merged with trunk and removed conflicts

125 files changed, 10633 insertions, 2059 deletions

diff --git a/nova/__init__.py b/nova/__init__.py
index 8745617bc..256db55a9 100644
--- a/nova/__init__.py
+++ b/nova/__init__.py
@@ -30,5 +30,3 @@
 .. moduleauthor:: Manish Singh <yosh@gimp.org>
 .. moduleauthor:: Andy Smith <andy@anarkystic.com>
 """
-
-from exception import *
diff --git a/nova/adminclient.py b/nova/adminclient.py
index c614b274c..fc3c5c5fe 100644
--- a/nova/adminclient.py
+++ b/nova/adminclient.py
@@ -23,6 +23,8 @@ import base64
 import boto
 import boto.exception
 import httplib
+import re
+import string
 
 from boto.ec2.regioninfo import RegionInfo
 
@@ -165,19 +167,20 @@ class HostInfo(object):
 
     **Fields Include**
 
-    * Disk stats
-    * Running Instances
-    * Memory stats
-    * CPU stats
-    * Network address info
-    * Firewall info
-    * Bridge and devices
-
+    * Hostname
+    * Compute service status
+    * Volume service status
+    * Instance count
+    * Volume count
     """
 
     def __init__(self, connection=None):
         self.connection = connection
         self.hostname = None
+        self.compute = None
+        self.volume = None
+        self.instance_count = 0
+        self.volume_count = 0
 
     def __repr__(self):
         return 'Host:%s' % self.hostname
@@ -188,7 +191,39 @@ class HostInfo(object):
 
     # this is needed by the sax parser, so ignore the ugly name
     def endElement(self, name, value, connection):
-        setattr(self, name, value)
+        fixed_name = string.lower(re.sub(r'([A-Z])', r'_\1', name))
+        setattr(self, fixed_name, value)
+
+
+class Vpn(object):
+    """
+    Information about a Vpn, as parsed through SAX
+
+    **Fields Include**
+
+    * instance_id
+    * project_id
+    * public_ip
+    * public_port
+    * created_at
+    * internal_ip
+    * state
+    """
+
+    def __init__(self, connection=None):
+        self.connection = connection
+        self.instance_id = None
+        self.project_id = None
+
+    def __repr__(self):
+        return 'Vpn:%s:%s' % (self.project_id, self.instance_id)
+
+    def startElement(self, name, attrs, connection):
+        return None
+
+    def endElement(self, name, value, connection):
+        fixed_name = string.lower(re.sub(r'([A-Z])', r'_\1', name))
+        setattr(self, fixed_name, value)
 
 
 class InstanceType(object):
@@ -422,6 +457,16 @@ class NovaAdminClient(object):
         zip = self.apiconn.get_object('GenerateX509ForUser', params, UserInfo)
         return zip.file
 
+    def start_vpn(self, project):
+        """
+        Starts the vpn for a user
+        """
+        return self.apiconn.get_object('StartVpn', {'Project': project}, Vpn)
+
+    def get_vpns(self):
+        """Return a list of vpn with project name"""
+        return self.apiconn.get_list('DescribeVpns', {}, [('item', Vpn)])
+
     def get_hosts(self):
         return self.apiconn.get_list('DescribeHosts', {}, [('item', HostInfo)])
 
diff --git a/nova/api/direct.py b/nova/api/direct.py
index 208b6d086..dfca250e0 100644
--- a/nova/api/direct.py
+++ b/nova/api/direct.py
@@ -187,7 +187,7 @@ class ServiceWrapper(wsgi.Controller):
     def __init__(self, service_handle):
         self.service_handle = service_handle
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         arg_dict = req.environ['wsgiorg.routing_args'][1]
         action = arg_dict['action']
@@ -206,7 +206,7 @@ class ServiceWrapper(wsgi.Controller):
         params = dict([(str(k), v) for (k, v) in params.iteritems()])
         result = method(context, **params)
         if type(result) is dict or type(result) is list:
-            return self._serialize(result, req)
+            return self._serialize(result, req.best_match_content_type())
         else:
             return result
 
@@ -218,7 +218,7 @@ class Proxy(object):
         self.prefix = prefix
 
     def __do_request(self, path, context, **kwargs):
-        req = webob.Request.blank(path)
+        req = wsgi.Request.blank(path)
         req.method = 'POST'
         req.body = urllib.urlencode({'json': utils.dumps(kwargs)})
         req.environ['openstack.context'] = context
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index 1a06b3f01..fccebca5d 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -20,7 +20,6 @@ Starting point for routing EC2 requests.
 
 """
 
-import datetime
 import webob
 import webob.dec
 import webob.exc
@@ -54,25 +53,22 @@ flags.DEFINE_list('lockout_memcached_servers', None,
 class RequestLogging(wsgi.Middleware):
     """Access-Log akin logging for all EC2 API requests."""
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
+        start = utils.utcnow()
         rv = req.get_response(self.application)
-        self.log_request_completion(rv, req)
+        self.log_request_completion(rv, req, start)
         return rv
 
-    def log_request_completion(self, response, request):
+    def log_request_completion(self, response, request, start):
         controller = request.environ.get('ec2.controller', None)
         if controller:
             controller = controller.__class__.__name__
         action = request.environ.get('ec2.action', None)
         ctxt = request.environ.get('ec2.context', None)
-        seconds = 'X'
-        microseconds = 'X'
-        if ctxt:
-            delta = datetime.datetime.utcnow() - \
-                    ctxt.timestamp
-            seconds = delta.seconds
-            microseconds = delta.microseconds
+        delta = utils.utcnow() - start
+        seconds = delta.seconds
+        microseconds = delta.microseconds
         LOG.info(
             "%s.%ss %s %s %s %s:%s %s [%s] %s %s",
             seconds,
@@ -116,7 +112,7 @@ class Lockout(wsgi.Middleware):
                                   debug=0)
         super(Lockout, self).__init__(application)
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         access_key = str(req.params['AWSAccessKeyId'])
         failures_key = "authfailures-%s" % access_key
@@ -145,7 +141,7 @@ class Authenticate(wsgi.Middleware):
 
     """Authenticate an EC2 request and add 'ec2.context' to WSGI environ."""
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         # Read request signature and access id.
         try:
@@ -194,7 +190,7 @@ class Requestify(wsgi.Middleware):
         super(Requestify, self).__init__(app)
         self.controller = utils.import_class(controller)()
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         non_args = ['Action', 'Signature', 'AWSAccessKeyId', 'SignatureMethod',
                     'SignatureVersion', 'Version', 'Timestamp']
@@ -202,6 +198,12 @@ class Requestify(wsgi.Middleware):
         try:
             # Raise KeyError if omitted
             action = req.params['Action']
+            # Fix bug lp:720157 for older (version 1) clients
+            version = req.params['SignatureVersion']
+            if int(version) == 1:
+                non_args.remove('SignatureMethod')
+                if 'SignatureMethod' in args:
+                    args.pop('SignatureMethod')
             for non_arg in non_args:
                 # Remove, but raise KeyError if omitted
                 args.pop(non_arg)
@@ -273,7 +275,7 @@ class Authorizer(wsgi.Middleware):
             },
         }
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         context = req.environ['ec2.context']
         controller = req.environ['ec2.request'].controller.__class__.__name__
@@ -294,7 +296,7 @@ class Authorizer(wsgi.Middleware):
             return True
         if 'none' in roles:
             return False
-        return any(context.project.has_role(context.user.id, role)
+        return any(context.project.has_role(context.user_id, role)
                    for role in roles)
 
 
@@ -307,7 +309,7 @@ class Executor(wsgi.Application):
     response, or a 400 upon failure.
     """
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         context = req.environ['ec2.context']
         api_request = req.environ['ec2.request']
@@ -369,7 +371,7 @@ class Executor(wsgi.Application):
 
 class Versions(wsgi.Application):
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         """Respond to a request for all EC2 versions."""
         # available api versions
diff --git a/nova/api/ec2/admin.py b/nova/api/ec2/admin.py
index 735951082..d9a4ef999 100644
--- a/nova/api/ec2/admin.py
+++ b/nova/api/ec2/admin.py
@@ -21,14 +21,17 @@ Admin API controller, exposed through http via the api worker.
 """
 
 import base64
+import datetime
 
 from nova import db
 from nova import exception
+from nova import flags
 from nova import log as logging
+from nova import utils
 from nova.auth import manager
-from nova.compute import instance_types
 
 
+FLAGS = flags.FLAGS
 LOG = logging.getLogger('nova.api.ec2.admin')
 
 
@@ -55,22 +58,54 @@ def project_dict(project):
         return {}
 
 
-def host_dict(host):
+def host_dict(host, compute_service, instances, volume_service, volumes, now):
     """Convert a host model object to a result dict"""
-    if host:
-        return host.state
-    else:
-        return {}
+    rv = {'hostanme': host, 'instance_count': len(instances),
+          'volume_count': len(volumes)}
+    if compute_service:
+        latest = compute_service['updated_at'] or compute_service['created_at']
+        delta = now - latest
+        if delta.seconds <= FLAGS.service_down_time:
+            rv['compute'] = 'up'
+        else:
+            rv['compute'] = 'down'
+    if volume_service:
+        latest = volume_service['updated_at'] or volume_service['created_at']
+        delta = now - latest
+        if delta.seconds <= FLAGS.service_down_time:
+            rv['volume'] = 'up'
+        else:
+            rv['volume'] = 'down'
+    return rv
 
 
-def instance_dict(name, inst):
-    return {'name': name,
+def instance_dict(inst):
+    return {'name': inst['name'],
             'memory_mb': inst['memory_mb'],
             'vcpus': inst['vcpus'],
             'disk_gb': inst['local_gb'],
             'flavor_id': inst['flavorid']}
 
 
+def vpn_dict(project, vpn_instance):
+    rv = {'project_id': project.id,
+          'public_ip': project.vpn_ip,
+          'public_port': project.vpn_port}
+    if vpn_instance:
+        rv['instance_id'] = vpn_instance['ec2_id']
+        rv['created_at'] = utils.isotime(vpn_instance['created_at'])
+        address = vpn_instance.get('fixed_ip', None)
+        if address:
+            rv['internal_ip'] = address['address']
+        if utils.vpn_ping(project.vpn_ip, project.vpn_port):
+            rv['state'] = 'running'
+        else:
+            rv['state'] = 'down'
+    else:
+        rv['state'] = 'pending'
+    return rv
+
+
 class AdminController(object):
     """
     API Controller for users, hosts, nodes, and workers.
@@ -79,9 +114,9 @@ class AdminController(object):
     def __str__(self):
         return 'AdminController'
 
-    def describe_instance_types(self, _context, **_kwargs):
-        return {'instanceTypeSet': [instance_dict(n, v) for n, v in
-                                    instance_types.INSTANCE_TYPES.iteritems()]}
+    def describe_instance_types(self, context, **_kwargs):
+        """Returns all active instance types data (vcpus, memory, etc.)"""
+        return {'instanceTypeSet': [db.instance_type_get_all(context)]}
 
     def describe_user(self, _context, name, **_kwargs):
         """Returns user data, including access and secret keys."""
@@ -223,19 +258,68 @@ class AdminController(object):
             raise exception.ApiError(_('operation must be add or remove'))
         return True
 
+    def _vpn_for(self, context, project_id):
+        """Get the VPN instance for a project ID."""
+        for instance in db.instance_get_all_by_project(context, project_id):
+            if (instance['image_id'] == FLAGS.vpn_image_id
+                and not instance['state_description'] in
+                    ['shutting_down', 'shutdown']):
+                return instance
+
+    def start_vpn(self, context, project):
+        instance = self._vpn_for(context, project)
+        if not instance:
+            # NOTE(vish) import delayed because of __init__.py
+            from nova.cloudpipe import pipelib
+            pipe = pipelib.CloudPipe()
+            try:
+                pipe.launch_vpn_instance(project)
+            except db.NoMoreNetworks:
+                raise exception.ApiError("Unable to claim IP for VPN instance"
+                                         ", ensure it isn't running, and try "
+                                         "again in a few minutes")
+            instance = self._vpn_for(context, project)
+        return {'instance_id': instance['ec2_id']}
+
+    def describe_vpns(self, context):
+        vpns = []
+        for project in manager.AuthManager().get_projects():
+            instance = self._vpn_for(context, project.id)
+            vpns.append(vpn_dict(project, instance))
+        return {'items': vpns}
+
     # FIXME(vish): these host commands don't work yet, perhaps some of the
     #              required data can be retrieved from service objects?
 
-    def describe_hosts(self, _context, **_kwargs):
+    def describe_hosts(self, context, **_kwargs):
         """Returns status info for all nodes. Includes:
-            * Disk Space
-            * Instance List
-            * RAM used
-            * CPU used
-            * DHCP servers running
-            * Iptables / bridges
+            * Hostname
+            * Compute (up, down, None)
+            * Instance count
+            * Volume (up, down, None)
+            * Volume Count
         """
-        return {'hostSet': [host_dict(h) for h in db.host_get_all()]}
+        services = db.service_get_all(context)
+        now = datetime.datetime.utcnow()
+        hosts = []
+        rv = []
+        for host in [service['host'] for service in services]:
+            if not host in hosts:
+                hosts.append(host)
+        for host in hosts:
+            compute = [s for s in services if s['host'] == host \
+                                           and s['binary'] == 'nova-compute']
+            if compute:
+                compute = compute[0]
+            instances = db.instance_get_all_by_host(context, host)
+            volume = [s for s in services if s['host'] == host \
+                                           and s['binary'] == 'nova-volume']
+            if volume:
+                volume = volume[0]
+            volumes = db.volume_get_all_by_host(context, host)
+            rv.append(host_dict(host, compute, instances, volume, volumes,
+                                now))
+        return {'hosts': rv}
 
     def describe_host(self, _context, name, **_kwargs):
         """Returns status info for single node."""
diff --git a/nova/api/ec2/apirequest.py b/nova/api/ec2/apirequest.py
index 7e72d67fb..d7ad08d2f 100644
--- a/nova/api/ec2/apirequest.py
+++ b/nova/api/ec2/apirequest.py
@@ -20,6 +20,7 @@
 APIRequest class
 """
 
+import datetime
 import re
 # TODO(termie): replace minidom with etree
 from xml.dom import minidom
@@ -45,8 +46,29 @@ def _underscore_to_xmlcase(str):
     return res[:1].lower() + res[1:]
 
 
+def _database_to_isoformat(datetimeobj):
+    """Return a xs:dateTime parsable string from datatime"""
+    return datetimeobj.strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
 def _try_convert(value):
-    """Return a non-string if possible"""
+    """Return a non-string from a string or unicode, if possible.
+
+    ============= =====================================================
+    When value is returns
+    ============= =====================================================
+    zero-length   ''
+    'None'        None
+    'True'        True
+    'False'       False
+    '0', '-0'     0
+    0xN, -0xN     int from hex (postitive) (N is any number)
+    0bN, -0bN     int from binary (positive) (N is any number)
+    *             try conversion to int, float, complex, fallback value
+
+    """
+    if len(value) == 0:
+        return ''
     if value == 'None':
         return None
     if value == 'True':
@@ -171,6 +193,9 @@ class APIRequest(object):
             self._render_dict(xml, data_el, data.__dict__)
         elif isinstance(data, bool):
             data_el.appendChild(xml.createTextNode(str(data).lower()))
+        elif isinstance(data, datetime.datetime):
+            data_el.appendChild(
+                  xml.createTextNode(_database_to_isoformat(data)))
         elif data != None:
             data_el.appendChild(xml.createTextNode(str(data)))
 
diff --git a/nova/api/ec2/cloud.py b/nova/api/ec2/cloud.py
index 6919cd8d2..40a9da0e7 100644
--- a/nova/api/ec2/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -39,7 +39,9 @@ from nova import log as logging
 from nova import network
 from nova import utils
 from nova import volume
+from nova.api.ec2 import ec2utils
 from nova.compute import instance_types
+from nova.image import s3
 
 
 FLAGS = flags.FLAGS
@@ -73,30 +75,19 @@ def _gen_key(context, user_id, key_name):
     return {'private_key': private_key, 'fingerprint': fingerprint}
 
 
-def ec2_id_to_id(ec2_id):
-    """Convert an ec2 ID (i-[base 16 number]) to an instance id (int)"""
-    return int(ec2_id.split('-')[-1], 16)
-
-
-def id_to_ec2_id(instance_id, template='i-%08x'):
-    """Convert an instance ID (int) to an ec2 ID (i-[base 16 number])"""
-    return template % instance_id
-
-
 class CloudController(object):
     """ CloudController provides the critical dispatch between
  inbound API calls through the endpoint and messages
  sent to the other nodes.
 """
     def __init__(self):
-        self.image_service = utils.import_object(FLAGS.image_service)
+        self.image_service = s3.S3ImageService()
         self.network_api = network.API()
         self.volume_api = volume.API()
         self.compute_api = compute.API(
                 network_api=self.network_api,
-                image_service=self.image_service,
                 volume_api=self.volume_api,
-                hostname_factory=id_to_ec2_id)
+                hostname_factory=ec2utils.id_to_ec2_id)
         self.setup()
 
     def __str__(self):
@@ -115,7 +106,7 @@ class CloudController(object):
             start = os.getcwd()
             os.chdir(FLAGS.ca_path)
             # TODO(vish): Do this with M2Crypto instead
-            utils.runthis(_("Generating root CA: %s"), "sh genrootca.sh")
+            utils.runthis(_("Generating root CA: %s"), "sh", "genrootca.sh")
             os.chdir(start)
 
     def _get_mpi_data(self, context, project_id):
@@ -154,11 +145,12 @@ class CloudController(object):
         availability_zone = self._get_availability_zone_by_host(ctxt, host)
         floating_ip = db.instance_get_floating_address(ctxt,
                                                        instance_ref['id'])
-        ec2_id = id_to_ec2_id(instance_ref['id'])
+        ec2_id = ec2utils.id_to_ec2_id(instance_ref['id'])
+        image_ec2_id = self._image_ec2_id(instance_ref['image_id'], 'machine')
         data = {
             'user-data': base64.b64decode(instance_ref['user_data']),
             'meta-data': {
-                'ami-id': instance_ref['image_id'],
+                'ami-id': image_ec2_id,
                 'ami-launch-index': instance_ref['launch_index'],
                 'ami-manifest-path': 'FIXME',
                 'block-device-mapping': {
@@ -173,15 +165,20 @@ class CloudController(object):
                 'instance-type': instance_ref['instance_type'],
                 'local-hostname': hostname,
                 'local-ipv4': address,
-                'kernel-id': instance_ref['kernel_id'],
                 'placement': {'availability-zone': availability_zone},
                 'public-hostname': hostname,
                 'public-ipv4': floating_ip or '',
                 'public-keys': keys,
-                'ramdisk-id': instance_ref['ramdisk_id'],
                 'reservation-id': instance_ref['reservation_id'],
                 'security-groups': '',
                 'mpi': mpi}}
+
+        for image_type in ['kernel', 'ramdisk']:
+            if '%s_id' % image_type in instance_ref:
+                ec2_id = self._image_ec2_id(instance_ref['%s_id' % image_type],
+                                            image_type)
+                data['meta-data']['%s-id' % image_type] = ec2_id
+
         if False:  # TODO(vish): store ancestor ids
             data['ancestor-ami-ids'] = []
         if False:  # TODO(vish): store product codes
@@ -198,8 +195,9 @@ class CloudController(object):
             return self._describe_availability_zones(context, **kwargs)
 
     def _describe_availability_zones(self, context, **kwargs):
-        enabled_services = db.service_get_all(context)
-        disabled_services = db.service_get_all(context, True)
+        ctxt = context.elevated()
+        enabled_services = db.service_get_all(ctxt)
+        disabled_services = db.service_get_all(ctxt, True)
         available_zones = []
         for zone in [service.availability_zone for service
                      in enabled_services]:
@@ -282,7 +280,7 @@ class CloudController(object):
                                  'description': 'fixme'}]}
 
     def describe_key_pairs(self, context, key_name=None, **kwargs):
-        key_pairs = db.key_pair_get_all_by_user(context, context.user.id)
+        key_pairs = db.key_pair_get_all_by_user(context, context.user_id)
         if not key_name is None:
             key_pairs = [x for x in key_pairs if x['name'] in key_name]
 
