
+    def _cache_image(self, fn, target, fname, cow=False, *args, **kwargs):
+        """Wrapper for a method that creates an image that caches the image.
+
+        This wrapper will save the image into a common store and create a
+        copy for use by the hypervisor.
+
+        The underlying method should specify a kwarg of target representing
+        where the image will be saved.
+
+        fname is used as the filename of the base image.  The filename needs
+        to be unique to a given image.
+
+        If cow is True, it will make a CoW image instead of a copy.
+        """
+        if not os.path.exists(target):
+            base_dir = os.path.join(FLAGS.instances_path, '_base')
+            if not os.path.exists(base_dir):
+                os.mkdir(base_dir)
+                os.chmod(base_dir, 0777)
+            base = os.path.join(base_dir, fname)
+            if not os.path.exists(base):
+                fn(target=base, *args, **kwargs)
+            if cow:
+                utils.execute('qemu-img create -f qcow2 -o '
+                              'cluster_size=2M,backing_file=%s %s'
+                              % (base, target))
+            else:
+                utils.execute('cp %s %s' % (base, target))
+
+    def _fetch_image(self, target, image_id, user, project, size=None):
+        """Grab image and optionally attempt to resize it"""
+        images.fetch(image_id, target, user, project)
+        if size:
+            disk.extend(target, size)
+
+    def _create_local(self, target, local_gb):
+        """Create a blank image of specified size"""
+        utils.execute('truncate %s -s %dG' % (target, local_gb))
+        # TODO(vish): should we format disk by default?
+
     def _create_image(self, inst, libvirt_xml, prefix='', disk_images=None):
         # syntactic nicety
-        basepath = lambda fname = '', prefix = prefix: os.path.join(
-                                                 FLAGS.instances_path,
-                                                 inst['name'],
-                                                 prefix + fname)
+        def basepath(fname='', prefix=prefix):
+            return os.path.join(FLAGS.instances_path,
+                                inst['name'],
+                                prefix + fname)
 
         # ensure directories exist and are writable
         utils.execute('mkdir -p %s' % basepath(prefix=''))
         utils.execute('chmod 0777 %s' % basepath(prefix=''))
 
-        # TODO(termie): these are blocking calls, it would be great
-        #               if they weren't.
         LOG.info(_('instance %s: Creating image'), inst['name'])
         f = open(basepath('libvirt.xml'), 'w')
         f.write(libvirt_xml)
@@ -531,23 +576,44 @@ class LibvirtConnection(object):
             disk_images = {'image_id': inst['image_id'],
                            'kernel_id': inst['kernel_id'],
                            'ramdisk_id': inst['ramdisk_id']}
-        if not os.path.exists(basepath('disk')):
-            images.fetch(inst.image_id, basepath('disk-raw'), user,
-                         project)
-
-        if inst['kernel_id']:
-            if not os.path.exists(basepath('kernel')):
-                images.fetch(inst['kernel_id'], basepath('kernel'),
-                             user, project)
-            if inst['ramdisk_id']:
-                if not os.path.exists(basepath('ramdisk')):
-                    images.fetch(inst['ramdisk_id'], basepath('ramdisk'),
-                                 user, project)
-
-        def execute(cmd, process_input=None, check_exit_code=True):
-            return utils.execute(cmd=cmd,
-                                 process_input=process_input,
-                                 check_exit_code=check_exit_code)
+
+        if disk_images['kernel_id']:
+            self._cache_image(fn=self._fetch_image,
+                              target=basepath('kernel'),
+                              fname=disk_images['kernel_id'],
+                              image_id=disk_images['kernel_id'],
+                              user=user,
+                              project=project)
+            if disk_images['ramdisk_id']:
+                self._cache_image(fn=self._fetch_image,
+                                  target=basepath('ramdisk'),
+                                  fname=disk_images['ramdisk_id'],
+                                  image_id=disk_images['ramdisk_id'],
+                                  user=user,
+                                  project=project)
+
+        root_fname = disk_images['image_id']
+        size = FLAGS.minimum_root_size
+        if inst['instance_type'] == 'm1.tiny' or prefix == 'rescue-':
+            size = None
+            root_fname += "_sm"
+
+        self._cache_image(fn=self._fetch_image,
+                          target=basepath('disk'),
+                          fname=root_fname,
+                          cow=FLAGS.use_cow_images,
+                          image_id=disk_images['image_id'],
+                          user=user,
+                          project=project,
+                          size=size)
+        type_data = instance_types.INSTANCE_TYPES[inst['instance_type']]
+
+        if type_data['local_gb']:
+            self._cache_image(fn=self._create_local,
+                              target=basepath('local'),
+                              fname="local_%s" % type_data['local_gb'],
+                              cow=FLAGS.use_cow_images,
+                              local_gb=type_data['local_gb'])
 