@@ -290,18 +288,18 @@ class CloudController(object):
         for key_pair in key_pairs:
             # filter out the vpn keys
             suffix = FLAGS.vpn_key_suffix
-            if context.user.is_admin() or \
+            if context.is_admin or \
                not key_pair['name'].endswith(suffix):
                 result.append({
                     'keyName': key_pair['name'],
                     'keyFingerprint': key_pair['fingerprint'],
                 })
 
-        return {'keypairsSet': result}
+        return {'keySet': result}
 
     def create_key_pair(self, context, key_name, **kwargs):
         LOG.audit(_("Create key pair %s"), key_name, context=context)
-        data = _gen_key(context, context.user.id, key_name)
+        data = _gen_key(context, context.user_id, key_name)
         return {'keyName': key_name,
                 'keyFingerprint': data['fingerprint'],
                 'keyMaterial': data['private_key']}
@@ -310,7 +308,7 @@ class CloudController(object):
     def delete_key_pair(self, context, key_name, **kwargs):
         LOG.audit(_("Delete key pair %s"), key_name, context=context)
         try:
-            db.key_pair_destroy(context, context.user.id, key_name)
+            db.key_pair_destroy(context, context.user_id, key_name)
         except exception.NotFound:
             # aws returns true even if the key doesn't exist
             pass
@@ -318,14 +316,19 @@ class CloudController(object):
 
     def describe_security_groups(self, context, group_name=None, **kwargs):
         self.compute_api.ensure_default_security_group(context)
-        if context.user.is_admin():
+        if group_name:
+            groups = []
+            for name in group_name:
+                group = db.security_group_get_by_name(context,
+                                                      context.project_id,
+                                                      name)
+                groups.append(group)
+        elif context.is_admin:
             groups = db.security_group_get_all(context)
         else:
             groups = db.security_group_get_by_project(context,
                                                       context.project_id)
         groups = [self._format_security_group(context, g) for g in groups]
-        if not group_name is None:
-            groups = [g for g in groups if g.name in group_name]
 
         return {'securityGroupInfo':
                 list(sorted(groups,
@@ -494,7 +497,7 @@ class CloudController(object):
         if db.security_group_exists(context, context.project_id, group_name):
             raise exception.ApiError(_('group %s already exists') % group_name)
 
-        group = {'user_id': context.user.id,
+        group = {'user_id': context.user_id,
                  'project_id': context.project_id,
                  'name': group_name,
                  'description': group_description}
@@ -519,7 +522,7 @@ class CloudController(object):
             ec2_id = instance_id[0]
         else:
             ec2_id = instance_id
-        instance_id = ec2_id_to_id(ec2_id)
+        instance_id = ec2utils.ec2_id_to_id(ec2_id)
         output = self.compute_api.get_console_output(
                 context, instance_id=instance_id)
         now = datetime.datetime.utcnow()
@@ -529,14 +532,15 @@ class CloudController(object):
 
     def get_ajax_console(self, context, instance_id, **kwargs):
         ec2_id = instance_id[0]
-        internal_id = ec2_id_to_id(ec2_id)
-        return self.compute_api.get_ajax_console(context, internal_id)
+        instance_id = ec2utils.ec2_id_to_id(ec2_id)
+        return self.compute_api.get_ajax_console(context,
+                                                 instance_id=instance_id)
 
     def describe_volumes(self, context, volume_id=None, **kwargs):
         if volume_id:
             volumes = []
             for ec2_id in volume_id:
-                internal_id = ec2_id_to_id(ec2_id)
+                internal_id = ec2utils.ec2_id_to_id(ec2_id)
                 volume = self.volume_api.get(context, internal_id)
                 volumes.append(volume)
         else:
@@ -549,11 +553,11 @@ class CloudController(object):
         instance_data = None
         if volume.get('instance', None):
             instance_id = volume['instance']['id']
-            instance_ec2_id = id_to_ec2_id(instance_id)
+            instance_ec2_id = ec2utils.id_to_ec2_id(instance_id)
             instance_data = '%s[%s]' % (instance_ec2_id,
                                         volume['instance']['host'])
         v = {}
-        v['volumeId'] = id_to_ec2_id(volume['id'], 'vol-%08x')
+        v['volumeId'] = ec2utils.id_to_ec2_id(volume['id'], 'vol-%08x')
         v['status'] = volume['status']
         v['size'] = volume['size']
         v['availabilityZone'] = volume['availability_zone']
@@ -561,7 +565,7 @@ class CloudController(object):
         if context.is_admin:
             v['status'] = '%s (%s, %s, %s, %s)' % (
                 volume['status'],
-                volume['user_id'],
+                volume['project_id'],
                 volume['host'],
                 instance_data,
                 volume['mountpoint'])
@@ -571,8 +575,7 @@ class CloudController(object):
                                    'device': volume['mountpoint'],
                                    'instanceId': instance_ec2_id,
                                    'status': 'attached',
-                                   'volumeId': id_to_ec2_id(volume['id'],
-                                                            'vol-%08x')}]
+                                   'volumeId': v['volumeId']}]
         else:
             v['attachmentSet'] = [{}]
 
@@ -591,12 +594,12 @@ class CloudController(object):
         return {'volumeSet': [self._format_volume(context, dict(volume))]}
 
     def delete_volume(self, context, volume_id, **kwargs):
-        volume_id = ec2_id_to_id(volume_id)
+        volume_id = ec2utils.ec2_id_to_id(volume_id)
         self.volume_api.delete(context, volume_id=volume_id)
         return True
 
     def update_volume(self, context, volume_id, **kwargs):
-        volume_id = ec2_id_to_id(volume_id)
+        volume_id = ec2utils.ec2_id_to_id(volume_id)
         updatable_fields = ['display_name', 'display_description']
         changes = {}
         for field in updatable_fields:
@@ -607,8 +610,8 @@ class CloudController(object):
         return True
 
     def attach_volume(self, context, volume_id, instance_id, device, **kwargs):
-        volume_id = ec2_id_to_id(volume_id)
-        instance_id = ec2_id_to_id(instance_id)
+        volume_id = ec2utils.ec2_id_to_id(volume_id)
+        instance_id = ec2utils.ec2_id_to_id(instance_id)
         msg = _("Attach volume %(volume_id)s to instance %(instance_id)s"
                 " at %(device)s") % locals()
         LOG.audit(msg, context=context)
@@ -619,22 +622,22 @@ class CloudController(object):
         volume = self.volume_api.get(context, volume_id)
         return {'attachTime': volume['attach_time'],
                 'device': volume['mountpoint'],
-                'instanceId': id_to_ec2_id(instance_id),
+                'instanceId': ec2utils.id_to_ec2_id(instance_id),
                 'requestId': context.request_id,
                 'status': volume['attach_status'],
-                'volumeId': id_to_ec2_id(volume_id, 'vol-%08x')}
+                'volumeId': ec2utils.id_to_ec2_id(volume_id, 'vol-%08x')}
 
     def detach_volume(self, context, volume_id, **kwargs):
-        volume_id = ec2_id_to_id(volume_id)
+        volume_id = ec2utils.ec2_id_to_id(volume_id)
         LOG.audit(_("Detach volume %s"), volume_id, context=context)
         volume = self.volume_api.get(context, volume_id)
         instance = self.compute_api.detach_volume(context, volume_id=volume_id)
         return {'attachTime': volume['attach_time'],
                 'device': volume['mountpoint'],
-                'instanceId': id_to_ec2_id(instance['id']),
+                'instanceId': ec2utils.id_to_ec2_id(instance['id']),
                 'requestId': context.request_id,
                 'status': volume['attach_status'],
-                'volumeId': id_to_ec2_id(volume_id, 'vol-%08x')}
+                'volumeId': ec2utils.id_to_ec2_id(volume_id, 'vol-%08x')}
 
     def _convert_to_set(self, lst, label):
         if lst == None or lst == []:
@@ -668,20 +671,21 @@ class CloudController(object):
         if instance_id:
             instances = []
             for ec2_id in instance_id:
-                internal_id = ec2_id_to_id(ec2_id)
-                instance = self.compute_api.get(context, internal_id)
+                internal_id = ec2utils.ec2_id_to_id(ec2_id)
+                instance = self.compute_api.get(context,
+                                                instance_id=internal_id)
                 instances.append(instance)
         else:
             instances = self.compute_api.get_all(context, **kwargs)
         for instance in instances:
-            if not context.user.is_admin():
+            if not context.is_admin:
                 if instance['image_id'] == FLAGS.vpn_image_id:
                     continue
             i = {}
             instance_id = instance['id']
-            ec2_id = id_to_ec2_id(instance_id)
+            ec2_id = ec2utils.id_to_ec2_id(instance_id)
             i['instanceId'] = ec2_id
-            i['imageId'] = instance['image_id']
+            i['imageId'] = self._image_ec2_id(instance['image_id'])
             i['instanceState'] = {
                 'code': instance['state'],
                 'name': instance['state_description']}
@@ -702,7 +706,7 @@ class CloudController(object):
             i['dnsName'] = i['publicDnsName'] or i['privateDnsName']
             i['keyName'] = instance['key_name']
 
-            if context.user.is_admin():
+            if context.is_admin:
                 i['keyName'] = '%s (%s, %s)' % (i['keyName'],
                     instance['project_id'],
                     instance['host'])
@@ -736,7 +740,7 @@ class CloudController(object):
 
     def format_addresses(self, context):
         addresses = []
-        if context.user.is_admin():
+        if context.is_admin:
             iterator = db.floating_ip_get_all(context)
         else:
             iterator = db.floating_ip_get_all_by_project(context,
@@ -747,10 +751,10 @@ class CloudController(object):
             if (floating_ip_ref['fixed_ip']
                 and floating_ip_ref['fixed_ip']['instance']):
                 instance_id = floating_ip_ref['fixed_ip']['instance']['id']
-                ec2_id = id_to_ec2_id(instance_id)
+                ec2_id = ec2utils.id_to_ec2_id(instance_id)
             address_rv = {'public_ip': address,
                           'instance_id': ec2_id}
-            if context.user.is_admin():
+            if context.is_admin:
                 details = "%s (%s)" % (address_rv['instance_id'],
                                        floating_ip_ref['project_id'])
                 address_rv['instance_id'] = details
@@ -770,7 +774,7 @@ class CloudController(object):
     def associate_address(self, context, instance_id, public_ip, **kwargs):
         LOG.audit(_("Associate address %(public_ip)s to"
                 " instance %(instance_id)s") % locals(), context=context)
-        instance_id = ec2_id_to_id(instance_id)
+        instance_id = ec2utils.ec2_id_to_id(instance_id)
         self.compute_api.associate_floating_ip(context,
                                                instance_id=instance_id,
                                                address=public_ip)
@@ -783,13 +787,19 @@ class CloudController(object):
 
     def run_instances(self, context, **kwargs):
         max_count = int(kwargs.get('max_count', 1))
+        if kwargs.get('kernel_id'):
+            kernel = self._get_image(context, kwargs['kernel_id'])
+            kwargs['kernel_id'] = kernel['id']
+        if kwargs.get('ramdisk_id'):
+            ramdisk = self._get_image(context, kwargs['ramdisk_id'])
+            kwargs['ramdisk_id'] = ramdisk['id']
         instances = self.compute_api.create(context,
             instance_type=instance_types.get_by_type(
                 kwargs.get('instance_type', None)),
-            image_id=kwargs['image_id'],
+            image_id=self._get_image(context, kwargs['image_id'])['id'],
             min_count=int(kwargs.get('min_count', max_count)),
             max_count=max_count,
-            kernel_id=kwargs.get('kernel_id', None),
+            kernel_id=kwargs.get('kernel_id'),
             ramdisk_id=kwargs.get('ramdisk_id'),
             display_name=kwargs.get('display_name'),
             display_description=kwargs.get('display_description'),
@@ -806,7 +816,7 @@ class CloudController(object):
         instance_id is a kwarg so its name cannot be modified."""
         LOG.debug(_("Going to start terminating instances"))
         for ec2_id in instance_id:
-            instance_id = ec2_id_to_id(ec2_id)
+            instance_id = ec2utils.ec2_id_to_id(ec2_id)
             self.compute_api.delete(context, instance_id=instance_id)
         return True
 
@@ -814,64 +824,103 @@ class CloudController(object):
         """instance_id is a list of instance ids"""
         LOG.audit(_("Reboot instance %r"), instance_id, context=context)
         for ec2_id in instance_id:
-            instance_id = ec2_id_to_id(ec2_id)
+            instance_id = ec2utils.ec2_id_to_id(ec2_id)
             self.compute_api.reboot(context, instance_id=instance_id)
         return True
 
     def rescue_instance(self, context, instance_id, **kwargs):
         """This is an extension to the normal ec2_api"""
-        instance_id = ec2_id_to_id(instance_id)
+        instance_id = ec2utils.ec2_id_to_id(instance_id)
         self.compute_api.rescue(context, instance_id=instance_id)
         return True
 
     def unrescue_instance(self, context, instance_id, **kwargs):
         """This is an extension to the normal ec2_api"""
-        instance_id = ec2_id_to_id(instance_id)
+        instance_id = ec2utils.ec2_id_to_id(instance_id)
         self.compute_api.unrescue(context, instance_id=instance_id)
         return True
 
-    def update_instance(self, context, ec2_id, **kwargs):
+    def update_instance(self, context, instance_id, **kwargs):
         updatable_fields = ['display_name', 'display_description']
         changes = {}
         for field in updatable_fields:
             if field in kwargs:
                 changes[field] = kwargs[field]
         if changes:
-            instance_id = ec2_id_to_id(ec2_id)
+            instance_id = ec2utils.ec2_id_to_id(instance_id)
             self.compute_api.update(context, instance_id=instance_id, **kwargs)
         return True
 
-    def _format_image(self, context, image):
+    _type_prefix_map = {'machine': 'ami',
+                        'kernel': 'aki',
+                        'ramdisk': 'ari'}
+
+    def _image_ec2_id(self, image_id, image_type='machine'):
+        prefix = self._type_prefix_map[image_type]
+        template = prefix + '-%08x'
+        return ec2utils.id_to_ec2_id(int(image_id), template=template)
+
+    def _get_image(self, context, ec2_id):
+        try:
+            internal_id = ec2utils.ec2_id_to_id(ec2_id)
+            return self.image_service.show(context, internal_id)
+        except exception.NotFound:
+            return self.image_service.show_by_name(context, ec2_id)
+
+    def _format_image(self, image):
         """Convert from format defined by BaseImageService to S3 format."""
         i = {}
-        i['imageId'] = image.get('id')
-        i['kernelId'] = image.get('kernel_id')
-        i['ramdiskId'] = image.get('ramdisk_id')
-        i['imageOwnerId'] = image.get('owner_id')
-        i['imageLocation'] = image.get('location')
-        i['imageState'] = image.get('status')
-        i['type'] = image.get('type')
-        i['isPublic'] = image.get('is_public')
-        i['architecture'] = image.get('architecture')
+        image_type = image['properties'].get('type')
+        ec2_id = self._image_ec2_id(image.get('id'), image_type)
+        name = image.get('name')
+        if name:
+            i['imageId'] = "%s (%s)" % (ec2_id, name)
+        else:
+            i['imageId'] = ec2_id
+        kernel_id = image['properties'].get('kernel_id')
+        if kernel_id:
+            i['kernelId'] = self._image_ec2_id(kernel_id, 'kernel')
+        ramdisk_id = image['properties'].get('ramdisk_id')
+        if ramdisk_id:
+            i['ramdiskId'] = self._image_ec2_id(ramdisk_id, 'ramdisk')
+        i['imageOwnerId'] = image['properties'].get('owner_id')
+        i['imageLocation'] = image['properties'].get('image_location')
+        i['imageState'] = image['properties'].get('image_state')
+        i['type'] = image_type
+        i['isPublic'] = str(image['properties'].get('is_public', '')) == 'True'
+        i['architecture'] = image['properties'].get('architecture')
         return i
 
     def describe_images(self, context, image_id=None, **kwargs):
         # NOTE: image_id is a list!
-        images = self.image_service.index(context)
         if image_id:
-            images = filter(lambda x: x['id'] in image_id, images)
-        images = [self._format_image(context, i) for i in images]
+            images = []
+            for ec2_id in image_id:
+                try:
+                    image = self._get_image(context, ec2_id)
+                except exception.NotFound:
+                    raise exception.NotFound(_('Image %s not found') %
+                                             ec2_id)
+                images.append(image)
+        else:
+            images = self.image_service.detail(context)
+        images = [self._format_image(i) for i in images]
         return {'imagesSet': images}
 
     def deregister_image(self, context, image_id, **kwargs):
         LOG.audit(_("De-registering image %s"), image_id, context=context)
-        self.image_service.deregister(context, image_id)
+        image = self._get_image(context, image_id)
+        internal_id = image['id']
+        self.image_service.delete(context, internal_id)
         return {'imageId': image_id}
 
     def register_image(self, context, image_location=None, **kwargs):
         if image_location is None and 'name' in kwargs:
             image_location = kwargs['name']
-        image_id = self.image_service.register(context, image_location)
+        metadata = {'properties': {'image_location': image_location}}
+        image = self.image_service.create(context, metadata)
+        image_id = self._image_ec2_id(image['id'],
+                                      image['properties']['type'])
         msg = _("Registered image %(image_location)s with"
                 " id %(image_id)s") % locals()
         LOG.audit(msg, context=context)
@@ -882,14 +931,11 @@ class CloudController(object):
             raise exception.ApiError(_('attribute not supported: %s')
                                      % attribute)
         try:
-            image = self.image_service.show(context, image_id)
-            image = self._format_image(context,
-                                       self.image_service.show(context,
-                                                               image_id))
-        except IndexError:
-            raise exception.ApiError(_('invalid id: %s') % image_id)
-        result = {'image_id': image_id, 'launchPermission': []}
-        if image['isPublic']:
+            image = self._get_image(context, image_id)
+        except exception.NotFound:
+            raise exception.NotFound(_('Image %s not found') % image_id)
+        result = {'imageId': image_id, 'launchPermission': []}
+        if image['properties']['is_public']:
             result['launchPermission'].append({'group': 'all'})
         return result
 