         # For now, we assume that if we're not using a kernel, we're using a
         # partitioned disk image where the target partition is the first
@@ -563,12 +629,16 @@ class LibvirtConnection(object):
         if network_ref['injected']:
             admin_context = context.get_admin_context()
             address = db.instance_get_fixed_address(admin_context, inst['id'])
+            ra_server = network_ref['ra_server']
+            if not ra_server:
+                ra_server = "fd00::"
             with open(FLAGS.injected_network_template) as f:
                 net = f.read() % {'address': address,
                                   'netmask': network_ref['netmask'],
                                   'gateway': network_ref['gateway'],
                                   'broadcast': network_ref['broadcast'],
-                                  'dns': network_ref['dns']}
+                                  'dns': network_ref['dns'],
+                                  'ra_server': ra_server}
         if key or net:
             if key:
                 LOG.info(_('instance %s: injecting key into image %s'),
@@ -577,34 +647,15 @@ class LibvirtConnection(object):
                 LOG.info(_('instance %s: injecting net into image %s'),
                              inst['name'], inst.image_id)
             try:
-                disk.inject_data(basepath('disk-raw'), key, net,
+                disk.inject_data(basepath('disk'), key, net,
                                  partition=target_partition,
-                                 execute=execute)
+                                 nbd=FLAGS.use_cow_images)
             except Exception as e:
                 # This could be a windows image, or a vmdk format disk
                 LOG.warn(_('instance %s: ignoring error injecting data'
                            ' into image %s (%s)'),
                          inst['name'], inst.image_id, e)
 
-        if inst['kernel_id']:
-            if os.path.exists(basepath('disk')):
-                utils.execute('rm -f %s' % basepath('disk'))
-
-        local_bytes = (instance_types.INSTANCE_TYPES[inst.instance_type]
-                                                    ['local_gb']
-                                                    * 1024 * 1024 * 1024)
-
-        resize = True
-        if inst['instance_type'] == 'm1.tiny' or prefix == 'rescue-':
-            resize = False
-
-        if inst['kernel_id']:
-            disk.partition(basepath('disk-raw'), basepath('disk'),
-                           local_bytes, resize, execute=execute)
-        else:
-            os.rename(basepath('disk-raw'), basepath('disk'))
-            disk.extend(basepath('disk'), local_bytes, execute=execute)
-
         if FLAGS.libvirt_type == 'uml':
             utils.execute('sudo chown root %s' % basepath('disk'))
 
@@ -623,15 +674,36 @@ class LibvirtConnection(object):
                                                    instance['id'])
         # Assume that the gateway also acts as the dhcp server.
         dhcp_server = network['gateway']
-
+        ra_server = network['ra_server']
+        if not ra_server:
+            ra_server = 'fd00::'
         if FLAGS.allow_project_net_traffic:
-            net, mask = _get_net_and_mask(network['cidr'])
-            extra_params = ("<parameter name=\"PROJNET\" "
+            if FLAGS.use_ipv6:
+                net, mask = _get_net_and_mask(network['cidr'])
+                net_v6, prefixlen_v6 = _get_net_and_prefixlen(
+                                           network['cidr_v6'])
+                extra_params = ("<parameter name=\"PROJNET\" "
+                            "value=\"%s\" />\n"
+                            "<parameter name=\"PROJMASK\" "
+                            "value=\"%s\" />\n"
+                            "<parameter name=\"PROJNETV6\" "
+                            "value=\"%s\" />\n"
+                            "<parameter name=\"PROJMASKV6\" "
+                            "value=\"%s\" />\n") % \
+                              (net, mask, net_v6, prefixlen_v6)
+            else:
+                net, mask = _get_net_and_mask(network['cidr'])
+                extra_params = ("<parameter name=\"PROJNET\" "
                             "value=\"%s\" />\n"
                             "<parameter name=\"PROJMASK\" "
-                            "value=\"%s\" />\n") % (net, mask)
+                            "value=\"%s\" />\n") % \
+                              (net, mask)
         else:
             extra_params = "\n"
+        if FLAGS.use_cow_images:
+            driver_type = 'qcow2'
+        else:
+            driver_type = 'raw'
 