@@ -906,8 +952,18 @@ class CloudController(object):
         if not operation_type in ['add', 'remove']:
             raise exception.ApiError(_('operation_type must be add or remove'))
         LOG.audit(_("Updating image %s publicity"), image_id, context=context)
-        return self.image_service.modify(context, image_id, operation_type)
+
+        try:
+            image = self._get_image(context, image_id)
+        except exception.NotFound:
+            raise exception.NotFound(_('Image %s not found') % image_id)
+        internal_id = image['id']
+        del(image['id'])
+        raise Exception(image)
+        image['properties']['is_public'] = (operation_type == 'add')
+        return self.image_service.update(context, internal_id, image)
 
     def update_image(self, context, image_id, **kwargs):
-        result = self.image_service.update(context, image_id, dict(kwargs))
+        internal_id = ec2utils.ec2_id_to_id(image_id)
+        result = self.image_service.update(context, internal_id, dict(kwargs))
         return result
diff --git a/nova/api/ec2/ec2utils.py b/nova/api/ec2/ec2utils.py
new file mode 100644
index 000000000..3b34f6ea5
--- /dev/null
+++ b/nova/api/ec2/ec2utils.py
@@ -0,0 +1,32 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from nova import exception
+
+
+def ec2_id_to_id(ec2_id):
+    """Convert an ec2 ID (i-[base 16 number]) to an instance id (int)"""
+    try:
+        return int(ec2_id.split('-')[-1], 16)
+    except ValueError:
+        raise exception.NotFound(_("Id %s Not Found") % ec2_id)
+
+
+def id_to_ec2_id(instance_id, template='i-%08x'):
+    """Convert an instance ID (int) to an ec2 ID (i-[base 16 number])"""
+    return template % instance_id
diff --git a/nova/api/ec2/metadatarequesthandler.py b/nova/api/ec2/metadatarequesthandler.py
index 6fb441656..28f99b0ef 100644
--- a/nova/api/ec2/metadatarequesthandler.py
+++ b/nova/api/ec2/metadatarequesthandler.py
@@ -65,7 +65,7 @@ class MetadataRequestHandler(wsgi.Application):
                 data = data[item]
         return data
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         cc = cloud.CloudController()
         remote_address = req.remote_addr
diff --git a/nova/api/openstack/__init__.py b/nova/api/openstack/__init__.py
index d0b18eced..ce3cff337 100644
--- a/nova/api/openstack/__init__.py
+++ b/nova/api/openstack/__init__.py
@@ -27,6 +27,7 @@ import webob.exc
 from nova import flags
 from nova import log as logging
 from nova import wsgi
+from nova.api.openstack import accounts
 from nova.api.openstack import faults
 from nova.api.openstack import backup_schedules
 from nova.api.openstack import consoles
@@ -34,6 +35,7 @@ from nova.api.openstack import flavors
 from nova.api.openstack import images
 from nova.api.openstack import servers
 from nova.api.openstack import shared_ip_groups
+from nova.api.openstack import users
 from nova.api.openstack import zones
 
 
@@ -47,7 +49,7 @@ flags.DEFINE_bool('allow_admin_api',
 class FaultWrapper(wsgi.Middleware):
     """Calls down the middleware stack, making exceptions into faults."""
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         try:
             return req.get_response(self.application)
@@ -74,17 +76,28 @@ class APIRouter(wsgi.Router):
         server_members = {'action': 'POST'}
         if FLAGS.allow_admin_api:
             LOG.debug(_("Including admin operations in API."))
+
             server_members['pause'] = 'POST'
             server_members['unpause'] = 'POST'
-            server_members["diagnostics"] = "GET"
-            server_members["actions"] = "GET"
+            server_members['diagnostics'] = 'GET'
+            server_members['actions'] = 'GET'
             server_members['suspend'] = 'POST'
             server_members['resume'] = 'POST'
+            server_members['rescue'] = 'POST'
+            server_members['unrescue'] = 'POST'
             server_members['reset_network'] = 'POST'
+            server_members['inject_network_info'] = 'POST'
 
             mapper.resource("zone", "zones", controller=zones.Controller(),
+                        collection={'detail': 'GET', 'info': 'GET'}),
+
+            mapper.resource("user", "users", controller=users.Controller(),
                         collection={'detail': 'GET'})
 
+            mapper.resource("account", "accounts",
+                            controller=accounts.Controller(),
+                            collection={'detail': 'GET'})
+
         mapper.resource("server", "servers", controller=servers.Controller(),
                         collection={'detail': 'GET'},
                         member=server_members)
@@ -111,7 +124,7 @@ class APIRouter(wsgi.Router):
 
 
 class Versions(wsgi.Application):
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         """Respond to a request for all OpenStack API versions."""
         response = {
@@ -120,4 +133,6 @@ class Versions(wsgi.Application):
         metadata = {
             "application/xml": {
                 "attributes": dict(version=["status", "id"])}}
-        return wsgi.Serializer(req.environ, metadata).to_content_type(response)
+
+        content_type = req.best_match_content_type()
+        return wsgi.Serializer(metadata).serialize(response, content_type)
diff --git a/nova/api/openstack/accounts.py b/nova/api/openstack/accounts.py
new file mode 100644
index 000000000..2510ffb61
--- /dev/null
+++ b/nova/api/openstack/accounts.py
@@ -0,0 +1,85 @@
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import common
+
+from nova import exception
+from nova import flags
+from nova import log as logging
+from nova import wsgi
+
+from nova.auth import manager
+from nova.api.openstack import faults
+
+FLAGS = flags.FLAGS
+LOG = logging.getLogger('nova.api.openstack')
+
+
+def _translate_keys(account):
+    return dict(id=account.id,
+                name=account.name,
+                description=account.description,
+                manager=account.project_manager_id)
+
+
+class Controller(wsgi.Controller):
+
+    _serialization_metadata = {
+        'application/xml': {
+            "attributes": {
+                "account": ["id", "name", "description", "manager"]}}}
+
+    def __init__(self):
+        self.manager = manager.AuthManager()
+
+    def _check_admin(self, context):
+        """We cannot depend on the db layer to check for admin access
+           for the auth manager, so we do it here"""
+        if not context.is_admin:
+            raise exception.NotAuthorized(_("Not admin user."))
+
+    def index(self, req):
+        raise faults.Fault(exc.HTTPNotImplemented())
+
+    def detail(self, req):
+        raise faults.Fault(exc.HTTPNotImplemented())
+
+    def show(self, req, id):
+        """Return data about the given account id"""
+        account = self.manager.get_project(id)
+        return dict(account=_translate_keys(account))
+
+    def delete(self, req, id):
+        self._check_admin(req.environ['nova.context'])
+        self.manager.delete_project(id)
+        return {}
+
+    def create(self, req):
+        """We use update with create-or-update semantics
+           because the id comes from an external source"""
+        raise faults.Fault(exc.HTTPNotImplemented())
+
+    def update(self, req, id):
+        """This is really create or update."""
+        self._check_admin(req.environ['nova.context'])
+        env = self._deserialize(req.body, req.get_content_type())
+        description = env['account'].get('description')
+        manager = env['account'].get('manager')
+        try:
+            account = self.manager.get_project(id)
+            self.manager.modify_project(id, manager, description)
+        except exception.NotFound:
+            account = self.manager.create_project(id, manager, description)
+        return dict(account=_translate_keys(account))
diff --git a/nova/api/openstack/auth.py b/nova/api/openstack/auth.py
index 473071738..4c6b58eff 100644
--- a/nova/api/openstack/auth.py
+++ b/nova/api/openstack/auth.py
@@ -19,7 +19,6 @@ import datetime
 import hashlib
 import json
 import time
-import logging
 
 import webob.exc
 import webob.dec
@@ -27,12 +26,15 @@ import webob.dec
 from nova import auth
 from nova import context
 from nova import db
+from nova import exception
 from nova import flags
+from nova import log as logging
 from nova import manager
 from nova import utils
 from nova import wsgi
 from nova.api.openstack import faults
 
+LOG = logging.getLogger('nova.api.openstack')
 FLAGS = flags.FLAGS
 
 
@@ -46,18 +48,27 @@ class AuthMiddleware(wsgi.Middleware):
         self.auth = auth.manager.AuthManager()
         super(AuthMiddleware, self).__init__(application)
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         if not self.has_authentication(req):
             return self.authenticate(req)
-
         user = self.get_user_by_authentication(req)
-
+        accounts = self.auth.get_projects(user=user)
         if not user:
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
-        project = self.auth.get_project(FLAGS.default_project)
-        req.environ['nova.context'] = context.RequestContext(user, project)
+        if accounts:
+            #we are punting on this til auth is settled,
+            #and possibly til api v1.1 (mdragon)
+            account = accounts[0]
+        else:
+            return faults.Fault(webob.exc.HTTPUnauthorized())
+
+        if not self.auth.is_admin(user) and \
+           not self.auth.is_project_member(user, account):
+            return faults.Fault(webob.exc.HTTPUnauthorized())
+
+        req.environ['nova.context'] = context.RequestContext(user, account)
         return self.application
 
     def has_authentication(self, req):
@@ -104,11 +115,14 @@ class AuthMiddleware(wsgi.Middleware):
         2 days ago.
         """
         ctxt = context.get_admin_context()
-        token = self.db.auth_get_token(ctxt, token_hash)
+        try:
+            token = self.db.auth_token_get(ctxt, token_hash)
+        except exception.NotFound:
+            return None
         if token:
             delta = datetime.datetime.now() - token.created_at
             if delta.days >= 2:
-                self.db.auth_destroy_token(ctxt, token)
+                self.db.auth_token_destroy(ctxt, token.token_hash)
             else:
                 return self.auth.get_user(token.user_id)
         return None
@@ -118,20 +132,21 @@ class AuthMiddleware(wsgi.Middleware):
 
         username - string
         key - string API key
-        req - webob.Request object
+        req - wsgi.Request object
         """
         ctxt = context.get_admin_context()
         user = self.auth.get_user_from_access_key(key)
+
         if user and user.name == username:
             token_hash = hashlib.sha1('%s%s%f' % (username, key,
                 time.time())).hexdigest()
             token_dict = {}
             token_dict['token_hash'] = token_hash
             token_dict['cdn_management_url'] = ''
-            # Same as auth url, e.g. http://foo.org:8774/baz/v1.0
-            token_dict['server_management_url'] = req.url
+            os_url = req.url
+            token_dict['server_management_url'] = os_url
             token_dict['storage_url'] = ''
             token_dict['user_id'] = user.id
-            token = self.db.auth_create_token(ctxt, token_dict)
+            token = self.db.auth_token_create(ctxt, token_dict)
             return token, user
         return None, None
diff --git a/nova/api/openstack/backup_schedules.py b/nova/api/openstack/backup_schedules.py
index 197125d86..7abb5f884 100644
--- a/nova/api/openstack/backup_schedules.py
+++ b/nova/api/openstack/backup_schedules.py
@@ -15,7 +15,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import logging
 import time
 
 from webob import exc
diff --git a/nova/api/openstack/common.py b/nova/api/openstack/common.py
index 1dc3767e2..74ac21024 100644
--- a/nova/api/openstack/common.py
+++ b/nova/api/openstack/common.py
@@ -15,6 +15,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import webob.exc
+
 from nova import exception
 
 
@@ -23,22 +25,29 @@ def limited(items, request, max_limit=1000):
     Return a slice of items according to requested offset and limit.
 
     @param items: A sliceable entity
-    @param request: `webob.Request` possibly containing 'offset' and 'limit'
+    @param request: `wsgi.Request` possibly containing 'offset' and 'limit'
                     GET variables. 'offset' is where to start in the list,
                     and 'limit' is the maximum number of items to return. If
                     'limit' is not specified, 0, or > max_limit, we default
-                    to max_limit.
+                    to max_limit. Negative values for either offset or limit
+                    will cause exc.HTTPBadRequest() exceptions to be raised.
     @kwarg max_limit: The maximum number of items to return from 'items'
     """
     try:
         offset = int(request.GET.get('offset', 0))
     except ValueError:
-        offset = 0
+        raise webob.exc.HTTPBadRequest(_('offset param must be an integer'))
 
     try:
         limit = int(request.GET.get('limit', max_limit))
     except ValueError:
-        limit = max_limit
+        raise webob.exc.HTTPBadRequest(_('limit param must be an integer'))
+
+    if limit < 0:
+        raise webob.exc.HTTPBadRequest(_('limit param must be positive'))
+
+    if offset < 0:
+        raise webob.exc.HTTPBadRequest(_('offset param must be positive'))
 
     limit = min(max_limit, limit or max_limit)
     range_end = offset + limit
diff --git a/nova/api/openstack/consoles.py b/nova/api/openstack/consoles.py
index 9ebdbe710..8c291c2eb 100644
--- a/nova/api/openstack/consoles.py
+++ b/nova/api/openstack/consoles.py
@@ -65,7 +65,7 @@ class Controller(wsgi.Controller):
 
     def create(self, req, server_id):
         """Creates a new console"""
-        #info = self._deserialize(req.body, req)
+        #info = self._deserialize(req.body, req.get_content_type())
         self.console_api.create_console(
                                 req.environ['nova.context'],
                                 int(server_id))
diff --git a/nova/api/openstack/faults.py b/nova/api/openstack/faults.py
index 224a7ef0b..2fd733299 100644
--- a/nova/api/openstack/faults.py
+++ b/nova/api/openstack/faults.py
@@ -42,7 +42,7 @@ class Fault(webob.exc.HTTPException):
         """Create a Fault for the given webob.exc.exception."""
         self.wrapped_exc = exception
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         """Generate a WSGI response based on the exception passed to ctor."""
         # Replace the body with fault details.
@@ -57,6 +57,7 @@ class Fault(webob.exc.HTTPException):
             fault_data[fault_name]['retryAfter'] = retry
         # 'code' is an attribute on the fault tag itself
         metadata = {'application/xml': {'attributes': {fault_name: 'code'}}}
-        serializer = wsgi.Serializer(req.environ, metadata)
-        self.wrapped_exc.body = serializer.to_content_type(fault_data)
+        serializer = wsgi.Serializer(metadata)
+        content_type = req.best_match_content_type()
+        self.wrapped_exc.body = serializer.serialize(fault_data, content_type)
         return self.wrapped_exc
diff --git a/nova/api/openstack/flavors.py b/nova/api/openstack/flavors.py
index f620d4107..f3d040ba3 100644
--- a/nova/api/openstack/flavors.py
+++ b/nova/api/openstack/flavors.py
@@ -17,6 +17,8 @@
 
 from webob import exc
 
+from nova import db
+from nova import context
 from nova.api.openstack import faults
 from nova.api.openstack import common
 from nova.compute import instance_types
@@ -39,19 +41,19 @@ class Controller(wsgi.Controller):
 
     def detail(self, req):
         """Return all flavors in detail."""
-        items = [self.show(req, id)['flavor'] for id in self._all_ids()]
-        items = common.limited(items, req)
+        items = [self.show(req, id)['flavor'] for id in self._all_ids(req)]
         return dict(flavors=items)
 
     def show(self, req, id):
         """Return data about the given flavor id."""
-        for name, val in instance_types.INSTANCE_TYPES.iteritems():
-            if val['flavorid'] == int(id):
-                item = dict(ram=val['memory_mb'], disk=val['local_gb'],
-                            id=val['flavorid'], name=name)
-                return dict(flavor=item)
+        ctxt = req.environ['nova.context']
+        values = db.instance_type_get_by_flavor_id(ctxt, id)
+        return dict(flavor=values)
         raise faults.Fault(exc.HTTPNotFound())
 
-    def _all_ids(self):
+    def _all_ids(self, req):
         """Return the list of all flavorids."""
-        return [i['flavorid'] for i in instance_types.INSTANCE_TYPES.values()]
+        ctxt = req.environ['nova.context']
+        inst_types = db.instance_type_get_all(ctxt)
+        flavor_ids = [inst_types[i]['flavorid'] for i in inst_types.keys()]
+        return sorted(flavor_ids)
diff --git a/nova/api/openstack/images.py b/nova/api/openstack/images.py
index 9d56bc508..98f0dd96b 100644
--- a/nova/api/openstack/images.py
+++ b/nova/api/openstack/images.py
@@ -15,8 +15,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import logging
-
 from webob import exc
 
 from nova import compute
@@ -153,7 +151,7 @@ class Controller(wsgi.Controller):
 
     def create(self, req):
         context = req.environ['nova.context']
-        env = self._deserialize(req.body, req)
+        env = self._deserialize(req.body, req.get_content_type())
         instance_id = env["image"]["serverId"]
         name = env["image"]["name"]
 
diff --git a/nova/api/openstack/ratelimiting/__init__.py b/nova/api/openstack/ratelimiting/__init__.py
index cbb4b897e..88ffc3246 100644
--- a/nova/api/openstack/ratelimiting/__init__.py
+++ b/nova/api/openstack/ratelimiting/__init__.py
@@ -57,7 +57,7 @@ class RateLimitingMiddleware(wsgi.Middleware):
             self.limiter = WSGIAppProxy(service_host)
         super(RateLimitingMiddleware, self).__init__(application)
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         """Rate limit the request.
 
@@ -183,7 +183,7 @@ class WSGIApp(object):
         """Create the WSGI application using the given Limiter instance."""
         self.limiter = limiter
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
         parts = req.path_info.split('/')
         # format: /limiter/<username>/<urlencoded action>
diff --git a/nova/api/openstack/servers.py b/nova/api/openstack/servers.py
index 486eca508..dc28a0782 100644
--- a/nova/api/openstack/servers.py
+++ b/nova/api/openstack/servers.py
@@ -13,6 +13,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import hashlib
 import json
 import traceback
 
@@ -33,7 +34,6 @@ import nova.api.openstack
 
 
 LOG = logging.getLogger('server')
-LOG.setLevel(logging.DEBUG)
 
 
 FLAGS = flags.FLAGS
@@ -51,7 +51,8 @@ def _translate_detail_keys(inst):
         power_state.PAUSED: 'paused',
         power_state.SHUTDOWN: 'active',
         power_state.SHUTOFF: 'active',
-        power_state.CRASHED: 'error'}
+        power_state.CRASHED: 'error',
+        power_state.FAILED: 'error'}
     inst_dict = {}
 
     mapped_keys = dict(status='state', imageId='image_id',
@@ -64,22 +65,22 @@ def _translate_detail_keys(inst):
     inst_dict['addresses'] = dict(public=[], private=[])
 
     # grab single private fixed ip
-    try:
-        private_ip = inst['fixed_ip']['address']
-        if private_ip:
-            inst_dict['addresses']['private'].append(private_ip)
-    except KeyError:
-        LOG.debug(_("Failed to read private ip"))
+    private_ips = utils.get_from_path(inst, 'fixed_ip/address')
+    inst_dict['addresses']['private'] = private_ips
 
     # grab all public floating ips
-    try:
-        for floating in inst['fixed_ip']['floating_ips']:
-            inst_dict['addresses']['public'].append(floating['address'])
-    except KeyError:
-        LOG.debug(_("Failed to read public ip(s)"))
+    public_ips = utils.get_from_path(inst, 'fixed_ip/floating_ips/address')
+    inst_dict['addresses']['public'] = public_ips
+
+    # Return the metadata as a dictionary
+    metadata = {}
+    for item in inst['metadata']:
+        metadata[item['key']] = item['value']
+    inst_dict['metadata'] = metadata
 
-    inst_dict['metadata'] = {}
     inst_dict['hostId'] = ''
+    if inst['host']:
+        inst_dict['hostId'] = hashlib.sha224(inst['host']).hexdigest()
 
     return dict(server=inst_dict)
 
@@ -97,7 +98,7 @@ class Controller(wsgi.Controller):
         'application/xml': {
             "attributes": {
                 "server": ["id", "imageId", "name", "flavorId", "hostId",
-                           "status", "progress"]}}}
+                           "status", "progress", "adminPass"]}}}
 
     def __init__(self):
         self.compute_api = compute.API()
@@ -138,38 +139,35 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPNotFound())
         return exc.HTTPAccepted()
 
-    def _get_kernel_ramdisk_from_image(self, req, image_id):
-        """
-        Machine images are associated with Kernels and Ramdisk images via
-        metadata stored in Glance as 'image_properties'
-        """
-        def lookup(param):
-            _image_id = image_id
-            try:
-                return image['properties'][param]
-            except KeyError:
-                raise exception.NotFound(
-                    _("%(param)s property not found for image %(_image_id)s") %
-                      locals())
-
-        image_id = str(image_id)
-        image = self._image_service.show(req.environ['nova.context'], image_id)
-        return lookup('kernel_id'), lookup('ramdisk_id')
-
     def create(self, req):
         """ Creates a new server for a given user """
-        env = self._deserialize(req.body, req)
+        env = self._deserialize(req.body, req.get_content_type())
         if not env:
             return faults.Fault(exc.HTTPUnprocessableEntity())
 