         xml_info = {'type': FLAGS.libvirt_type,
                     'name': instance['name'],
@@ -643,8 +715,11 @@ class LibvirtConnection(object):
                     'mac_address': instance['mac_address'],
                     'ip_address': ip_address,
                     'dhcp_server': dhcp_server,
+                    'ra_server': ra_server,
                     'extra_params': extra_params,
-                    'rescue': rescue}
+                    'rescue': rescue,
+                    'local': instance_type['local_gb'],
+                    'driver_type': driver_type}
         if not rescue:
             if instance['kernel_id']:
                 xml_info['kernel'] = xml_info['basepath'] + "/kernel"
@@ -811,7 +886,7 @@ class LibvirtConnection(object):
         if list(set(tkeys)) != list(set(keys)):
             msg = _('Invalid xml: topology(%s) must have %s')
             raise exception.Invalid(msg % (str(topology), ', '.join(keys)))
-        
+
         feature_nodes = xml.xpathEval('//cpu/feature')
         features = list()
         for nodes in feature_nodes:
@@ -819,16 +894,15 @@ class LibvirtConnection(object):
             features.append(feature_name)
 
         template = ("""{"arch":"%s", "model":"%s", "vendor":"%s", """
-                    """"topology":{"cores":"%s", "threads":"%s", "sockets":"%s"}, """
-                    """"features":[%s]}""")
+                    """"topology":{"cores":"%s", "threads":"%s", """
+                    """"sockets":"%s"}, "features":[%s]}""")
         c = topology['cores']
         s = topology['sockets']
         t = topology['threads']
-        f = [ '"%s"' % x for x in features]
+        f = ['"%s"' % x for x in features]
         cpu_info = template % (arch, model, vendor, c, s, t, ', '.join(f))
         return cpu_info
 
-
     def block_stats(self, instance_name, disk):
         """
         Note that this function takes an instance name, not an Instance, so
@@ -868,20 +942,30 @@ class LibvirtConnection(object):
 
            'http://libvirt.org/html/libvirt-libvirt.html#virCPUCompareResult'
         """
+        msg = _('Checking cpu_info: instance was launched this cpu.\n: %s ')
+        LOG.info(msg % cpu_info)
         dic = json.loads(cpu_info)
-        print dic
         xml = str(Template(self.cpuinfo_xml, searchList=dic))
-        msg = _('Checking cpu_info: instance was launched this cpu.\n: %s ')
+        msg = _('to xml...\n: %s ')
         LOG.info(msg % xml)
-        ret = self._conn.compareCPU(xml, 0)
+
+        url = 'http://libvirt.org/html/libvirt-libvirt.html'
+        url += '#virCPUCompareResult\n'
+        msg = 'CPU does not have compativility.\n'
+        msg += 'result:%d \n'
+        msg += 'Refer to %s'
+        msg = _(msg)
+
+        # unknown character exists in xml, then libvirt complains
+        try:
+            ret = self._conn.compareCPU(xml, 0)
+        except libvirt.libvirtError, e:
+            LOG.error(msg % (ret, url))
+            raise e
+
         if ret <= 0:
-            url = 'http://libvirt.org/html/libvirt-libvirt.html'
-            url += '#virCPUCompareResult\n'
-            msg = 'CPU does not have compativility.\n'
-            msg += 'result:%d \n'
-            msg += 'Refer to %s'
-            msg = _(msg)
             raise exception.Invalid(msg % (ret, url))
+
         return
 
     def ensure_filtering_rules_for_instance(self, instance_ref):
@@ -1165,6 +1249,15 @@ class NWFilterFirewall(FirewallDriver):
                     </rule>
                   </filter>'''
 
+    def nova_ra_filter(self):
+        return '''<filter name='nova-allow-ra-server' chain='root'>
+                            <uuid>d707fa71-4fb5-4b27-9ab7-ba5ca19c8804</uuid>
+                              <rule action='accept' direction='inout'
+                                    priority='100'>
+                                <icmpv6 srcipaddr='$RASERVER'/>
+                              </rule>
+                            </filter>'''
+
     def setup_basic_filtering(self, instance):
         """Set up basic filtering (MAC, IP, and ARP spoofing protection)"""
         logging.info('called setup_basic_filtering in nwfilter')
@@ -1192,9 +1285,12 @@ class NWFilterFirewall(FirewallDriver):
         self._define_filter(self.nova_base_ipv4_filter)
         self._define_filter(self.nova_base_ipv6_filter)
         self._define_filter(self.nova_dhcp_filter)
+        self._define_filter(self.nova_ra_filter)
         self._define_filter(self.nova_vpn_filter)
         if FLAGS.allow_project_net_traffic:
             self._define_filter(self.nova_project_filter)
+            if FLAGS.use_ipv6:
+                self._define_filter(self.nova_project_filter_v6)
 