-        key_pair = auth_manager.AuthManager.get_key_pairs(
-            req.environ['nova.context'])[0]
+        context = req.environ['nova.context']
+        key_pairs = auth_manager.AuthManager.get_key_pairs(context)
+        if not key_pairs:
+            raise exception.NotFound(_("No keypairs defined"))
+        key_pair = key_pairs[0]
+
         image_id = common.get_image_id_from_image_hash(self._image_service,
-            req.environ['nova.context'], env['server']['imageId'])
+            context, env['server']['imageId'])
         kernel_id, ramdisk_id = self._get_kernel_ramdisk_from_image(
             req, image_id)
+
+        # Metadata is a list, not a Dictionary, because we allow duplicate keys
+        # (even though JSON can't encode this)
+        # In future, we may not allow duplicate keys.
+        # However, the CloudServers API is not definitive on this front,
+        #  and we want to be compatible.
+        metadata = []
+        if env['server'].get('metadata'):
+            for k, v in env['server']['metadata'].items():
+                metadata.append({'key': k, 'value': v})
+
         instances = self.compute_api.create(
-            req.environ['nova.context'],
+            context,
             instance_types.get_by_flavor_id(env['server']['flavorId']),
             image_id,
             kernel_id=kernel_id,
@@ -178,12 +176,23 @@ class Controller(wsgi.Controller):
             display_description=env['server']['name'],
             key_name=key_pair['name'],
             key_data=key_pair['public_key'],
+            metadata=metadata,
             onset_files=env.get('onset_files', []))
-        return _translate_keys(instances[0])
+
+        server = _translate_keys(instances[0])
+        password = "%s%s" % (server['server']['name'][:4],
+                             utils.generate_password(12))
+        server['server']['adminPass'] = password
+        self.compute_api.set_admin_password(context, server['server']['id'],
+                                            password)
+        return server
 
     def update(self, req, id):
         """ Updates the server name or password """
-        inst_dict = self._deserialize(req.body, req)
+        if len(req.body) == 0:
+            raise exc.HTTPUnprocessableEntity()
+
+        inst_dict = self._deserialize(req.body, req.get_content_type())
         if not inst_dict:
             return faults.Fault(exc.HTTPUnprocessableEntity())
 
@@ -204,10 +213,58 @@ class Controller(wsgi.Controller):
         return exc.HTTPNoContent()
 
     def action(self, req, id):
-        """ Multi-purpose method used to reboot, rebuild, and
-        resize a server """
-        input_dict = self._deserialize(req.body, req)
-        #TODO(sandy): rebuild/resize not supported.
+        """Multi-purpose method used to reboot, rebuild, or
+        resize a server"""
+
+        actions = {
+            'reboot':        self._action_reboot,
+            'resize':        self._action_resize,
+            'confirmResize': self._action_confirm_resize,
+            'revertResize':  self._action_revert_resize,
+            'rebuild':       self._action_rebuild,
+            }
+
+        input_dict = self._deserialize(req.body, req.get_content_type())
+        for key in actions.keys():
+            if key in input_dict:
+                return actions[key](input_dict, req, id)
+        return faults.Fault(exc.HTTPNotImplemented())
+
+    def _action_confirm_resize(self, input_dict, req, id):
+        try:
+            self.compute_api.confirm_resize(req.environ['nova.context'], id)
+        except Exception, e:
+            LOG.exception(_("Error in confirm-resize %s"), e)
+            return faults.Fault(exc.HTTPBadRequest())
+        return exc.HTTPNoContent()
+
+    def _action_revert_resize(self, input_dict, req, id):
+        try:
+            self.compute_api.revert_resize(req.environ['nova.context'], id)
+        except Exception, e:
+            LOG.exception(_("Error in revert-resize %s"), e)
+            return faults.Fault(exc.HTTPBadRequest())
+        return exc.HTTPAccepted()
+
+    def _action_rebuild(self, input_dict, req, id):
+        return faults.Fault(exc.HTTPNotImplemented())
+
+    def _action_resize(self, input_dict, req, id):
+        """ Resizes a given instance to the flavor size requested """
+        try:
+            if 'resize' in input_dict and 'flavorId' in input_dict['resize']:
+                flavor_id = input_dict['resize']['flavorId']
+                self.compute_api.resize(req.environ['nova.context'], id,
+                        flavor_id)
+            else:
+                LOG.exception(_("Missing arguments for resize"))
+                return faults.Fault(exc.HTTPUnprocessableEntity())
+        except Exception, e:
+            LOG.exception(_("Error in resize %s"), e)
+            return faults.Fault(exc.HTTPBadRequest())
+        return faults.Fault(exc.HTTPAccepted())
+
+    def _action_reboot(self, input_dict, req, id):
         try:
             reboot_type = input_dict['reboot']['type']
         except Exception:
@@ -278,6 +335,20 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    def inject_network_info(self, req, id):
+        """
+        Inject network info for an instance (admin only).
+
+        """
+        context = req.environ['nova.context']
+        try:
+            self.compute_api.inject_network_info(context, id)
+        except:
+            readable = traceback.format_exc()
+            LOG.exception(_("Compute.api::inject_network_info %s"), readable)
+            return faults.Fault(exc.HTTPUnprocessableEntity())
+        return exc.HTTPAccepted()
+
     def pause(self, req, id):
         """ Permit Admins to Pause the server. """
         ctxt = req.environ['nova.context']
@@ -322,6 +393,28 @@ class Controller(wsgi.Controller):
             return faults.Fault(exc.HTTPUnprocessableEntity())
         return exc.HTTPAccepted()
 
+    def rescue(self, req, id):
+        """Permit users to rescue the server."""
+        context = req.environ["nova.context"]
+        try:
+            self.compute_api.rescue(context, id)
+        except:
+            readable = traceback.format_exc()
+            LOG.exception(_("compute.api::rescue %s"), readable)
+            return faults.Fault(exc.HTTPUnprocessableEntity())
+        return exc.HTTPAccepted()
+
+    def unrescue(self, req, id):
+        """Permit users to unrescue the server."""
+        context = req.environ["nova.context"]
+        try:
+            self.compute_api.unrescue(context, id)
+        except:
+            readable = traceback.format_exc()
+            LOG.exception(_("compute.api::unrescue %s"), readable)
+            return faults.Fault(exc.HTTPUnprocessableEntity())
+        return exc.HTTPAccepted()
+
     def get_ajax_console(self, req, id):
         """ Returns a url to an instance's ajaxterm console. """
         try:
@@ -349,3 +442,37 @@ class Controller(wsgi.Controller):
                 action=item.action,
                 error=item.error))
         return dict(actions=actions)
+
+    def _get_kernel_ramdisk_from_image(self, req, image_id):
+        """Retrevies kernel and ramdisk IDs from Glance
+
+        Only 'machine' (ami) type use kernel and ramdisk outside of the
+        image.
+        """
+        # FIXME(sirp): Since we're retrieving the kernel_id from an
+        # image_property, this means only Glance is supported.
+        # The BaseImageService needs to expose a consistent way of accessing
+        # kernel_id and ramdisk_id
+        image = self._image_service.show(req.environ['nova.context'], image_id)
+
+        if image['status'] != 'active':
+            raise exception.Invalid(
+                _("Cannot build from image %(image_id)s, status not active") %
+                  locals())
+
+        if image['disk_format'] != 'ami':
+            return None, None
+
+        try:
+            kernel_id = image['properties']['kernel_id']
+        except KeyError:
+            raise exception.NotFound(
+                _("Kernel not found for image %(image_id)s") % locals())
+
+        try:
+            ramdisk_id = image['properties']['ramdisk_id']
+        except KeyError:
+            raise exception.NotFound(
+                _("Ramdisk not found for image %(image_id)s") % locals())
+
+        return kernel_id, ramdisk_id
diff --git a/nova/api/openstack/shared_ip_groups.py b/nova/api/openstack/shared_ip_groups.py
index bd3cc23a8..5d78f9377 100644
--- a/nova/api/openstack/shared_ip_groups.py
+++ b/nova/api/openstack/shared_ip_groups.py
@@ -15,8 +15,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import logging
-
 from webob import exc
 
 from nova import wsgi
diff --git a/nova/api/openstack/users.py b/nova/api/openstack/users.py
new file mode 100644
index 000000000..ebd0f4512
--- /dev/null
+++ b/nova/api/openstack/users.py
@@ -0,0 +1,93 @@
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import common
+
+from nova import exception
+from nova import flags
+from nova import log as logging
+from nova import wsgi
+
+from nova.auth import manager
+
+FLAGS = flags.FLAGS
+LOG = logging.getLogger('nova.api.openstack')
+
+
+def _translate_keys(user):
+    return dict(id=user.id,
+                name=user.name,
+                access=user.access,
+                secret=user.secret,
+                admin=user.admin)
+
+
+class Controller(wsgi.Controller):
+
+    _serialization_metadata = {
+        'application/xml': {
+            "attributes": {
+                "user": ["id", "name", "access", "secret", "admin"]}}}
+
+    def __init__(self):
+        self.manager = manager.AuthManager()
+
+    def _check_admin(self, context):
+        """We cannot depend on the db layer to check for admin access
+           for the auth manager, so we do it here"""
+        if not context.is_admin:
+            raise exception.NotAuthorized(_("Not admin user"))
+
+    def index(self, req):
+        """Return all users in brief"""
+        users = self.manager.get_users()
+        users = common.limited(users, req)
+        users = [_translate_keys(user) for user in users]
+        return dict(users=users)
+
+    def detail(self, req):
+        """Return all users in detail"""
+        return self.index(req)
+
+    def show(self, req, id):
+        """Return data about the given user id"""
+        user = self.manager.get_user(id)
+        return dict(user=_translate_keys(user))
+
+    def delete(self, req, id):
+        self._check_admin(req.environ['nova.context'])
+        self.manager.delete_user(id)
+        return {}
+
+    def create(self, req):
+        self._check_admin(req.environ['nova.context'])
+        env = self._deserialize(req.body, req.get_content_type())
+        is_admin = env['user'].get('admin') in ('T', 'True', True)
+        name = env['user'].get('name')
+        access = env['user'].get('access')
+        secret = env['user'].get('secret')
+        user = self.manager.create_user(name, access, secret, is_admin)
+        return dict(user=_translate_keys(user))
+
+    def update(self, req, id):
+        self._check_admin(req.environ['nova.context'])
+        env = self._deserialize(req.body, req.get_content_type())
+        is_admin = env['user'].get('admin')
+        if is_admin is not None:
+            is_admin = is_admin in ('T', 'True', True)
+        access = env['user'].get('access')
+        secret = env['user'].get('secret')
+        self.manager.modify_user(id, access, secret, is_admin)
+        return dict(user=_translate_keys(self.manager.get_user(id)))
diff --git a/nova/api/openstack/zones.py b/nova/api/openstack/zones.py
index 830464ffd..8fe84275a 100644
--- a/nova/api/openstack/zones.py
+++ b/nova/api/openstack/zones.py
@@ -1,4 +1,4 @@
-# Copyright 2010 OpenStack LLC.
+# Copyright 2011 OpenStack LLC.
 # All Rights Reserved.
 #
 #    Licensed under the Apache License, Version 2.0 (the "License"); you may
@@ -14,11 +14,11 @@
 #    under the License.
 
 import common
-import logging
 
 from nova import flags
 from nova import wsgi
 from nova import db
+from nova.scheduler import api
 
 
 FLAGS = flags.FLAGS
@@ -33,6 +33,10 @@ def _filter_keys(item, keys):
     return dict((k, v) for k, v in item.iteritems() if k in keys)
 
 
+def _exclude_keys(item, keys):
+    return dict((k, v) for k, v in item.iteritems() if k not in keys)
+
+
 def _scrub_zone(zone):
     return _filter_keys(zone, ('id', 'api_url'))
 
@@ -42,19 +46,30 @@ class Controller(wsgi.Controller):
     _serialization_metadata = {
         'application/xml': {
             "attributes": {
-                "zone": ["id", "api_url"]}}}
+                "zone": ["id", "api_url", "name", "capabilities"]}}}
 
     def index(self, req):
         """Return all zones in brief"""
-        items = db.zone_get_all(req.environ['nova.context'])
+        # Ask the ZoneManager in the Scheduler for most recent data,
+        # or fall-back to the database ...
+        items = api.API().get_zone_list(req.environ['nova.context'])
+        if not items:
+            items = db.zone_get_all(req.environ['nova.context'])
+
         items = common.limited(items, req)
-        items = [_scrub_zone(item) for item in items]
+        items = [_exclude_keys(item, ['username', 'password'])
+                      for item in items]
         return dict(zones=items)
 
     def detail(self, req):
         """Return all zones in detail"""
         return self.index(req)
 
+    def info(self, req):
+        """Return name and capabilities for this zone."""
+        return dict(zone=dict(name=FLAGS.zone_name,
+                    capabilities=FLAGS.zone_capabilities))
+
     def show(self, req, id):
         """Return data about the given zone id"""
         zone_id = int(id)
@@ -68,13 +83,13 @@ class Controller(wsgi.Controller):
 
     def create(self, req):
         context = req.environ['nova.context']
-        env = self._deserialize(req.body, req)
+        env = self._deserialize(req.body, req.get_content_type())
         zone = db.zone_create(context, env["zone"])
         return dict(zone=_scrub_zone(zone))
 
     def update(self, req, id):
         context = req.environ['nova.context']
-        env = self._deserialize(req.body, req)
+        env = self._deserialize(req.body, req.get_content_type())
         zone_id = int(id)
         zone = db.zone_update(context, zone_id, env["zone"])
         return dict(zone=_scrub_zone(zone))
diff --git a/nova/compute/api.py b/nova/compute/api.py
index 0d2690c72..61f8b2a6a 100644
--- a/nova/compute/api.py
+++ b/nova/compute/api.py
@@ -85,12 +85,12 @@ class API(base.Base):
                min_count=1, max_count=1,
                display_name='', display_description='',
                key_name=None, key_data=None, security_group='default',
-               availability_zone=None, user_data=None,
+               availability_zone=None, user_data=None, metadata=[],
                onset_files=None):
         """Create the number of instances requested if quota and
-        other arguments check out ok.
-        """
-        type_data = instance_types.INSTANCE_TYPES[instance_type]
+        other arguments check out ok."""
+
+        type_data = instance_types.get_instance_type(instance_type)
         num_instances = quota.allowed_instances(context, max_count, type_data)
         if num_instances < min_count:
             pid = context.project_id
@@ -100,25 +100,53 @@ class API(base.Base):
                                      "run %s more instances of this type.") %
                                    num_instances, "InstanceLimitExceeded")
 
-        is_vpn = image_id == FLAGS.vpn_image_id
-        if not is_vpn:
-            image = self.image_service.show(context, image_id)
-            if kernel_id is None:
-                kernel_id = image.get('kernel_id', None)
-            if ramdisk_id is None:
-                ramdisk_id = image.get('ramdisk_id', None)
-            # No kernel and ramdisk for raw images
-            if kernel_id == str(FLAGS.null_kernel):
-                kernel_id = None
-                ramdisk_id = None
-                LOG.debug(_("Creating a raw instance"))
-            # Make sure we have access to kernel and ramdisk (if not raw)
-            logging.debug("Using Kernel=%s, Ramdisk=%s" %
-                           (kernel_id, ramdisk_id))
-            if kernel_id:
-                self.image_service.show(context, kernel_id)
-            if ramdisk_id:
-                self.image_service.show(context, ramdisk_id)
+        num_metadata = len(metadata)
+        quota_metadata = quota.allowed_metadata_items(context, num_metadata)
+        if quota_metadata < num_metadata:
+            pid = context.project_id
+            msg = (_("Quota exceeeded for %(pid)s,"
+                     " tried to set %(num_metadata)s metadata properties")
+                   % locals())
+            LOG.warn(msg)
+            raise quota.QuotaError(msg, "MetadataLimitExceeded")
+
+        # Because metadata is stored in the DB, we hard-code the size limits
+        # In future, we may support more variable length strings, so we act
+        #  as if this is quota-controlled for forwards compatibility
+        for metadata_item in metadata:
+            k = metadata_item['key']
+            v = metadata_item['value']
+            if len(k) > 255 or len(v) > 255:
+                pid = context.project_id
+                msg = (_("Quota exceeeded for %(pid)s,"
+                         " metadata property key or value too long")
+                       % locals())
+                LOG.warn(msg)
+                raise quota.QuotaError(msg, "MetadataLimitExceeded")
+
+        image = self.image_service.show(context, image_id)
+
+        os_type = None
+        if 'properties' in image and 'os_type' in image['properties']:
+            os_type = image['properties']['os_type']
+
+        if kernel_id is None:
+            kernel_id = image['properties'].get('kernel_id', None)
+        if ramdisk_id is None:
+            ramdisk_id = image['properties'].get('ramdisk_id', None)
+        # FIXME(sirp): is there a way we can remove null_kernel?
+        # No kernel and ramdisk for raw images
+        if kernel_id == str(FLAGS.null_kernel):
+            kernel_id = None
+            ramdisk_id = None
+            LOG.debug(_("Creating a raw instance"))
+        # Make sure we have access to kernel and ramdisk (if not raw)
+        logging.debug("Using Kernel=%s, Ramdisk=%s" %
+                       (kernel_id, ramdisk_id))
+        if kernel_id:
+            self.image_service.show(context, kernel_id)
+        if ramdisk_id:
+            self.image_service.show(context, ramdisk_id)
 
         if security_group is None:
             security_group = ['default']
@@ -142,6 +170,7 @@ class API(base.Base):
             'image_id': image_id,
             'kernel_id': kernel_id or '',
             'ramdisk_id': ramdisk_id or '',
+            'state': 0,
             'state_description': 'scheduling',
             'user_id': context.user_id,
             'project_id': context.project_id,
@@ -156,7 +185,9 @@ class API(base.Base):
             'key_name': key_name,
             'key_data': key_data,
             'locked': False,
-            'availability_zone': availability_zone}
+            'metadata': metadata,
+            'availability_zone': availability_zone,
+            'os_type': os_type}
         elevated = context.elevated()
         instances = []
         LOG.debug(_("Going to run %s instances..."), num_instances)
@@ -295,12 +326,12 @@ class API(base.Base):
         try:
             instance = self.get(context, instance_id)
         except exception.NotFound:
-            LOG.warning(_("Instance %d was not found during terminate"),
+            LOG.warning(_("Instance %s was not found during terminate"),
                         instance_id)
             raise
 
         if (instance['state_description'] == 'terminating'):
-            LOG.warning(_("Instance %d is already being terminated"),
+            LOG.warning(_("Instance %s is already being terminated"),
                         instance_id)
             return
 
@@ -380,6 +411,10 @@ class API(base.Base):
         kwargs = {'method': method, 'args': params}
         return rpc.call(context, queue, kwargs)
 
+    def _cast_scheduler_message(self, context, args):
+        """Generic handler for RPC calls to the scheduler"""
+        rpc.cast(context, FLAGS.scheduler_topic, args)
+
     def snapshot(self, context, instance_id, name):
         """Snapshot the given instance.
 
@@ -396,6 +431,45 @@ class API(base.Base):
         """Reboot the given instance."""
         self._cast_compute_message('reboot_instance', context, instance_id)
 
+    def revert_resize(self, context, instance_id):
+        """Reverts a resize, deleting the 'new' instance in the process"""
+        context = context.elevated()
+        migration_ref = self.db.migration_get_by_instance_and_status(context,
+                instance_id, 'finished')
+        if not migration_ref:
+            raise exception.NotFound(_("No finished migrations found for "
+                    "instance"))
+
+        params = {'migration_id': migration_ref['id']}
+        self._cast_compute_message('revert_resize', context, instance_id,
+                migration_ref['dest_compute'], params=params)
+
+    def confirm_resize(self, context, instance_id):
+        """Confirms a migration/resize, deleting the 'old' instance in the
+        process."""
+        context = context.elevated()
+        migration_ref = self.db.migration_get_by_instance_and_status(context,
+                instance_id, 'finished')
+        if not migration_ref:
+            raise exception.NotFound(_("No finished migrations found for "
+                    "instance"))
+        instance_ref = self.db.instance_get(context, instance_id)
+        params = {'migration_id': migration_ref['id']}
+        self._cast_compute_message('confirm_resize', context, instance_id,
+                migration_ref['source_compute'], params=params)
+
+        self.db.migration_update(context, migration_id,
+                {'status': 'confirmed'})
+        self.db.instance_update(context, instance_id,
+                {'host': migration_ref['dest_compute'], })
+
+    def resize(self, context, instance_id, flavor):
+        """Resize a running instance."""
+        self._cast_scheduler_message(context,
+                    {"method": "prep_resize",
+                     "args": {"topic": FLAGS.compute_topic,
+                              "instance_id": instance_id, }},)
+
     def pause(self, context, instance_id):
         """Pause the given instance."""
         self._cast_compute_message('pause_instance', context, instance_id)
@@ -431,9 +505,10 @@ class API(base.Base):
         """Unrescue the given instance."""
         self._cast_compute_message('unrescue_instance', context, instance_id)
 
-    def set_admin_password(self, context, instance_id):
+    def set_admin_password(self, context, instance_id, password=None):
         """Set the root/admin password for the given instance."""
-        self._cast_compute_message('set_admin_password', context, instance_id)
+        self._cast_compute_message('set_admin_password', context, instance_id,
+                                    password)
 
     def inject_file(self, context, instance_id):
         """Write a file to the given instance."""
@@ -449,7 +524,7 @@ class API(base.Base):
                  {'method': 'authorize_ajax_console',
                   'args': {'token': output['token'], 'host': output['host'],
                   'port': output['port']}})
-        return {'url': '%s?token=%s' % (FLAGS.ajax_console_proxy_url,
+        return {'url': '%s/?token=%s' % (FLAGS.ajax_console_proxy_url,
                 output['token'])}
 
     def get_console_output(self, context, instance_id):
@@ -478,6 +553,13 @@ class API(base.Base):
         """
         self._cast_compute_message('reset_network', context, instance_id)
 
+    def inject_network_info(self, context, instance_id):
+        """
+        Inject network info for the instance.
+
+        """
+        self._cast_compute_message('inject_network_info', context, instance_id)
+
     def attach_volume(self, context, instance_id, volume_id, device):
         if not re.match("^/dev/[a-z]d[a-z]+$", device):
             raise exception.ApiError(_("Invalid device specified: %s. "
diff --git a/nova/compute/instance_types.py b/nova/compute/instance_types.py
index 309313fd0..fa02a5dfa 100644
--- a/nova/compute/instance_types.py
+++ b/nova/compute/instance_types.py
@@ -4,6 +4,7 @@
 # Administrator of the National Aeronautics and Space Administration.
 # All Rights Reserved.
 # Copyright (c) 2010 Citrix Systems, Inc.
+# Copyright 2011 Ken Pepple
 #
 #    Licensed under the Apache License, Version 2.0 (the "License"); you may
 #    not use this file except in compliance with the License. You may obtain
@@ -21,30 +22,120 @@
 The built-in instance properties.
 """
 
-from nova import flags
+from nova import context
+from nova import db
 from nova import exception
+from nova import flags
+from nova import log as logging
 
 FLAGS = flags.FLAGS
-INSTANCE_TYPES = {
-    'm1.tiny': dict(memory_mb=512, vcpus=1, local_gb=0, flavorid=1),
-    'm1.small': dict(memory_mb=2048, vcpus=1, local_gb=20, flavorid=2),
-    'm1.medium': dict(memory_mb=4096, vcpus=2, local_gb=40, flavorid=3),
-    'm1.large': dict(memory_mb=8192, vcpus=4, local_gb=80, flavorid=4),
-    'm1.xlarge': dict(memory_mb=16384, vcpus=8, local_gb=160, flavorid=5)}
+LOG = logging.getLogger('nova.instance_types')
+
+
+def create(name, memory, vcpus, local_gb, flavorid, swap=0,
+           rxtx_quota=0, rxtx_cap=0):
+    """Creates instance types / flavors
+       arguments: name memory vcpus local_gb flavorid swap rxtx_quota rxtx_cap
+    """
+    for option in [memory, vcpus, local_gb, flavorid]:
+        try:
+            int(option)
+        except ValueError:
+            raise exception.InvalidInputException(
+                    _("create arguments must be positive integers"))
+    if (int(memory) <= 0) or (int(vcpus) <= 0) or (int(local_gb) < 0):
+        raise exception.InvalidInputException(
+                _("create arguments must be positive integers"))
+
+    try:
+        db.instance_type_create(
+                context.get_admin_context(),
+                dict(name=name,
+                    memory_mb=memory,
+                    vcpus=vcpus,
+                    local_gb=local_gb,
+                    flavorid=flavorid,
+                    swap=swap,
+                    rxtx_quota=rxtx_quota,
+                    rxtx_cap=rxtx_cap))
+    except exception.DBError, e:
+        LOG.exception(_('DB error: %s' % e))
+        raise exception.ApiError(_("Cannot create instance type: %s" % name))
+
+
+def destroy(name):
+    """Marks instance types / flavors as deleted
+    arguments: name"""
+    if name == None:
+        raise exception.InvalidInputException(_("No instance type specified"))
+    else:
+        try:
+            db.instance_type_destroy(context.get_admin_context(), name)
+        except exception.NotFound:
+            LOG.exception(_('Instance type %s not found for deletion' % name))
+            raise exception.ApiError(_("Unknown instance type: %s" % name))
+
+
+def purge(name):
+    """Removes instance types / flavors from database
+    arguments: name"""
+    if name == None:
+        raise exception.InvalidInputException(_("No instance type specified"))
+    else:
+        try:
+            db.instance_type_purge(context.get_admin_context(), name)
+        except exception.NotFound:
+            LOG.exception(_('Instance type %s not found for purge' % name))
+            raise exception.ApiError(_("Unknown instance type: %s" % name))
+
+
+def get_all_types(inactive=0):
+    """Retrieves non-deleted instance_types.
+    Pass true as argument if you want deleted instance types returned also."""
+    return db.instance_type_get_all(context.get_admin_context(), inactive)
+
+
+def get_all_flavors():
+    """retrieves non-deleted flavors. alias for instance_types.get_all_types().
+    Pass true as argument if you want deleted instance types returned also."""
+    return get_all_types(context.get_admin_context())
+
+
+def get_instance_type(name):
+    """Retrieves single instance type by name"""
+    if name is None:
+        return FLAGS.default_instance_type
+    try:
+        ctxt = context.get_admin_context()
+        inst_type = db.instance_type_get_by_name(ctxt, name)
+        return inst_type
+    except exception.DBError:
+        raise exception.ApiError(_("Unknown instance type: %s" % name))
 
 
 def get_by_type(instance_type):
-    """Build instance data structure and save it to the data store."""
+    """retrieve instance type name"""
     if instance_type is None:
         return FLAGS.default_instance_type
-    if instance_type not in INSTANCE_TYPES:
-        raise exception.ApiError(_("Unknown instance type: %s") % \
-                                 instance_type, "Invalid")
-    return instance_type
+
+    try:
+        ctxt = context.get_admin_context()
+        inst_type = db.instance_type_get_by_name(ctxt, instance_type)
+        return inst_type['name']
+    except exception.DBError, e:
+        LOG.exception(_('DB error: %s' % e))
+        raise exception.ApiError(_("Unknown instance type: %s" %\
+                                    instance_type))
 
 
 def get_by_flavor_id(flavor_id):
-    for instance_type, details in INSTANCE_TYPES.iteritems():
-        if details['flavorid'] == flavor_id:
-            return instance_type
-    return FLAGS.default_instance_type
+    """retrieve instance type's name by flavor_id"""
+    if flavor_id is None:
+        return FLAGS.default_instance_type
+    try:
+        ctxt = context.get_admin_context()
+        flavor = db.instance_type_get_by_flavor_id(ctxt, flavor_id)
+        return flavor['name']
+    except exception.DBError, e:
+        LOG.exception(_('DB error: %s' % e))
+        raise exception.ApiError(_("Unknown flavor: %s" % flavor_id))
diff --git a/nova/compute/manager.py b/nova/compute/manager.py
index b8d4b7ee9..0cab10fc3 100644
--- a/nova/compute/manager.py
+++ b/nova/compute/manager.py
@@ -36,9 +36,12 @@ terminating it.
 
 import base64
 import datetime
+import os
 import random
 import string
 import socket
+import tempfile
+import time
 import functools
 
 from nova import exception
@@ -61,6 +64,9 @@ flags.DEFINE_integer('password_length', 12,
 flags.DEFINE_string('console_host', socket.gethostname(),
                     'Console proxy host to use to connect to instances on'
                     'this host.')
+flags.DEFINE_integer('live_migration_retry_count', 30,
+                    ("Retry count needed in live_migration."
+                     " sleep 1 sec for each count"))
 
 LOG = logging.getLogger('nova.compute.manager')
 
@@ -181,7 +187,7 @@ class ComputeManager(manager.Manager):
                   context=context)
         self.db.instance_update(context,
                                 instance_id,
-                                {'host': self.host})
+                                {'host': self.host, 'launched_on': self.host})
 
         self.db.instance_set_state(context,
                                    instance_id,
@@ -370,12 +376,19 @@ class ComputeManager(manager.Manager):
         context = context.elevated()
         instance_ref = self.db.instance_get(context, instance_id)
         LOG.audit(_('instance %s: rescuing'), instance_id, context=context)
-        self.db.instance_set_state(context,
-                                   instance_id,
-                                   power_state.NOSTATE,
-                                   'rescuing')
+        self.db.instance_set_state(
+            context,
+            instance_id,
+            power_state.NOSTATE,
+            'rescuing')
         self.network_manager.setup_compute_network(context, instance_id)
-        self.driver.rescue(instance_ref)
+        self.driver.rescue(
+            instance_ref,
+            lambda result: self._update_state_callback(
+                self,
+                context,
+                instance_id,
+                result))
         self._update_state(context, instance_id)
 
     @exception.wrap_exception
@@ -385,11 +398,18 @@ class ComputeManager(manager.Manager):
         context = context.elevated()
         instance_ref = self.db.instance_get(context, instance_id)
         LOG.audit(_('instance %s: unrescuing'), instance_id, context=context)
-        self.db.instance_set_state(context,
-                                   instance_id,
-                                   power_state.NOSTATE,
-                                   'unrescuing')
-        self.driver.unrescue(instance_ref)
+        self.db.instance_set_state(
+            context,
+            instance_id,
+            power_state.NOSTATE,
+            'unrescuing')
+        self.driver.unrescue(
+            instance_ref,
+            lambda result: self._update_state_callback(
+                self,
+                context,
+                instance_id,
+                result))
         self._update_state(context, instance_id)
 
     @staticmethod
@@ -399,6 +419,110 @@ class ComputeManager(manager.Manager):
 
     @exception.wrap_exception
     @checks_instance_lock
+    def confirm_resize(self, context, instance_id, migration_id):
+        """Destroys the source instance"""
+        context = context.elevated()
+        instance_ref = self.db.instance_get(context, instance_id)
+        migration_ref = self.db.migration_get(context, migration_id)
+        self.driver.destroy(instance_ref)
+
+    @exception.wrap_exception
+    @checks_instance_lock
+    def revert_resize(self, context, instance_id, migration_id):
+        """Destroys the new instance on the destination machine,
+        reverts the model changes, and powers on the old
+        instance on the source machine"""
+        instance_ref = self.db.instance_get(context, instance_id)
+        migration_ref = self.db.migration_get(context, migration_id)
+
+        #TODO(mdietz): we may want to split these into separate methods.
+        if migration_ref['source_compute'] == FLAGS.host:
+            self.driver._start(instance_ref)
+            self.db.migration_update(context, migration_id,
+                    {'status': 'reverted'})
+        else:
+            self.driver.destroy(instance_ref)
+            topic = self.db.queue_get_for(context, FLAGS.compute_topic,
+                    instance_ref['host'])
+            rpc.cast(context, topic,
+                    {'method': 'revert_resize',
+                     'args': {
+                           'migration_id': migration_ref['id'],
+                           'instance_id': instance_id, },
+                    })
+
+    @exception.wrap_exception
+    @checks_instance_lock
+    def prep_resize(self, context, instance_id):
+        """Initiates the process of moving a running instance to another
+        host, possibly changing the RAM and disk size in the process"""
+        context = context.elevated()
+        instance_ref = self.db.instance_get(context, instance_id)
+        if instance_ref['host'] == FLAGS.host:
+            raise exception.Error(_(
+                    'Migration error: destination same as source!'))
+
+        migration_ref = self.db.migration_create(context,
+                {'instance_id': instance_id,
+                 'source_compute': instance_ref['host'],
+                 'dest_compute': FLAGS.host,
+                 'dest_host':   self.driver.get_host_ip_addr(),
+                 'status':      'pre-migrating'})
+        LOG.audit(_('instance %s: migrating to '), instance_id,
+                context=context)
+        topic = self.db.queue_get_for(context, FLAGS.compute_topic,
+                instance_ref['host'])
+        rpc.cast(context, topic,
+                {'method': 'resize_instance',
+                 'args': {
+                       'migration_id': migration_ref['id'],
+                       'instance_id': instance_id, },
+                })
+
+    @exception.wrap_exception
+    @checks_instance_lock
+    def resize_instance(self, context, instance_id, migration_id):
+        """Starts the migration of a running instance to another host"""
+        migration_ref = self.db.migration_get(context, migration_id)
+        instance_ref = self.db.instance_get(context, instance_id)
+        self.db.migration_update(context, migration_id,
+                {'status': 'migrating', })
+
+        disk_info = self.driver.migrate_disk_and_power_off(instance_ref,
+                                  migration_ref['dest_host'])
+        self.db.migration_update(context, migration_id,
+                {'status': 'post-migrating', })
+
+        #TODO(mdietz): This is where we would update the VM record
+        #after resizing
+        service = self.db.service_get_by_host_and_topic(context,
+                migration_ref['dest_compute'], FLAGS.compute_topic)
+        topic = self.db.queue_get_for(context, FLAGS.compute_topic,
+                migration_ref['dest_compute'])
+        rpc.cast(context, topic,
+                {'method': 'finish_resize',
+                 'args': {
+                       'migration_id': migration_id,
+                       'instance_id': instance_id,
+                       'disk_info': disk_info, },
+                })
+
+    @exception.wrap_exception
+    @checks_instance_lock
+    def finish_resize(self, context, instance_id, migration_id, disk_info):
+        """Completes the migration process by setting up the newly transferred
+        disk and turning on the instance on its new host machine"""
+        migration_ref = self.db.migration_get(context, migration_id)
+        instance_ref = self.db.instance_get(context,
+                migration_ref['instance_id'])
+
+        self.driver.finish_resize(instance_ref, disk_info)
+
+        self.db.migration_update(context, migration_id,
+                {'status': 'finished', })
+
+    @exception.wrap_exception
+    @checks_instance_lock
     def pause_instance(self, context, instance_id):
         """Pause an instance on this server."""
         context = context.elevated()
@@ -527,6 +651,18 @@ class ComputeManager(manager.Manager):
                                                    context=context)
         self.driver.reset_network(instance_ref)
 
+    @checks_instance_lock
+    def inject_network_info(self, context, instance_id):
+        """
+        Inject network info for the instance.
+
+        """
+        context = context.elevated()
+        instance_ref = self.db.instance_get(context, instance_id)
+        LOG.debug(_('instance %s: inject network info'), instance_id,
+                                                         context=context)
+        self.driver.inject_network_info(instance_ref)
+
     @exception.wrap_exception
     def get_console_output(self, context, instance_id):
         """Send the console output for an instance."""
@@ -593,3 +729,248 @@ class ComputeManager(manager.Manager):
         self.volume_manager.remove_compute_volume(context, volume_id)
         self.db.volume_detached(context, volume_id)
         return True
+
+    @exception.wrap_exception
+    def compare_cpu(self, context, cpu_info):
+        """Checks the host cpu is compatible to a cpu given by xml.
+
+        :param context: security context
+        :param cpu_info: json string obtained from virConnect.getCapabilities
+        :returns: See driver.compare_cpu
+
+        """
+        return self.driver.compare_cpu(cpu_info)
+
+    @exception.wrap_exception
+    def create_shared_storage_test_file(self, context):
+        """Makes tmpfile under FLAGS.instance_path.
+
+        This method enables compute nodes to recognize that they mounts
+        same shared storage. (create|check|creanup)_shared_storage_test_file()
+        is a pair.
+
+        :param context: security context
+        :returns: tmpfile name(basename)
+
+        """
+
+        dirpath = FLAGS.instances_path
+        fd, tmp_file = tempfile.mkstemp(dir=dirpath)
+        LOG.debug(_("Creating tmpfile %s to notify to other "
+                    "compute nodes that they should mount "
+                    "the same storage.") % tmp_file)
+        os.close(fd)
+        return os.path.basename(tmp_file)
+
+    @exception.wrap_exception
+    def check_shared_storage_test_file(self, context, filename):
+        """Confirms existence of the tmpfile under FLAGS.instances_path.
+
+        :param context: security context
+        :param filename: confirm existence of FLAGS.instances_path/thisfile
+
+        """
+
+        tmp_file = os.path.join(FLAGS.instances_path, filename)
+        if not os.path.exists(tmp_file):
+            raise exception.NotFound(_('%s not found') % tmp_file)
+
+    @exception.wrap_exception
+    def cleanup_shared_storage_test_file(self, context, filename):
+        """Removes existence of the tmpfile under FLAGS.instances_path.
+
+        :param context: security context
+        :param filename: remove existence of FLAGS.instances_path/thisfile
+
+        """
+
+        tmp_file = os.path.join(FLAGS.instances_path, filename)
+        os.remove(tmp_file)
+
+    @exception.wrap_exception
+    def update_available_resource(self, context):
+        """See comments update_resource_info.
+
+        :param context: security context
+        :returns: See driver.update_available_resource()
+
+        """
+
+        return self.driver.update_available_resource(context, self.host)
+
+    def pre_live_migration(self, context, instance_id):
+        """Preparations for live migration at dest host.
+
+        :param context: security context
+        :param instance_id: nova.db.sqlalchemy.models.Instance.Id
+
+        """
+
+        # Getting instance info
+        instance_ref = self.db.instance_get(context, instance_id)
+        ec2_id = instance_ref['hostname']
+
+        # Getting fixed ips
+        fixed_ip = self.db.instance_get_fixed_address(context, instance_id)
+        if not fixed_ip:
+            msg = _("%(instance_id)s(%(ec2_id)s) does not have fixed_ip.")
+            raise exception.NotFound(msg % locals())
+
+        # If any volume is mounted, prepare here.
+        if not instance_ref['volumes']:
+            LOG.info(_("%s has no volume."), ec2_id)
+        else:
+            for v in instance_ref['volumes']:
+                self.volume_manager.setup_compute_volume(context, v['id'])
+
+        # Bridge settings.
+        # Call this method prior to ensure_filtering_rules_for_instance,
+        # since bridge is not set up, ensure_filtering_rules_for instance
+        # fails.
+        #
+        # Retry operation is necessary because continuously request comes,
+        # concorrent request occurs to iptables, then it complains.
+        max_retry = FLAGS.live_migration_retry_count
+        for cnt in range(max_retry):
+            try:
+                self.network_manager.setup_compute_network(context,
+                                                           instance_id)
+                break
+            except exception.ProcessExecutionError:
+                if cnt == max_retry - 1:
+                    raise
+                else:
+                    LOG.warn(_("setup_compute_network() failed %(cnt)d."
+                               "Retry up to %(max_retry)d for %(ec2_id)s.")
+                               % locals())
+                    time.sleep(1)
+
+        # Creating filters to hypervisors and firewalls.
+        # An example is that nova-instance-instance-xxx,
+        # which is written to libvirt.xml(Check "virsh nwfilter-list")
+        # This nwfilter is necessary on the destination host.
+        # In addition, this method is creating filtering rule
+        # onto destination host.
+        self.driver.ensure_filtering_rules_for_instance(instance_ref)
+
+    def live_migration(self, context, instance_id, dest):
+        """Executing live migration.
+
+        :param context: security context
+        :param instance_id: nova.db.sqlalchemy.models.Instance.Id
+        :param dest: destination host
+
+        """
+
+        # Get instance for error handling.
+        instance_ref = self.db.instance_get(context, instance_id)
+        i_name = instance_ref.name
+
+        try:
+            # Checking volume node is working correctly when any volumes
+            # are attached to instances.
+            if instance_ref['volumes']:
+                rpc.call(context,
+                          FLAGS.volume_topic,
+                          {"method": "check_for_export",
+                           "args": {'instance_id': instance_id}})
+
+            # Asking dest host to preparing live migration.
+            rpc.call(context,
+                     self.db.queue_get_for(context, FLAGS.compute_topic, dest),
+                     {"method": "pre_live_migration",
+                      "args": {'instance_id': instance_id}})
+
+        except Exception:
+            msg = _("Pre live migration for %(i_name)s failed at %(dest)s")
+            LOG.error(msg % locals())
+            self.recover_live_migration(context, instance_ref)
+            raise
+
+        # Executing live migration
+        # live_migration might raises exceptions, but
+        # nothing must be recovered in this version.
+        self.driver.live_migration(context, instance_ref, dest,
+                                   self.post_live_migration,
+                                   self.recover_live_migration)
+
+    def post_live_migration(self, ctxt, instance_ref, dest):
+        """Post operations for live migration.
+
+        This method is called from live_migration
+        and mainly updating database record.
+
+        :param ctxt: security context
+        :param instance_id: nova.db.sqlalchemy.models.Instance.Id
+        :param dest: destination host
+
+        """
+
+        LOG.info(_('post_live_migration() is started..'))
+        instance_id = instance_ref['id']
+
+        # Detaching volumes.
+        try:
+            for vol in self.db.volume_get_all_by_instance(ctxt, instance_id):
+                self.volume_manager.remove_compute_volume(ctxt, vol['id'])
+        except exception.NotFound:
+            pass
+
+        # Releasing vlan.
+        # (not necessary in current implementation?)
+
+        # Releasing security group ingress rule.
+        self.driver.unfilter_instance(instance_ref)
+
+        # Database updating.
+        i_name = instance_ref.name
+        try:
+            # Not return if floating_ip is not found, otherwise,
+            # instance never be accessible..
+            floating_ip = self.db.instance_get_floating_address(ctxt,
+                                                         instance_id)
+            if not floating_ip:
+                LOG.info(_('No floating_ip is found for %s.'), i_name)
+            else:
+                floating_ip_ref = self.db.floating_ip_get_by_address(ctxt,
+                                                              floating_ip)
+                self.db.floating_ip_update(ctxt,
+                                           floating_ip_ref['address'],
+                                           {'host': dest})
+        except exception.NotFound:
+            LOG.info(_('No floating_ip is found for %s.'), i_name)
+        except:
+            LOG.error(_("Live migration: Unexpected error:"
+                        "%s cannot inherit floating ip..") % i_name)
+
+        # Restore instance/volume state
+        self.recover_live_migration(ctxt, instance_ref, dest)
+
+        LOG.info(_('Migrating %(i_name)s to %(dest)s finished successfully.')
+                 % locals())
+        LOG.info(_("You may see the error \"libvirt: QEMU error: "
+                   "Domain not found: no domain with matching name.\" "
+                   "This error can be safely ignored."))
+
+    def recover_live_migration(self, ctxt, instance_ref, host=None):
+        """Recovers Instance/volume state from migrating -> running.
+
+        :param ctxt: security context
+        :param instance_id: nova.db.sqlalchemy.models.Instance.Id
+        :param host:
+            DB column value is updated by this hostname.
+            if none, the host instance currently running is selected.
+
+        """
+
+        if not host:
+            host = instance_ref['host']
+
+        self.db.instance_update(ctxt,
+                                instance_ref['id'],
+                                {'state_description': 'running',
+                                 'state': power_state.RUNNING,
+                                 'host': host})
+
+        for volume in instance_ref['volumes']:
+            self.db.volume_update(ctxt, volume['id'], {'status': 'in-use'})
diff --git a/nova/console/manager.py b/nova/console/manager.py
index 5697e7cb1..57c75cf4f 100644
--- a/nova/console/manager.py
+++ b/nova/console/manager.py
@@ -20,11 +20,11 @@ Console Proxy Service
 """
 