         self.static_filters_configured = True
 
@@ -1226,13 +1322,13 @@ class NWFilterFirewall(FirewallDriver):
 
     def nova_base_ipv6_filter(self):
         retval = "<filter name='nova-base-ipv6' chain='ipv6'>"
-        for protocol in ['tcp', 'udp', 'icmp']:
+        for protocol in ['tcp-ipv6', 'udp-ipv6', 'icmpv6']:
             for direction, action, priority in [('out', 'accept', 399),
                                                 ('in', 'drop', 400)]:
                 retval += """<rule action='%s' direction='%s' priority='%d'>
-                               <%s-ipv6 />
+                               <%s />
                              </rule>""" % (action, direction,
-                                             priority, protocol)
+                                              priority, protocol)
         retval += '</filter>'
         return retval
 
@@ -1245,10 +1341,20 @@ class NWFilterFirewall(FirewallDriver):
         retval += '</filter>'
         return retval
 
+    def nova_project_filter_v6(self):
+        retval = "<filter name='nova-project-v6' chain='ipv6'>"
+        for protocol in ['tcp-ipv6', 'udp-ipv6', 'icmpv6']:
+            retval += """<rule action='accept' direction='inout'
+                                                   priority='200'>
+                           <%s srcipaddr='$PROJNETV6'
+                               srcipmask='$PROJMASKV6' />
+                         </rule>""" % (protocol)
+        retval += '</filter>'
+        return retval
+
     def _define_filter(self, xml):
         if callable(xml):
             xml = xml()
-
         # execute in a native thread and block current greenthread until done
         tpool.execute(self._conn.nwfilterDefineXML, xml)
 
@@ -1262,7 +1368,6 @@ class NWFilterFirewall(FirewallDriver):
         it makes sure the filters for the security groups as well as
         the base filter are all in place.
         """
-
         if instance['image_id'] == FLAGS.vpn_image_id:
             base_filter = 'nova-vpn'
         else:
@@ -1274,11 +1379,15 @@ class NWFilterFirewall(FirewallDriver):
         instance_secgroup_filter_children = ['nova-base-ipv4',
                                              'nova-base-ipv6',
                                              'nova-allow-dhcp-server']
+        if FLAGS.use_ipv6:
+            instance_secgroup_filter_children += ['nova-allow-ra-server']
 
         ctxt = context.get_admin_context()
 
         if FLAGS.allow_project_net_traffic:
             instance_filter_children += ['nova-project']
+            if FLAGS.use_ipv6:
+                instance_filter_children += ['nova-project-v6']
 
         for security_group in db.security_group_get_by_instance(ctxt,
                                                                instance['id']):
@@ -1306,12 +1415,19 @@ class NWFilterFirewall(FirewallDriver):
         security_group = db.security_group_get(context.get_admin_context(),
                                                security_group_id)
         rule_xml = ""
+        v6protocol = {'tcp': 'tcp-ipv6', 'udp': 'udp-ipv6', 'icmp': 'icmpv6'}
         for rule in security_group.rules:
             rule_xml += "<rule action='accept' direction='in' priority='300'>"
             if rule.cidr:
-                net, mask = _get_net_and_mask(rule.cidr)
-                rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
-                            (rule.protocol, net, mask)
+                version = _get_ip_version(rule.cidr)
+                if(FLAGS.use_ipv6 and version == 6):
+                    net, prefixlen = _get_net_and_prefixlen(rule.cidr)
+                    rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
+                                (v6protocol[rule.protocol], net, prefixlen)
+                else:
+                    net, mask = _get_net_and_mask(rule.cidr)
+                    rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
+                                (rule.protocol, net, mask)
                 if rule.protocol in ['tcp', 'udp']:
                     rule_xml += "dstportstart='%s' dstportend='%s' " % \
                                 (rule.from_port, rule.to_port)
@@ -1326,8 +1442,11 @@ class NWFilterFirewall(FirewallDriver):
 