 import functools
-import logging
 import socket
 
 from nova import exception
 from nova import flags
+from nova import log as logging
 from nova import manager
 from nova import rpc
 from nova import utils
diff --git a/nova/console/xvp.py b/nova/console/xvp.py
index ee66dac46..68d8c8565 100644
--- a/nova/console/xvp.py
+++ b/nova/console/xvp.py
@@ -20,7 +20,6 @@ XVP (Xenserver VNC Proxy) driver.
 """
 
 import fcntl
-import logging
 import os
 import signal
 import subprocess
@@ -31,6 +30,7 @@ from nova import context
 from nova import db
 from nova import exception
 from nova import flags
+from nova import log as logging
 from nova import utils
 
 flags.DEFINE_string('console_xvp_conf_template',
@@ -133,10 +133,10 @@ class XVPConsoleProxy(object):
             return
         logging.debug(_("Starting xvp"))
         try:
-            utils.execute('xvp -p %s -c %s -l %s' %
-                          (FLAGS.console_xvp_pid,
-                           FLAGS.console_xvp_conf,
-                           FLAGS.console_xvp_log))
+            utils.execute('xvp',
+                          '-p', FLAGS.console_xvp_pid,
+                          '-c', FLAGS.console_xvp_conf,
+                          '-l', FLAGS.console_xvp_log)
         except exception.ProcessExecutionError, err:
             logging.error(_("Error starting xvp: %s") % err)
 
@@ -190,5 +190,5 @@ class XVPConsoleProxy(object):
             flag = '-x'
         #xvp will blow up on passwords that are too long (mdragon)
         password = password[:maxlen]
-        out, err = utils.execute('xvp %s' % flag, process_input=password)
+        out, err = utils.execute('xvp', flag, process_input=password)
         return out.strip()
diff --git a/nova/crypto.py b/nova/crypto.py
index a34b940f5..2a8d4abca 100644
--- a/nova/crypto.py
+++ b/nova/crypto.py
@@ -105,8 +105,10 @@ def generate_key_pair(bits=1024):
 
     tmpdir = tempfile.mkdtemp()
     keyfile = os.path.join(tmpdir, 'temp')
-    utils.execute('ssh-keygen -q -b %d -N "" -f %s' % (bits, keyfile))
-    (out, err) = utils.execute('ssh-keygen -q -l -f %s.pub' % (keyfile))
+    utils.execute('ssh-keygen', '-q', '-b', bits, '-N', '',
+                  '-f', keyfile)
+    (out, err) = utils.execute('ssh-keygen', '-q', '-l', '-f',
+                               '%s.pub' % (keyfile))
     fingerprint = out.split(' ')[1]
     private_key = open(keyfile).read()
     public_key = open(keyfile + '.pub').read()
@@ -118,7 +120,8 @@ def generate_key_pair(bits=1024):
     # bio = M2Crypto.BIO.MemoryBuffer()
     # key.save_pub_key_bio(bio)
     # public_key = bio.read()
-    # public_key, err = execute('ssh-keygen -y -f /dev/stdin', private_key)
+    # public_key, err = execute('ssh-keygen', '-y', '-f',
+    #                           '/dev/stdin', private_key)
 
     return (private_key, public_key, fingerprint)
 
@@ -143,9 +146,10 @@ def revoke_cert(project_id, file_name):
     start = os.getcwd()
     os.chdir(ca_folder(project_id))
     # NOTE(vish): potential race condition here
-    utils.execute("openssl ca -config ./openssl.cnf -revoke '%s'" % file_name)
-    utils.execute("openssl ca -gencrl -config ./openssl.cnf -out '%s'" %
-                  FLAGS.crl_file)
+    utils.execute('openssl', 'ca', '-config', './openssl.cnf', '-revoke',
+                  file_name)
+    utils.execute('openssl', 'ca', '-gencrl', '-config', './openssl.cnf',
+                  '-out', FLAGS.crl_file)
     os.chdir(start)
 
 
@@ -193,9 +197,9 @@ def generate_x509_cert(user_id, project_id, bits=1024):
     tmpdir = tempfile.mkdtemp()
     keyfile = os.path.abspath(os.path.join(tmpdir, 'temp.key'))
     csrfile = os.path.join(tmpdir, 'temp.csr')
-    utils.execute("openssl genrsa -out %s %s" % (keyfile, bits))
-    utils.execute("openssl req -new -key %s -out %s -batch -subj %s" %
-                  (keyfile, csrfile, subject))
+    utils.execute('openssl', 'genrsa', '-out', keyfile, str(bits))
+    utils.execute('openssl', 'req', '-new', '-key', keyfile, '-out', csrfile,
+                  '-batch', '-subj', subject)
     private_key = open(keyfile).read()
     csr = open(csrfile).read()
     shutil.rmtree(tmpdir)
@@ -212,8 +216,8 @@ def _ensure_project_folder(project_id):
     if not os.path.exists(ca_path(project_id)):
         start = os.getcwd()
         os.chdir(ca_folder())
-        utils.execute("sh geninter.sh %s %s" %
-                      (project_id, _project_cert_subject(project_id)))
+        utils.execute('sh', 'geninter.sh', project_id,
+                      _project_cert_subject(project_id))
         os.chdir(start)
 
 
@@ -228,8 +232,8 @@ def generate_vpn_files(project_id):
     start = os.getcwd()
     os.chdir(ca_folder())
     # TODO(vish): the shell scripts could all be done in python
-    utils.execute("sh genvpn.sh %s %s" %
-                  (project_id, _vpn_cert_subject(project_id)))
+    utils.execute('sh', 'genvpn.sh',
+                  project_id, _vpn_cert_subject(project_id))
     with open(csr_fn, "r") as csrfile:
         csr_text = csrfile.read()
     (serial, signed_csr) = sign_csr(csr_text, project_id)
@@ -259,9 +263,10 @@ def _sign_csr(csr_text, ca_folder):
     start = os.getcwd()
     # Change working dir to CA
     os.chdir(ca_folder)
-    utils.execute("openssl ca -batch -out %s -config "
-                  "./openssl.cnf -infiles %s" % (outbound, inbound))
-    out, _err = utils.execute("openssl x509 -in %s -serial -noout" % outbound)
+    utils.execute('openssl', 'ca', '-batch', '-out', outbound, '-config',
+                  './openssl.cnf', '-infiles', inbound)
+    out, _err = utils.execute('openssl', 'x509', '-in', outbound,
+                              '-serial', '-noout')
     serial = out.rpartition("=")[2]
     os.chdir(start)
     with open(outbound, "r") as crtfile:
diff --git a/nova/db/api.py b/nova/db/api.py
index 6053c0352..3cb0e5811 100644
--- a/nova/db/api.py
+++ b/nova/db/api.py
@@ -80,13 +80,18 @@ def service_destroy(context, instance_id):
 
 
 def service_get(context, service_id):
-    """Get an service or raise if it does not exist."""
+    """Get a service or raise if it does not exist."""
     return IMPL.service_get(context, service_id)
 
 
+def service_get_by_host_and_topic(context, host, topic):
+    """Get a service by host it's on and topic it listens to"""
+    return IMPL.service_get_by_host_and_topic(context, host, topic)
+
+
 def service_get_all(context, disabled=False):
-    """Get all service."""
-    return IMPL.service_get_all(context, None, disabled)
+    """Get all services."""
+    return IMPL.service_get_all(context, disabled)
 
 
 def service_get_all_by_topic(context, topic):
@@ -99,6 +104,11 @@ def service_get_all_by_host(context, host):
     return IMPL.service_get_all_by_host(context, host)
 
 
+def service_get_all_compute_by_host(context, host):
+    """Get all compute services for a given host."""
+    return IMPL.service_get_all_compute_by_host(context, host)
+
+
 def service_get_all_compute_sorted(context):
     """Get all compute services sorted by instance count.
 
@@ -148,6 +158,29 @@ def service_update(context, service_id, values):
 ###################
 
 
+def compute_node_get(context, compute_id, session=None):
+    """Get an computeNode or raise if it does not exist."""
+    return IMPL.compute_node_get(context, compute_id)
+
+
+def compute_node_create(context, values):
+    """Create a computeNode from the values dictionary."""
+    return IMPL.compute_node_create(context, values)
+
+
+def compute_node_update(context, compute_id, values):
+    """Set the given properties on an computeNode and update it.
+
+    Raises NotFound if computeNode does not exist.
+
+    """
+
+    return IMPL.compute_node_update(context, compute_id, values)
+
+
+###################
+
+
 def certificate_create(context, values):
     """Create a certificate from the values dictionary."""
     return IMPL.certificate_create(context, values)
@@ -252,6 +285,33 @@ def floating_ip_get_by_address(context, address):
     return IMPL.floating_ip_get_by_address(context, address)
 
 
+def floating_ip_update(context, address, values):
+    """Update a floating ip by address or raise if it doesn't exist."""
+    return IMPL.floating_ip_update(context, address, values)
+
+
+####################
+
+def migration_update(context, id, values):
+    """Update a migration instance"""
+    return IMPL.migration_update(context, id, values)
+
+
+def migration_create(context, values):
+    """Create a migration record"""
+    return IMPL.migration_create(context, values)
+
+
+def migration_get(context, migration_id):
+    """Finds a migration by the id"""
+    return IMPL.migration_get(context, migration_id)
+
+
+def migration_get_by_instance_and_status(context, instance_id, status):
+    """Finds a migration by the instance id its migrating"""
+    return IMPL.migration_get_by_instance_and_status(context, instance_id,
+            status)
+
 ####################
 
 
@@ -419,6 +479,27 @@ def instance_add_security_group(context, instance_id, security_group_id):
                                             security_group_id)
 
 
+def instance_get_vcpu_sum_by_host_and_project(context, hostname, proj_id):
+    """Get instances.vcpus by host and project."""
+    return IMPL.instance_get_vcpu_sum_by_host_and_project(context,
+                                                          hostname,
+                                                          proj_id)
+
+
+def instance_get_memory_sum_by_host_and_project(context, hostname, proj_id):
+    """Get amount of memory by host and project."""
+    return IMPL.instance_get_memory_sum_by_host_and_project(context,
+                                                            hostname,
+                                                            proj_id)
+
+
+def instance_get_disk_sum_by_host_and_project(context, hostname, proj_id):
+    """Get total amount of disk by host and project."""
+    return IMPL.instance_get_disk_sum_by_host_and_project(context,
+                                                          hostname,
+                                                          proj_id)
+
+
 def instance_action_create(context, values):
     """Create an instance action from the values dictionary."""
     return IMPL.instance_action_create(context, values)
@@ -495,6 +576,13 @@ def network_create_safe(context, values):
     return IMPL.network_create_safe(context, values)
 
 
+def network_delete_safe(context, network_id):
+    """Delete network with key network_id.
+    This method assumes that the network is not associated with any project
+    """
+    return IMPL.network_delete_safe(context, network_id)
+
+
 def network_create_fixed_ips(context, network_id, num_vpn_clients):
     """Create the ips for the network, reserving sepecified ips."""
     return IMPL.network_create_fixed_ips(context, network_id, num_vpn_clients)
@@ -531,6 +619,11 @@ def network_get_by_bridge(context, bridge):
     return IMPL.network_get_by_bridge(context, bridge)
 
 
+def network_get_by_cidr(context, cidr):
+    """Get a network by cidr or raise if it does not exist"""
+    return IMPL.network_get_by_cidr(context, cidr)
+
+
 def network_get_by_instance(context, instance_id):
     """Get a network by instance id or raise if it does not exist."""
     return IMPL.network_get_by_instance(context, instance_id)
@@ -635,19 +728,24 @@ def iscsi_target_create_safe(context, values):
 ###############
 
 
-def auth_destroy_token(context, token):
+def auth_token_destroy(context, token_id):
     """Destroy an auth token."""
-    return IMPL.auth_destroy_token(context, token)
+    return IMPL.auth_token_destroy(context, token_id)
 
 
-def auth_get_token(context, token_hash):
+def auth_token_get(context, token_hash):
     """Retrieves a token given the hash representing it."""
-    return IMPL.auth_get_token(context, token_hash)
+    return IMPL.auth_token_get(context, token_hash)
+
+
+def auth_token_update(context, token_hash, values):
+    """Updates a token given the hash representing it."""
+    return IMPL.auth_token_update(context, token_hash, values)
 
 
-def auth_create_token(context, token):
+def auth_token_create(context, token):
     """Creates a new token."""
-    return IMPL.auth_create_token(context, token)
+    return IMPL.auth_token_create(context, token)
 
 
 ###################
@@ -726,6 +824,11 @@ def volume_get_all_by_host(context, host):
     return IMPL.volume_get_all_by_host(context, host)
 
 
+def volume_get_all_by_instance(context, instance_id):
+    """Get all volumes belonging to a instance."""
+    return IMPL.volume_get_all_by_instance(context, instance_id)
+
+
 def volume_get_all_by_project(context, project_id):
     """Get all volumes belonging to a project."""
     return IMPL.volume_get_all_by_project(context, project_id)
@@ -1007,6 +1110,41 @@ def console_get(context, console_id, instance_id=None):
     return IMPL.console_get(context, console_id, instance_id)
 
 
+    ##################
+
+
+def instance_type_create(context, values):
+    """Create a new instance type"""
+    return IMPL.instance_type_create(context, values)
+
+
+def instance_type_get_all(context, inactive=0):
+    """Get all instance types"""
+    return IMPL.instance_type_get_all(context, inactive)
+
+
+def instance_type_get_by_name(context, name):
+    """Get instance type by name"""
+    return IMPL.instance_type_get_by_name(context, name)
+
+
+def instance_type_get_by_flavor_id(context, id):
+    """Get instance type by name"""
+    return IMPL.instance_type_get_by_flavor_id(context, id)
+
+
+def instance_type_destroy(context, name):
+    """Delete a instance type"""
+    return IMPL.instance_type_destroy(context, name)
+
+
+def instance_type_purge(context, name):
+    """Purges (removes) an instance type from DB
+       Use instance_type_destroy for most cases
+    """
+    return IMPL.instance_type_purge(context, name)
+
+
 ####################
 
 
diff --git a/nova/db/sqlalchemy/api.py b/nova/db/sqlalchemy/api.py
index 828d24c78..44540617f 100644
--- a/nova/db/sqlalchemy/api.py
+++ b/nova/db/sqlalchemy/api.py
@@ -34,6 +34,7 @@ from sqlalchemy.orm import joinedload
 from sqlalchemy.orm import joinedload_all
 from sqlalchemy.sql import exists
 from sqlalchemy.sql import func
+from sqlalchemy.sql.expression import literal_column
 
 FLAGS = flags.FLAGS
 
@@ -118,6 +119,11 @@ def service_destroy(context, service_id):
         service_ref = service_get(context, service_id, session=session)
         service_ref.delete(session=session)
 
+        if service_ref.topic == 'compute' and \
+            len(service_ref.compute_node) != 0:
+            for c in service_ref.compute_node:
+                c.delete(session=session)
+
 
 @require_admin_context
 def service_get(context, service_id, session=None):
@@ -125,6 +131,7 @@ def service_get(context, service_id, session=None):
         session = get_session()
 
     result = session.query(models.Service).\
+                     options(joinedload('compute_node')).\
                      filter_by(id=service_id).\
                      filter_by(deleted=can_read_deleted(context)).\
                      first()
@@ -136,15 +143,12 @@ def service_get(context, service_id, session=None):
 
 
 @require_admin_context
-def service_get_all(context, session=None, disabled=False):
-    if not session:
-        session = get_session()
-
-    result = session.query(models.Service).\
+def service_get_all(context, disabled=False):
+    session = get_session()
+    return session.query(models.Service).\
                    filter_by(deleted=can_read_deleted(context)).\
                    filter_by(disabled=disabled).\
                    all()
-    return result
 