                 rule_xml += '/>\n'
             rule_xml += "</rule>\n"
-        xml = "<filter name='nova-secgroup-%s' chain='ipv4'>%s</filter>" % \
-              (security_group_id, rule_xml,)
+        xml = "<filter name='nova-secgroup-%s' " % security_group_id
+        if(FLAGS.use_ipv6):
+            xml += "chain='root'>%s</filter>" % rule_xml
+        else:
+            xml += "chain='ipv4'>%s</filter>" % rule_xml
         return xml
 
     def _instance_filter_name(self, instance):
@@ -1364,11 +1483,17 @@ class IptablesFirewallDriver(FirewallDriver):
     def apply_ruleset(self):
         current_filter, _ = self.execute('sudo iptables-save -t filter')
         current_lines = current_filter.split('\n')
-        new_filter = self.modify_rules(current_lines)
+        new_filter = self.modify_rules(current_lines, 4)
         self.execute('sudo iptables-restore',
                      process_input='\n'.join(new_filter))
-
-    def modify_rules(self, current_lines):
+        if(FLAGS.use_ipv6):
+            current_filter, _ = self.execute('sudo ip6tables-save -t filter')
+            current_lines = current_filter.split('\n')
+            new_filter = self.modify_rules(current_lines, 6)
+            self.execute('sudo ip6tables-restore',
+                         process_input='\n'.join(new_filter))
+
+    def modify_rules(self, current_lines, ip_version=4):
         ctxt = context.get_admin_context()
         # Remove any trace of nova rules.
         new_filter = filter(lambda l: 'nova-' not in l, current_lines)
@@ -1382,8 +1507,8 @@ class IptablesFirewallDriver(FirewallDriver):
                 if not new_filter[rules_index].startswith(':'):
                     break
 
-        our_chains = [':nova-ipv4-fallback - [0:0]']
-        our_rules = ['-A nova-ipv4-fallback -j DROP']
+        our_chains = [':nova-fallback - [0:0]']
+        our_rules = ['-A nova-fallback -j DROP']
 
         our_chains += [':nova-local - [0:0]']
         our_rules += ['-A FORWARD -j nova-local']
@@ -1394,7 +1519,10 @@ class IptablesFirewallDriver(FirewallDriver):
         for instance_id in self.instances:
             instance = self.instances[instance_id]
             chain_name = self._instance_chain_name(instance)
-            ip_address = self._ip_for_instance(instance)
+            if(ip_version == 4):
+                ip_address = self._ip_for_instance(instance)
+            elif(ip_version == 6):
+                ip_address = self._ip_for_instance_v6(instance)
 
             our_chains += [':%s - [0:0]' % chain_name]
 
@@ -1421,13 +1549,19 @@ class IptablesFirewallDriver(FirewallDriver):
 
                 our_rules += ['-A %s -j %s' % (chain_name, sg_chain_name)]
 
-            # Allow DHCP responses
-            dhcp_server = self._dhcp_server_for_instance(instance)
-            our_rules += ['-A %s -s %s -p udp --sport 67 --dport 68' %
-                                                     (chain_name, dhcp_server)]
+            if(ip_version == 4):
+                # Allow DHCP responses
+                dhcp_server = self._dhcp_server_for_instance(instance)
+                our_rules += ['-A %s -s %s -p udp --sport 67 --dport 68' %
+                                                 (chain_name, dhcp_server)]
+            elif(ip_version == 6):
+                # Allow RA responses
+                ra_server = self._ra_server_for_instance(instance)
+                our_rules += ['-A %s -s %s -p icmpv6' %
+                                                 (chain_name, ra_server)]
 
             # If nothing matches, jump to the fallback chain
-            our_rules += ['-A %s -j nova-ipv4-fallback' % (chain_name,)]
+            our_rules += ['-A %s -j nova-fallback' % (chain_name,)]
 
         # then, security group chains and rules
         for security_group_id in security_groups:
@@ -1440,15 +1574,22 @@ class IptablesFirewallDriver(FirewallDriver):
 
             for rule in rules:
                 logging.info('%r', rule)
-                args = ['-A', chain_name, '-p', rule.protocol]
 
-                if rule.cidr:
-                    args += ['-s', rule.cidr]
-                else:
+                if not rule.cidr:
                     # Eventually, a mechanism to grant access for security
                     # groups will turn up here. It'll use ipsets.
                     continue
 
+                version = _get_ip_version(rule.cidr)
+                if version != ip_version:
+                    continue
+
+                protocol = rule.protocol
+                if version == 6 and rule.protocol == 'icmp':
+                    protocol = 'icmpv6'
+
+                args = ['-A', chain_name, '-p', protocol, '-s', rule.cidr]
+
                 if rule.protocol in ['udp', 'tcp']:
                     if rule.from_port == rule.to_port:
                         args += ['--dport', '%s' % (rule.from_port,)]
@@ -1468,7 +1609,12 @@ class IptablesFirewallDriver(FirewallDriver):
                             icmp_type_arg += '/%s' % icmp_code
 
                     if icmp_type_arg:
-                        args += ['-m', 'icmp', '--icmp-type', icmp_type_arg]
+                        if(ip_version == 4):
+                            args += ['-m', 'icmp', '--icmp-type',
+                                     icmp_type_arg]
+                        elif(ip_version == 6):
+                            args += ['-m', 'icmp6', '--icmpv6-type',
+                                     icmp_type_arg]
 
                 args += ['-j ACCEPT']
                 our_rules += [' '.join(args)]
@@ -1494,7 +1640,16 @@ class IptablesFirewallDriver(FirewallDriver):
         return db.instance_get_fixed_address(context.get_admin_context(),
                                              instance['id'])
 
+    def _ip_for_instance_v6(self, instance):
+        return db.instance_get_fixed_address_v6(context.get_admin_context(),
+                                             instance['id'])
+
     def _dhcp_server_for_instance(self, instance):
         network = db.project_get_network(context.get_admin_context(),
                                          instance['project_id'])
         return network['gateway']
+
+    def _ra_server_for_instance(self, instance):
+        network = db.project_get_network(context.get_admin_context(),
+                                         instance['project_id'])
+        return network['ra_server']
diff --git a/nova/virt/xenapi/vmops.py b/nova/virt/xenapi/vmops.py
index 7aebb502f..6e359ef82 100644
--- a/nova/virt/xenapi/vmops.py
+++ b/nova/virt/xenapi/vmops.py
@@ -20,6 +20,11 @@ Management class for VM-related functions (spawn, reboot, etc).
 """
 
 import json
+import M2Crypto
+import os
+import subprocess
+import tempfile
+import uuid
 
 from nova import db
 from nova import context
@@ -127,12 +132,31 @@ class VMOps(object):
         """Refactored out the common code of many methods that receive either
         a vm name or a vm instance, and want a vm instance in return.
         """
+        vm = None
         try:
-            instance_name = instance_or_vm.name
-            vm = VMHelper.lookup(self._session, instance_name)
-        except AttributeError:
-            # A vm opaque ref was passed
-            vm = instance_or_vm
+            if instance_or_vm.startswith("OpaqueRef:"):
+                # Got passed an opaque ref; return it
+                return instance_or_vm
+            else:
+                # Must be the instance name
+                instance_name = instance_or_vm
+        except (AttributeError, KeyError):
+            # Note the the KeyError will only happen with fakes.py
+            # Not a string; must be an ID or a vm instance
+            if isinstance(instance_or_vm, (int, long)):
+                ctx = context.get_admin_context()
+                try:
+                    instance_obj = db.instance_get_by_id(ctx, instance_or_vm)
+                    instance_name = instance_obj.name
+                except exception.NotFound:
+                    # The unit tests screw this up, as they use an integer for
+                    # the vm name. I'd fix that up, but that's a matter for
+                    # another bug report. So for now, just try with the passed
+                    # value
+                    instance_name = instance_or_vm
+            else:
+                instance_name = instance_or_vm.name
+        vm = VMHelper.lookup(self._session, instance_name)
         if vm is None:
             raise Exception(_('Instance not present %s') % instance_name)
         return vm
@@ -189,6 +213,44 @@ class VMOps(object):
         task = self._session.call_xenapi('Async.VM.clean_reboot', vm)
         self._session.wait_for_task(instance.id, task)
 