 
 @require_admin_context
@@ -158,6 +162,17 @@ def service_get_all_by_topic(context, topic):
 
 
 @require_admin_context
+def service_get_by_host_and_topic(context, host, topic):
+    session = get_session()
+    return session.query(models.Service).\
+                   filter_by(deleted=False).\
+                   filter_by(disabled=False).\
+                   filter_by(host=host).\
+                   filter_by(topic=topic).\
+                   first()
+
+
+@require_admin_context
 def service_get_all_by_host(context, host):
     session = get_session()
     return session.query(models.Service).\
@@ -167,6 +182,24 @@ def service_get_all_by_host(context, host):
 
 
 @require_admin_context
+def service_get_all_compute_by_host(context, host):
+    topic = 'compute'
+    session = get_session()
+    result = session.query(models.Service).\
+                  options(joinedload('compute_node')).\
+                  filter_by(deleted=False).\
+                  filter_by(host=host).\
+                  filter_by(topic=topic).\
+                  all()
+
+    if not result:
+        raise exception.NotFound(_("%s does not exist or is not "
+                                   "a compute node.") % host)
+
+    return result
+
+
+@require_admin_context
 def _service_get_all_topic_subquery(context, session, topic, subq, label):
     sort_value = getattr(subq.c, label)
     return session.query(models.Service, func.coalesce(sort_value, 0)).\
@@ -277,6 +310,42 @@ def service_update(context, service_id, values):
 
 
 @require_admin_context
+def compute_node_get(context, compute_id, session=None):
+    if not session:
+        session = get_session()
+
+    result = session.query(models.ComputeNode).\
+                     filter_by(id=compute_id).\
+                     filter_by(deleted=can_read_deleted(context)).\
+                     first()
+
+    if not result:
+        raise exception.NotFound(_('No computeNode for id %s') % compute_id)
+
+    return result
+
+
+@require_admin_context
+def compute_node_create(context, values):
+    compute_node_ref = models.ComputeNode()
+    compute_node_ref.update(values)
+    compute_node_ref.save()
+    return compute_node_ref
+
+
+@require_admin_context
+def compute_node_update(context, compute_id, values):
+    session = get_session()
+    with session.begin():
+        compute_ref = compute_node_get(context, compute_id, session=session)
+        compute_ref.update(values)
+        compute_ref.save(session=session)
+
+
+###################
+
+
+@require_admin_context
 def certificate_get(context, certificate_id, session=None):
     if not session:
         session = get_session()
@@ -497,6 +566,16 @@ def floating_ip_get_by_address(context, address, session=None):
     return result
 
 
+@require_context
+def floating_ip_update(context, address, values):
+    session = get_session()
+    with session.begin():
+        floating_ip_ref = floating_ip_get_by_address(context, address, session)
+        for (key, value) in values.iteritems():
+            floating_ip_ref[key] = value
+        floating_ip_ref.save(session=session)
+
+
 ###################
 
 
@@ -569,18 +648,17 @@ def fixed_ip_disassociate(context, address):
 @require_admin_context
 def fixed_ip_disassociate_all_by_timeout(_context, host, time):
     session = get_session()
-    # NOTE(vish): The nested select is because sqlite doesn't support
-    #             JOINs in UPDATEs.
-    result = session.execute('UPDATE fixed_ips SET instance_id = NULL, '
-                                                  'leased = 0 '
-                             'WHERE network_id IN (SELECT id FROM networks '
-                                                  'WHERE host = :host) '
-                             'AND updated_at < :time '
-                             'AND instance_id IS NOT NULL '
-                             'AND allocated = 0',
-                    {'host': host,
-                     'time': time})
-    return result.rowcount
+    inner_q = session.query(models.Network.id).\
+                      filter_by(host=host).\
+                      subquery()
+    result = session.query(models.FixedIp).\
+                     filter(models.FixedIp.network_id.in_(inner_q)).\
+                     filter(models.FixedIp.updated_at < time).\
+                     filter(models.FixedIp.instance_id != None).\
+                     filter_by(allocated=0).\
+                     update({'instance_id': None,
+                             'leased': 0})
+    return result
 
 
 @require_admin_context
@@ -709,14 +787,16 @@ def instance_data_get_for_project(context, project_id):
 def instance_destroy(context, instance_id):
     session = get_session()
     with session.begin():
-        session.execute('update instances set deleted=1,'
-                        'deleted_at=:at where id=:id',
-                        {'id': instance_id,
-                         'at': datetime.datetime.utcnow()})
-        session.execute('update security_group_instance_association '
-                        'set deleted=1,deleted_at=:at where instance_id=:id',
-                        {'id': instance_id,
-                         'at': datetime.datetime.utcnow()})
+        session.query(models.Instance).\
+                filter_by(id=instance_id).\
+                update({'deleted': 1,
+                        'deleted_at': datetime.datetime.utcnow(),
+                        'updated_at': literal_column('updated_at')})
+        session.query(models.SecurityGroupInstanceAssociation).\
+                filter_by(instance_id=instance_id).\
+                update({'deleted': 1,
+                        'deleted_at': datetime.datetime.utcnow(),
+                        'updated_at': literal_column('updated_at')})
 
 
 @require_context
@@ -731,6 +811,7 @@ def instance_get(context, instance_id, session=None):
                          options(joinedload_all('security_groups.rules')).\
                          options(joinedload('volumes')).\
                          options(joinedload_all('fixed_ip.network')).\
+                         options(joinedload('metadata')).\
                          filter_by(id=instance_id).\
                          filter_by(deleted=can_read_deleted(context)).\
                          first()
@@ -739,6 +820,7 @@ def instance_get(context, instance_id, session=None):
                          options(joinedload_all('fixed_ip.floating_ips')).\
                          options(joinedload_all('security_groups.rules')).\
                          options(joinedload('volumes')).\
+                         options(joinedload('metadata')).\
                          filter_by(project_id=context.project_id).\
                          filter_by(id=instance_id).\
                          filter_by(deleted=False).\
@@ -911,6 +993,45 @@ def instance_add_security_group(context, instance_id, security_group_id):
 
 
 @require_context
+def instance_get_vcpu_sum_by_host_and_project(context, hostname, proj_id):
+    session = get_session()
+    result = session.query(models.Instance).\
+                      filter_by(host=hostname).\
+                      filter_by(project_id=proj_id).\
+                      filter_by(deleted=False).\
+                      value(func.sum(models.Instance.vcpus))
+    if not result:
+        return 0
+    return result
+
+
+@require_context
+def instance_get_memory_sum_by_host_and_project(context, hostname, proj_id):
+    session = get_session()
+    result = session.query(models.Instance).\
+                      filter_by(host=hostname).\
+                      filter_by(project_id=proj_id).\
+                      filter_by(deleted=False).\
+                      value(func.sum(models.Instance.memory_mb))
+    if not result:
+        return 0
+    return result
+
+
+@require_context
+def instance_get_disk_sum_by_host_and_project(context, hostname, proj_id):
+    session = get_session()
+    result = session.query(models.Instance).\
+                      filter_by(host=hostname).\
+                      filter_by(project_id=proj_id).\
+                      filter_by(deleted=False).\
+                      value(func.sum(models.Instance.local_gb))
+    if not result:
+        return 0
+    return result
+
+
+@require_context
 def instance_action_create(context, values):
     """Create an instance action from the values dictionary."""
     action_ref = models.InstanceActions()
@@ -956,9 +1077,11 @@ def key_pair_destroy_all_by_user(context, user_id):
     authorize_user_context(context, user_id)
     session = get_session()
     with session.begin():
-        # TODO(vish): do we have to use sql here?
-        session.execute('update key_pairs set deleted=1 where user_id=:id',
-                        {'id': user_id})
+        session.query(models.KeyPair).\
+                filter_by(user_id=user_id).\
+                update({'deleted': 1,
+                        'deleted_at': datetime.datetime.utcnow(),
+                        'updated_at': literal_column('updated_at')})
 
 
 @require_context
@@ -1061,14 +1184,26 @@ def network_create_safe(context, values):
 
 
 @require_admin_context
+def network_delete_safe(context, network_id):
+    session = get_session()
+    with session.begin():
+        network_ref = network_get(context, network_id=network_id, \
+                                  session=session)
+        session.delete(network_ref)
+
+
+@require_admin_context
 def network_disassociate(context, network_id):
-    network_update(context, network_id, {'project_id': None})
+    network_update(context, network_id, {'project_id': None,
+                                         'host': None})
 
 
 @require_admin_context
 def network_disassociate_all(context):
     session = get_session()
-    session.execute('update networks set project_id=NULL')
+    session.query(models.Network).\
+            update({'project_id': None,
+                    'updated_at': literal_column('updated_at')})
 
 
 @require_context
@@ -1133,6 +1268,18 @@ def network_get_by_bridge(context, bridge):
 
 
 @require_admin_context
+def network_get_by_cidr(context, cidr):
+    session = get_session()
+    result = session.query(models.Network).\
+                filter_by(cidr=cidr).first()
+
+    if not result:
+        raise exception.NotFound(_('Network with cidr %s does not exist') %
+                                  cidr)
+    return result
+
+
+@require_admin_context
 def network_get_by_instance(_context, instance_id):
     session = get_session()
     rv = session.query(models.Network).\
@@ -1278,16 +1425,20 @@ def iscsi_target_create_safe(context, values):
 
 
 @require_admin_context
-def auth_destroy_token(_context, token):
+def auth_token_destroy(context, token_id):
     session = get_session()
-    session.delete(token)
+    with session.begin():
+        token_ref = auth_token_get(context, token_id, session=session)
+        token_ref.delete(session=session)
 
 
 @require_admin_context
-def auth_get_token(_context, token_hash):
-    session = get_session()
+def auth_token_get(context, token_hash, session=None):
+    if session is None:
+        session = get_session()
     tk = session.query(models.AuthToken).\
                   filter_by(token_hash=token_hash).\
+                  filter_by(deleted=can_read_deleted(context)).\
                   first()
     if not tk:
         raise exception.NotFound(_('Token %s does not exist') % token_hash)
@@ -1295,7 +1446,16 @@ def auth_get_token(_context, token_hash):
 
 
 @require_admin_context
-def auth_create_token(_context, token):
+def auth_token_update(context, token_hash, values):
+    session = get_session()
+    with session.begin():
+        token_ref = auth_token_get(context, token_hash, session=session)
+        token_ref.update(values)
+        token_ref.save(session=session)
+
+
+@require_admin_context
+def auth_token_create(_context, token):
     tk = models.AuthToken()
     tk.update(token)
     tk.save()
@@ -1425,15 +1585,17 @@ def volume_data_get_for_project(context, project_id):
 def volume_destroy(context, volume_id):
     session = get_session()
     with session.begin():
-        # TODO(vish): do we have to use sql here?
-        session.execute('update volumes set deleted=1 where id=:id',
-                        {'id': volume_id})
-        session.execute('update export_devices set volume_id=NULL '
-                        'where volume_id=:id',
-                        {'id': volume_id})
-        session.execute('update iscsi_targets set volume_id=NULL '
-                        'where volume_id=:id',
-                        {'id': volume_id})
+        session.query(models.Volume).\
+                filter_by(id=volume_id).\
+                update({'deleted': 1,
+                        'deleted_at': datetime.datetime.utcnow(),
+                        'updated_at': literal_column('updated_at')})
+        session.query(models.ExportDevice).\
+                filter_by(volume_id=volume_id).\
+                update({'volume_id': None})
+        session.query(models.IscsiTarget).\
+                filter_by(volume_id=volume_id).\
+                update({'volume_id': None})
 
 
 @require_admin_context
@@ -1493,6 +1655,18 @@ def volume_get_all_by_host(context, host):
                    all()
 
 
+@require_admin_context
+def volume_get_all_by_instance(context, instance_id):
+    session = get_session()
+    result = session.query(models.Volume).\
+                     filter_by(instance_id=instance_id).\
+                     filter_by(deleted=False).\
+                     all()
+    if not result:
+        raise exception.NotFound(_('No volume for instance %s') % instance_id)
+    return result
+
+
 @require_context
 def volume_get_all_by_project(context, project_id):
     authorize_project_context(context, project_id)
@@ -1653,17 +1827,21 @@ def security_group_create(context, values):
 def security_group_destroy(context, security_group_id):
     session = get_session()
     with session.begin():
-        # TODO(vish): do we have to use sql here?
-        session.execute('update security_groups set deleted=1 where id=:id',
-                        {'id': security_group_id})
-        session.execute('update security_group_instance_association '
-                        'set deleted=1,deleted_at=:at '
-                        'where security_group_id=:id',
-                        {'id': security_group_id,
-                         'at': datetime.datetime.utcnow()})
-        session.execute('update security_group_rules set deleted=1 '
-                        'where group_id=:id',
-                        {'id': security_group_id})
+        session.query(models.SecurityGroup).\
+                filter_by(id=security_group_id).\
+                update({'deleted': 1,
+                        'deleted_at': datetime.datetime.utcnow(),
+                        'updated_at': literal_column('updated_at')})
+        session.query(models.SecurityGroupInstanceAssociation).\
+                filter_by(security_group_id=security_group_id).\
+                update({'deleted': 1,
+                        'deleted_at': datetime.datetime.utcnow(),
+                        'updated_at': literal_column('updated_at')})
+        session.query(models.SecurityGroupIngressRule).\
+                filter_by(group_id=security_group_id).\
+                update({'deleted': 1,
+                        'deleted_at': datetime.datetime.utcnow(),
+                        'updated_at': literal_column('updated_at')})
 
 
 @require_context
@@ -1671,9 +1849,14 @@ def security_group_destroy_all(context, session=None):
     if not session:
         session = get_session()
     with session.begin():
-        # TODO(vish): do we have to use sql here?
-        session.execute('update security_groups set deleted=1')
-        session.execute('update security_group_rules set deleted=1')
+        session.query(models.SecurityGroup).\
+                update({'deleted': 1,
+                        'deleted_at': datetime.datetime.utcnow(),
+                        'updated_at': literal_column('updated_at')})
+        session.query(models.SecurityGroupIngressRule).\
+                update({'deleted': 1,
+                        'deleted_at': datetime.datetime.utcnow(),
+                        'updated_at': literal_column('updated_at')})
 
 
 ###################
@@ -1802,12 +1985,15 @@ def user_create(_context, values):
 def user_delete(context, id):
     session = get_session()
     with session.begin():
-        session.execute('delete from user_project_association '
-                        'where user_id=:id', {'id': id})
-        session.execute('delete from user_role_association '
-                        'where user_id=:id', {'id': id})
-        session.execute('delete from user_project_role_association '
-                        'where user_id=:id', {'id': id})
+        session.query(models.UserProjectAssociation).\
+                filter_by(user_id=id).\
+                delete()
+        session.query(models.UserRoleAssociation).\
+                filter_by(user_id=id).\
+                delete()
+        session.query(models.UserProjectRoleAssociation).\
+                filter_by(user_id=id).\
+                delete()
         user_ref = user_get(context, id, session=session)
         session.delete(user_ref)
 
@@ -1864,8 +2050,11 @@ def project_get_by_user(context, user_id):
     session = get_session()
     user = session.query(models.User).\
                    filter_by(deleted=can_read_deleted(context)).\
+                   filter_by(id=user_id).\
                    options(joinedload_all('projects')).\
                    first()
+    if not user:
+        raise exception.NotFound(_('Invalid user_id %s') % user_id)
     return user.projects
 
 
@@ -1898,10 +2087,12 @@ def project_update(context, project_id, values):
 def project_delete(context, id):
     session = get_session()
     with session.begin():
-        session.execute('delete from user_project_association '
-                        'where project_id=:id', {'id': id})
-        session.execute('delete from user_project_role_association '
-                        'where project_id=:id', {'id': id})
+        session.query(models.UserProjectAssociation).\
+                filter_by(project_id=id).\
+                delete()
+        session.query(models.UserProjectRoleAssociation).\
+                filter_by(project_id=id).\
+                delete()
         project_ref = project_get(context, id, session=session)
         session.delete(project_ref)
 
@@ -1926,11 +2117,11 @@ def user_get_roles_for_project(context, user_id, project_id):
 def user_remove_project_role(context, user_id, project_id, role):
     session = get_session()
     with session.begin():
-        session.execute('delete from user_project_role_association where '
-                        'user_id=:user_id and project_id=:project_id and '
-                        'role=:role', {'user_id': user_id,
-                                       'project_id': project_id,
-                                       'role': role})
+        session.query(models.UserProjectRoleAssociation).\
+                filter_by(user_id=user_id).\
+                filter_by(project_id=project_id).\
+                filter_by(role=role).\
+                delete()
 
 
 def user_remove_role(context, user_id, role):
@@ -1975,6 +2166,51 @@ def host_get_networks(context, host):
                        all()
 
 
+###################
+
+
+@require_admin_context
+def migration_create(context, values):
+    migration = models.Migration()
+    migration.update(values)
+    migration.save()
+    return migration
+
+
+@require_admin_context
+def migration_update(context, id, values):
+    session = get_session()
+    with session.begin():
+        migration = migration_get(context, id, session=session)
+        migration.update(values)
+        migration.save(session=session)
+        return migration
+
+
+@require_admin_context
+def migration_get(context, id, session=None):
+    if not session:
+        session = get_session()
+    result = session.query(models.Migration).\
+                     filter_by(id=id).first()
+    if not result:
+        raise exception.NotFound(_("No migration found with id %s")
+                % migration_id)
+    return result
+
+
+@require_admin_context
+def migration_get_by_instance_and_status(context, instance_id, status):
+    session = get_session()
+    result = session.query(models.Migration).\
+                     filter_by(instance_id=instance_id).\
+                     filter_by(status=status).first()
+    if not result:
+        raise exception.NotFound(_("No migration found with instance id %s")
+                % migration_id)
+    return result
+
+
 ##################
 
 
@@ -2036,8 +2272,9 @@ def console_delete(context, console_id):
     session = get_session()
     with session.begin():
         # consoles are meant to be transient. (mdragon)
-        session.execute('delete from consoles '
-                        'where id=:id', {'id': console_id})
+        session.query(models.Console).\
+                filter_by(id=console_id).\
+                delete()
 
 
 def console_get_by_pool_instance(context, pool_id, instance_id):
@@ -2076,6 +2313,98 @@ def console_get(context, console_id, instance_id=None):
     return result
 
 
+    ##################
+
+
+@require_admin_context
+def instance_type_create(_context, values):
+    try:
+        instance_type_ref = models.InstanceTypes()
+        instance_type_ref.update(values)
+        instance_type_ref.save()
+    except:
+        raise exception.DBError
+    return instance_type_ref
+
+
+@require_context
+def instance_type_get_all(context, inactive=0):
+    """
+    Returns a dict describing all instance_types with name as key.
+    """
+    session = get_session()
+    if inactive:
+        inst_types = session.query(models.InstanceTypes).\
+                        order_by("name").\
+                        all()
+    else:
+        inst_types = session.query(models.InstanceTypes).\
+                        filter_by(deleted=inactive).\
+                        order_by("name").\
+                        all()
+    if inst_types:
+        inst_dict = {}
+        for i in inst_types:
+            inst_dict[i['name']] = dict(i)
+        return inst_dict
+    else:
+        raise exception.NotFound
+
+
+@require_context
+def instance_type_get_by_name(context, name):
+    """Returns a dict describing specific instance_type"""
+    session = get_session()
+    inst_type = session.query(models.InstanceTypes).\
+                    filter_by(name=name).\
+                    first()
+    if not inst_type:
+        raise exception.NotFound(_("No instance type with name %s") % name)
+    else:
+        return dict(inst_type)
+
+
+@require_context
+def instance_type_get_by_flavor_id(context, id):
+    """Returns a dict describing specific flavor_id"""
+    session = get_session()
+    inst_type = session.query(models.InstanceTypes).\
+                                    filter_by(flavorid=int(id)).\
+                                    first()
+    if not inst_type:
+        raise exception.NotFound(_("No flavor with name %s") % id)
+    else:
+        return dict(inst_type)
+
+
+@require_admin_context
+def instance_type_destroy(context, name):
+    """ Marks specific instance_type as deleted"""
+    session = get_session()
+    instance_type_ref = session.query(models.InstanceTypes).\
+                                      filter_by(name=name)
+    records = instance_type_ref.update(dict(deleted=1))
+    if records == 0:
+        raise exception.NotFound
+    else:
+        return instance_type_ref
+
+
+@require_admin_context
+def instance_type_purge(context, name):
+    """ Removes specific instance_type from DB
+        Usually instance_type_destroy should be used
+    """
+    session = get_session()
+    instance_type_ref = session.query(models.InstanceTypes).\
+                                      filter_by(name=name)
+    records = instance_type_ref.delete()
+    if records == 0:
+        raise exception.NotFound
+    else:
+        return instance_type_ref
+
+
 ####################
 