+    def set_admin_password(self, instance, new_pass):
+        """Set the root/admin password on the VM instance. This is done via
+        an agent running on the VM. Communication between nova and the agent
+        is done via writing xenstore records. Since communication is done over
+        the XenAPI RPC calls, we need to encrypt the password. We're using a
+        simple Diffie-Hellman class instead of the more advanced one in
+        M2Crypto for compatibility with the agent code.
+        """
+        # Need to uniquely identify this request.
+        transaction_id = str(uuid.uuid4())
+        # The simple Diffie-Hellman class is used to manage key exchange.
+        dh = SimpleDH()
+        args = {'id': transaction_id, 'pub': str(dh.get_public())}
+        resp = self._make_agent_call('key_init', instance, '', args)
+        if resp is None:
+            # No response from the agent
+            return
+        resp_dict = json.loads(resp)
+        # Successful return code from key_init is 'D0'
+        if resp_dict['returncode'] != 'D0':
+            # There was some sort of error; the message will contain
+            # a description of the error.
+            raise RuntimeError(resp_dict['message'])
+        agent_pub = int(resp_dict['message'])
+        dh.compute_shared(agent_pub)
+        enc_pass = dh.encrypt(new_pass)
+        # Send the encrypted password
+        args['enc_pass'] = enc_pass
+        resp = self._make_agent_call('password', instance, '', args)
+        if resp is None:
+            # No response from the agent
+            return
+        resp_dict = json.loads(resp)
+        # Successful return code from password is '0'
+        if resp_dict['returncode'] != '0':
+            raise RuntimeError(resp_dict['message'])
+        return resp_dict['message']
+
     def destroy(self, instance):
         """Destroy VM instance"""
         vm = VMHelper.lookup(self._session, instance.name)
@@ -246,30 +308,19 @@ class VMOps(object):
 
     def suspend(self, instance, callback):
         """suspend the specified instance"""
-        instance_name = instance.name
-        vm = VMHelper.lookup(self._session, instance_name)
-        if vm is None:
-            raise Exception(_("suspend: instance not present %s") %
-                                                     instance_name)
+        vm = self._get_vm_opaque_ref(instance)
         task = self._session.call_xenapi('Async.VM.suspend', vm)
         self._wait_with_callback(instance.id, task, callback)
 
     def resume(self, instance, callback):
         """resume the specified instance"""
-        instance_name = instance.name
-        vm = VMHelper.lookup(self._session, instance_name)
-        if vm is None:
-            raise Exception(_("resume: instance not present %s") %
-                                                    instance_name)
+        vm = self._get_vm_opaque_ref(instance)
         task = self._session.call_xenapi('Async.VM.resume', vm, False, True)
         self._wait_with_callback(instance.id, task, callback)
 
-    def get_info(self, instance_id):
+    def get_info(self, instance):
         """Return data about VM instance"""
-        vm = VMHelper.lookup(self._session, instance_id)
-        if vm is None:
-            raise exception.NotFound(_('Instance not'
-                                       ' found %s') % instance_id)
+        vm = self._get_vm_opaque_ref(instance)
         rec = self._session.get_xenapi().VM.get_record(vm)
         return VMHelper.compile_info(rec)
 
@@ -333,22 +384,34 @@ class VMOps(object):
         return self._make_plugin_call('xenstore.py', method=method, vm=vm,
                 path=path, addl_args=addl_args)
 
+    def _make_agent_call(self, method, vm, path, addl_args={}):
+        """Abstracts out the interaction with the agent xenapi plugin."""
+        return self._make_plugin_call('agent', method=method, vm=vm,
+                path=path, addl_args=addl_args)
+
     def _make_plugin_call(self, plugin, method, vm, path, addl_args={}):
         """Abstracts out the process of calling a method of a xenapi plugin.
         Any errors raised by the plugin will in turn raise a RuntimeError here.
         """
+        instance_id = vm.id
         vm = self._get_vm_opaque_ref(vm)
         rec = self._session.get_xenapi().VM.get_record(vm)
         args = {'dom_id': rec['domid'], 'path': path}
         args.update(addl_args)
-        # If the 'testing_mode' attribute is set, add that to the args.
-        if getattr(self, 'testing_mode', False):
-            args['testing_mode'] = 'true'
         try:
             task = self._session.async_call_plugin(plugin, method, args)
-            ret = self._session.wait_for_task(0, task)
+            ret = self._session.wait_for_task(instance_id, task)
         except self.XenAPI.Failure, e:
-            raise RuntimeError("%s" % e.details[-1])
+            ret = None
+            err_trace = e.details[-1]
+            err_msg = err_trace.splitlines()[-1]
+            strargs = str(args)
+            if 'TIMEOUT:' in err_msg:
+                LOG.error(_('TIMEOUT: The call to %(method)s timed out. '
+                        'VM id=%(instance_id)s; args=%(strargs)s') % locals())
+            else:
+                LOG.error(_('The call to %(method)s returned an error: %(e)s. '
+                        'VM id=%(instance_id)s; args=%(strargs)s') % locals())
         return ret
 
     def add_to_xenstore(self, vm, path, key, value):
@@ -460,3 +523,89 @@ class VMOps(object):
         """Removes all data from the xenstore parameter record for this VM."""
         self.write_to_param_xenstore(instance_or_vm, {})
     ########################################################################
+
+
+def _runproc(cmd):
+    pipe = subprocess.PIPE
+    return subprocess.Popen([cmd], shell=True, stdin=pipe, stdout=pipe,
+            stderr=pipe, close_fds=True)
+
+
+class SimpleDH(object):
+    """This class wraps all the functionality needed to implement
+    basic Diffie-Hellman-Merkle key exchange in Python. It features
+    intelligent defaults for the prime and base numbers needed for the
+    calculation, while allowing you to supply your own. It requires that
+    the openssl binary be installed on the system on which this is run,
+    as it uses that to handle the encryption and decryption. If openssl
+    is not available, a RuntimeError will be raised.
+    """
+    def __init__(self, prime=None, base=None, secret=None):
+        """You can specify the values for prime and base if you wish;
+        otherwise, reasonable default values will be used.
+        """
+        if prime is None:
+            self._prime = 162259276829213363391578010288127
+        else:
+            self._prime = prime
+        if base is None:
+            self._base = 5
+        else:
+            self._base = base
+        self._shared = self._public = None
+
+        self._dh = M2Crypto.DH.set_params(
+                self.dec_to_mpi(self._prime),
+                self.dec_to_mpi(self._base))
+        self._dh.gen_key()
+        self._public = self.mpi_to_dec(self._dh.pub)
+
+    def get_public(self):
+        return self._public
+
+    def compute_shared(self, other):
+        self._shared = self.bin_to_dec(
+                self._dh.compute_key(self.dec_to_mpi(other)))
+        return self._shared
+
+    def mpi_to_dec(self, mpi):
+        bn = M2Crypto.m2.mpi_to_bn(mpi)
+        hexval = M2Crypto.m2.bn_to_hex(bn)
+        dec = int(hexval, 16)
+        return dec
+
+    def bin_to_dec(self, binval):
+        bn = M2Crypto.m2.bin_to_bn(binval)
+        hexval = M2Crypto.m2.bn_to_hex(bn)
+        dec = int(hexval, 16)
+        return dec
+
+    def dec_to_mpi(self, dec):
+        bn = M2Crypto.m2.dec_to_bn('%s' % dec)
+        mpi = M2Crypto.m2.bn_to_mpi(bn)
+        return mpi
+
+    def _run_ssl(self, text, which):
+        base_cmd = ('cat %(tmpfile)s | openssl enc -aes-128-cbc '
+                '-a -pass pass:%(shared)s -nosalt %(dec_flag)s')
+        if which.lower()[0] == 'd':
+            dec_flag = ' -d'
+        else:
+            dec_flag = ''
+        fd, tmpfile = tempfile.mkstemp()
+        os.close(fd)
+        file(tmpfile, 'w').write(text)
+        shared = self._shared
+        cmd = base_cmd % locals()
+        proc = _runproc(cmd)
+        proc.wait()
+        err = proc.stderr.read()
+        if err:
+            raise RuntimeError(_('OpenSSL error: %s') % err)
+        return proc.stdout.read()
+
+    def encrypt(self, text):
+        return self._run_ssl(text, 'enc')
+
+    def decrypt(self, text):
+        return self._run_ssl(text, 'dec')
diff --git a/nova/virt/xenapi_conn.py b/nova/virt/xenapi_conn.py
index 76862be27..a2eb2d8d7 100644
--- a/nova/virt/xenapi_conn.py
+++ b/nova/virt/xenapi_conn.py
@@ -149,6 +149,10 @@ class XenAPIConnection(object):
         """Reboot VM instance"""
         self._vmops.reboot(instance)
 
+    def set_admin_password(self, instance, new_pass):
+        """Set the root/admin password on the VM instance"""
+        self._vmops.set_admin_password(instance, new_pass)
+
     def destroy(self, instance):
         """Destroy VM instance"""
         self._vmops.destroy(instance)
@@ -296,7 +300,8 @@ class XenAPISession(object):
 
     def _poll_task(self, id, task, done):
         """Poll the given XenAPI task, and fire the given action if we
-        get a result."""
+        get a result.
+        """
         try:
             name = self._session.xenapi.task.get_name_label(task)
             status = self._session.xenapi.task.get_status(task)