 
@@ -2101,8 +2430,9 @@ def zone_update(context, zone_id, values):
 def zone_delete(context, zone_id):
     session = get_session()
     with session.begin():
-        session.execute('delete from zones '
-                        'where id=:id', {'id': zone_id})
+        session.query(models.Zone).\
+                filter_by(id=zone_id).\
+                delete()
 
 
 @require_admin_context
diff --git a/nova/db/sqlalchemy/migrate_repo/versions/005_add_instance_metadata.py b/nova/db/sqlalchemy/migrate_repo/versions/005_add_instance_metadata.py
new file mode 100644
index 000000000..4cb07e0d8
--- /dev/null
+++ b/nova/db/sqlalchemy/migrate_repo/versions/005_add_instance_metadata.py
@@ -0,0 +1,78 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 Justin Santa Barbara
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from sqlalchemy import *
+from migrate import *
+
+from nova import log as logging
+
+
+meta = MetaData()
+
+
+# Just for the ForeignKey and column creation to succeed, these are not the
+# actual definitions of instances or services.
+instances = Table('instances', meta,
+        Column('id', Integer(), primary_key=True, nullable=False),
+        )
+
+quotas = Table('quotas', meta,
+        Column('id', Integer(),  primary_key=True, nullable=False),
+        )
+
+
+#
+# New Tables
+#
+
+instance_metadata_table = Table('instance_metadata', meta,
+        Column('created_at', DateTime(timezone=False)),
+        Column('updated_at', DateTime(timezone=False)),
+        Column('deleted_at', DateTime(timezone=False)),
+        Column('deleted', Boolean(create_constraint=True, name=None)),
+        Column('id', Integer(), primary_key=True, nullable=False),
+        Column('instance_id',
+               Integer(),
+               ForeignKey('instances.id'),
+               nullable=False),
+        Column('key',
+               String(length=255, convert_unicode=False, assert_unicode=None,
+                      unicode_error=None, _warn_on_bytestring=False)),
+        Column('value',
+               String(length=255, convert_unicode=False, assert_unicode=None,
+                      unicode_error=None, _warn_on_bytestring=False)))
+
+
+#
+# New columns
+#
+quota_metadata_items = Column('metadata_items', Integer())
+
+
+def upgrade(migrate_engine):
+    # Upgrade operations go here. Don't create your own engine;
+    # bind migrate_engine to your metadata
+    meta.bind = migrate_engine
+    for table in (instance_metadata_table, ):
+        try:
+            table.create()
+        except Exception:
+            logging.info(repr(table))
+            logging.exception('Exception while creating table')
+            raise
+
+    quotas.create_column(quota_metadata_items)
diff --git a/nova/db/sqlalchemy/migrate_repo/versions/006_add_provider_data_to_volumes.py b/nova/db/sqlalchemy/migrate_repo/versions/006_add_provider_data_to_volumes.py
new file mode 100644
index 000000000..705fc8ff3
--- /dev/null
+++ b/nova/db/sqlalchemy/migrate_repo/versions/006_add_provider_data_to_volumes.py
@@ -0,0 +1,72 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 Justin Santa Barbara.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from sqlalchemy import *
+from migrate import *
+
+from nova import log as logging
+
+
+meta = MetaData()
+
+
+# Table stub-definitions
+# Just for the ForeignKey and column creation to succeed, these are not the
+# actual definitions of instances or services.
+#
+volumes = Table('volumes', meta,
+                Column('id', Integer(), primary_key=True, nullable=False),
+                )
+
+
+#
+# New Tables
+#
+# None
+
+#
+# Tables to alter
+#
+# None
+
+#
+# Columns to add to existing tables
+#
+
+volumes_provider_location = Column('provider_location',
+                                   String(length=256,
+                                          convert_unicode=False,
+                                          assert_unicode=None,
+                                          unicode_error=None,
+                                          _warn_on_bytestring=False))
+
+volumes_provider_auth = Column('provider_auth',
+                               String(length=256,
+                                      convert_unicode=False,
+                                      assert_unicode=None,
+                                      unicode_error=None,
+                                      _warn_on_bytestring=False))
+
+
+def upgrade(migrate_engine):
+    # Upgrade operations go here. Don't create your own engine;
+    # bind migrate_engine to your metadata
+    meta.bind = migrate_engine
+
+    # Add columns to existing tables
+    volumes.create_column(volumes_provider_location)
+    volumes.create_column(volumes_provider_auth)
diff --git a/nova/db/sqlalchemy/migrate_repo/versions/007_add_ipv6_to_fixed_ips.py b/nova/db/sqlalchemy/migrate_repo/versions/007_add_ipv6_to_fixed_ips.py
new file mode 100644
index 000000000..427934d53
--- /dev/null
+++ b/nova/db/sqlalchemy/migrate_repo/versions/007_add_ipv6_to_fixed_ips.py
@@ -0,0 +1,90 @@
+# Copyright 2011 OpenStack LLC
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from sqlalchemy import *
+from migrate import *
+
+from nova import log as logging
+
+
+meta = MetaData()
+
+
+# Table stub-definitions
+# Just for the ForeignKey and column creation to succeed, these are not the
+# actual definitions of instances or services.
+#
+fixed_ips = Table(
+    "fixed_ips",
+    meta,
+    Column(
+        "id",
+        Integer(),
+        primary_key=True,
+        nullable=False))
+
+#
+# New Tables
+#
+# None
+
+#
+# Tables to alter
+#
+# None
+
+#
+# Columns to add to existing tables
+#
+
+fixed_ips_addressV6 = Column(
+    "addressV6",
+    String(
+        length=255,
+        convert_unicode=False,
+        assert_unicode=None,
+        unicode_error=None,
+        _warn_on_bytestring=False))
+
+
+fixed_ips_netmaskV6 = Column(
+    "netmaskV6",
+    String(
+        length=3,
+        convert_unicode=False,
+        assert_unicode=None,
+        unicode_error=None,
+        _warn_on_bytestring=False))
+
+
+fixed_ips_gatewayV6 = Column(
+    "gatewayV6",
+    String(
+        length=255,
+        convert_unicode=False,
+        assert_unicode=None,
+        unicode_error=None,
+        _warn_on_bytestring=False))
+
+
+def upgrade(migrate_engine):
+    # Upgrade operations go here. Don't create your own engine;
+    # bind migrate_engine to your metadata
+    meta.bind = migrate_engine
+
+    # Add columns to existing tables
+    fixed_ips.create_column(fixed_ips_addressV6)
+    fixed_ips.create_column(fixed_ips_netmaskV6)
+    fixed_ips.create_column(fixed_ips_gatewayV6)
diff --git a/nova/db/sqlalchemy/migrate_repo/versions/008_add_instance_types.py b/nova/db/sqlalchemy/migrate_repo/versions/008_add_instance_types.py
new file mode 100644
index 000000000..66609054e
--- /dev/null
+++ b/nova/db/sqlalchemy/migrate_repo/versions/008_add_instance_types.py
@@ -0,0 +1,87 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 Ken Pepple
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from sqlalchemy import *
+from migrate import *
+
+from nova import api
+from nova import db
+from nova import log as logging
+
+import datetime
+
+meta = MetaData()
+
+
+#
+# New Tables
+#
+instance_types = Table('instance_types', meta,
+        Column('created_at', DateTime(timezone=False)),
+        Column('updated_at', DateTime(timezone=False)),
+        Column('deleted_at', DateTime(timezone=False)),
+        Column('deleted', Boolean(create_constraint=True, name=None)),
+        Column('name',
+               String(length=255, convert_unicode=False, assert_unicode=None,
+                      unicode_error=None, _warn_on_bytestring=False),
+                      unique=True),
+        Column('id', Integer(),  primary_key=True, nullable=False),
+        Column('memory_mb', Integer(),  nullable=False),
+        Column('vcpus', Integer(),  nullable=False),
+        Column('local_gb', Integer(),  nullable=False),
+        Column('flavorid', Integer(),  nullable=False, unique=True),
+        Column('swap', Integer(),  nullable=False, default=0),
+        Column('rxtx_quota', Integer(),  nullable=False, default=0),
+        Column('rxtx_cap', Integer(),  nullable=False, default=0))
+
+
+def upgrade(migrate_engine):
+    # Upgrade operations go here
+    # Don't create your own engine; bind migrate_engine
+    # to your metadata
+    meta.bind = migrate_engine
+    try:
+        instance_types.create()
+    except Exception:
+        logging.info(repr(table))
+        logging.exception('Exception while creating instance_types table')
+        raise
+
+    # Here are the old static instance types
+    INSTANCE_TYPES = {
+    'm1.tiny': dict(memory_mb=512, vcpus=1, local_gb=0, flavorid=1),
+    'm1.small': dict(memory_mb=2048, vcpus=1, local_gb=20, flavorid=2),
+    'm1.medium': dict(memory_mb=4096, vcpus=2, local_gb=40, flavorid=3),
+    'm1.large': dict(memory_mb=8192, vcpus=4, local_gb=80, flavorid=4),
+    'm1.xlarge': dict(memory_mb=16384, vcpus=8, local_gb=160, flavorid=5)}
+    try:
+        i = instance_types.insert()
+        for name, values in INSTANCE_TYPES.iteritems():
+            # FIXME(kpepple) should we be seeding created_at / updated_at ?
+            # now = datetime.datatime.utcnow()
+            i.execute({'name': name, 'memory_mb': values["memory_mb"],
+                        'vcpus': values["vcpus"], 'deleted': 0,
+                        'local_gb': values["local_gb"],
+                        'flavorid': values["flavorid"]})
+    except Exception:
+        logging.info(repr(table))
+        logging.exception('Exception while seeding instance_types table')
+        raise
+
+
+def downgrade(migrate_engine):
+    # Operations to reverse the above upgrade go here.
+    for table in (instance_types):
+        table.drop()
diff --git a/nova/db/sqlalchemy/migrate_repo/versions/009_add_instance_migrations.py b/nova/db/sqlalchemy/migrate_repo/versions/009_add_instance_migrations.py
new file mode 100644
index 000000000..4fda525f1
--- /dev/null
+++ b/nova/db/sqlalchemy/migrate_repo/versions/009_add_instance_migrations.py
@@ -0,0 +1,61 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.from sqlalchemy import *
+
+from sqlalchemy import *
+from migrate import *
+
+from nova import log as logging
+
+
+meta = MetaData()
+
+# Just for the ForeignKey and column creation to succeed, these are not the
+# actual definitions of instances or services.
+instances = Table('instances', meta,
+        Column('id', Integer(),  primary_key=True, nullable=False),
+        )
+
+#
+# New Tables
+#
+
+migrations = Table('migrations', meta,
+            Column('created_at', DateTime(timezone=False)),
+            Column('updated_at', DateTime(timezone=False)),
+            Column('deleted_at', DateTime(timezone=False)),
+            Column('deleted', Boolean(create_constraint=True, name=None)),
+            Column('id', Integer(), primary_key=True, nullable=False),
+            Column('source_compute', String(255)),
+            Column('dest_compute', String(255)),
+            Column('dest_host', String(255)),
+            Column('instance_id', Integer, ForeignKey('instances.id'),
+                nullable=True),
+            Column('status', String(255)),
+      )
+
+
+def upgrade(migrate_engine):
+    # Upgrade operations go here. Don't create your own engine;
+    # bind migrate_engine to your metadata
+    meta.bind = migrate_engine
+    for table in (migrations, ):
+        try:
+            table.create()
+        except Exception:
+            logging.info(repr(table))
+            logging.exception('Exception while creating table')
+            raise
diff --git a/nova/db/sqlalchemy/migrate_repo/versions/010_add_os_type_to_instances.py b/nova/db/sqlalchemy/migrate_repo/versions/010_add_os_type_to_instances.py
new file mode 100644
index 000000000..eb3066894
--- /dev/null
+++ b/nova/db/sqlalchemy/migrate_repo/versions/010_add_os_type_to_instances.py
@@ -0,0 +1,51 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 OpenStack LLC.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from sqlalchemy import *
+from sqlalchemy.sql import text
+from migrate import *
+
+from nova import log as logging
+
+
+meta = MetaData()
+
+instances = Table('instances', meta,
+        Column('id', Integer(),  primary_key=True, nullable=False),
+        )
+
+instances_os_type = Column('os_type',
+                           String(length=255, convert_unicode=False,
+                                  assert_unicode=None, unicode_error=None,
+                                  _warn_on_bytestring=False),
+                           nullable=True)
+
+
+def upgrade(migrate_engine):
+    # Upgrade operations go here. Don't create your own engine;
+    # bind migrate_engine to your metadata
+    meta.bind = migrate_engine
+
+    instances.create_column(instances_os_type)
+    migrate_engine.execute(instances.update()\
+                           .where(instances.c.os_type == None)\
+                           .values(os_type='linux'))
+
+
+def downgrade(migrate_engine):
+    meta.bind = migrate_engine
+
+    instances.drop_column('os_type')
diff --git a/nova/db/sqlalchemy/migrate_repo/versions/011_live_migration.py b/nova/db/sqlalchemy/migrate_repo/versions/011_live_migration.py
new file mode 100644
index 000000000..23ccccb4e
--- /dev/null
+++ b/nova/db/sqlalchemy/migrate_repo/versions/011_live_migration.py
@@ -0,0 +1,83 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from migrate import *
+from nova import log as logging
+from sqlalchemy import *
+
+
+meta = MetaData()
+
+instances = Table('instances', meta,
+        Column('id', Integer(),  primary_key=True, nullable=False),
+        )
+
+#
+# New Tables
+#
+
+compute_nodes = Table('compute_nodes', meta,
+        Column('created_at', DateTime(timezone=False)),
+        Column('updated_at', DateTime(timezone=False)),
+        Column('deleted_at', DateTime(timezone=False)),
+        Column('deleted', Boolean(create_constraint=True, name=None)),
+        Column('id', Integer(),  primary_key=True, nullable=False),
+        Column('service_id', Integer(), nullable=False),
+
+        Column('vcpus', Integer(), nullable=False),
+        Column('memory_mb', Integer(), nullable=False),
+        Column('local_gb', Integer(), nullable=False),
+        Column('vcpus_used', Integer(), nullable=False),
+        Column('memory_mb_used', Integer(), nullable=False),
+        Column('local_gb_used', Integer(), nullable=False),
+        Column('hypervisor_type',
+               Text(convert_unicode=False, assert_unicode=None,
+               unicode_error=None, _warn_on_bytestring=False),
+               nullable=False),
+        Column('hypervisor_version', Integer(), nullable=False),
+        Column('cpu_info',
+               Text(convert_unicode=False, assert_unicode=None,
+                    unicode_error=None, _warn_on_bytestring=False),
+               nullable=False),
+        )
+
+
+#
+# Tables to alter
+#
+instances_launched_on = Column(
+         'launched_on',
+         Text(convert_unicode=False, assert_unicode=None,
+              unicode_error=None, _warn_on_bytestring=False),
+              nullable=True)
+
+
+def upgrade(migrate_engine):
+    # Upgrade operations go here. Don't create your own engine;
+    # bind migrate_engine to your metadata
+    meta.bind = migrate_engine
+
+    try:
+        compute_nodes.create()
+    except Exception:
+        logging.info(repr(compute_nodes))
+        logging.exception('Exception while creating table')
+        meta.drop_all(tables=[compute_nodes])
+        raise
+
+    instances.create_column(instances_launched_on)
diff --git a/nova/db/sqlalchemy/migration.py b/nova/db/sqlalchemy/migration.py
index 9bdaa6d6b..d9e303599 100644
--- a/nova/db/sqlalchemy/migration.py
+++ b/nova/db/sqlalchemy/migration.py
@@ -60,7 +60,7 @@ def db_version():
                           'key_pairs', 'networks', 'projects', 'quotas',
                           'security_group_instance_association',
                           'security_group_rules', 'security_groups',
-                          'services',
+                          'services', 'migrations',
                           'users', 'user_project_association',
                           'user_project_role_association',
                           'user_role_association',
diff --git a/nova/db/sqlalchemy/models.py b/nova/db/sqlalchemy/models.py
index 40a96fc17..162f6fded 100644
--- a/nova/db/sqlalchemy/models.py
+++ b/nova/db/sqlalchemy/models.py
@@ -113,6 +113,41 @@ class Service(BASE, NovaBase):
     availability_zone = Column(String(255), default='nova')
 
 
+class ComputeNode(BASE, NovaBase):
+    """Represents a running compute service on a host."""
+
+    __tablename__ = 'compute_nodes'
+    id = Column(Integer, primary_key=True)
+    service_id = Column(Integer, ForeignKey('services.id'), nullable=True)
+    service = relationship(Service,
+                           backref=backref('compute_node'),
+                           foreign_keys=service_id,
+                           primaryjoin='and_('
+                                'ComputeNode.service_id == Service.id,'
+                                'ComputeNode.deleted == False)')
+
+    vcpus = Column(Integer, nullable=True)
+    memory_mb = Column(Integer, nullable=True)
+    local_gb = Column(Integer, nullable=True)
+    vcpus_used = Column(Integer, nullable=True)
+    memory_mb_used = Column(Integer, nullable=True)
+    local_gb_used = Column(Integer, nullable=True)
+    hypervisor_type = Column(Text, nullable=True)
+    hypervisor_version = Column(Integer, nullable=True)
+
+    # Note(masumotok): Expected Strings example:
+    #
+    # '{"arch":"x86_64",
+    #   "model":"Nehalem",
+    #   "topology":{"sockets":1, "threads":2, "cores":3},
+    #   "features":["tdtscp", "xtpr"]}'
+    #
+    # Points are "json translatable" and it must have all dictionary keys
+    # above, since it is copied from <cpu> tag of getCapabilities()
+    # (See libvirt.virtConnection).
+    cpu_info = Column(Text, nullable=True)
+
+
 class Certificate(BASE, NovaBase):
     """Represents a an x509 certificate"""
     __tablename__ = 'certificates'
@@ -126,11 +161,16 @@ class Certificate(BASE, NovaBase):
 class Instance(BASE, NovaBase):
     """Represents a guest vm."""
     __tablename__ = 'instances'
+    onset_files = []
+
     id = Column(Integer, primary_key=True, autoincrement=True)
 
     @property
     def name(self):
-        return FLAGS.instance_name_template % self.id
+        base_name = FLAGS.instance_name_template % self.id
+        if getattr(self, '_rescue', False):
+            base_name += "-rescue"
+        return base_name
 
     admin_pass = Column(String(255))
     user_id = Column(String(255))
@@ -186,8 +226,13 @@ class Instance(BASE, NovaBase):
     display_name = Column(String(255))
     display_description = Column(String(255))
 
+    # To remember on which host a instance booted.
+    # An instance may have moved to another host by live migraiton.
+    launched_on = Column(Text)
     locked = Column(Boolean)
 
+    os_type = Column(String(255))
+
     # TODO(vish): see Ewan's email about state improvements, probably
     #             should be in a driver base class or some such
     # vmstate_state = running, halted, suspended, paused
@@ -210,6 +255,20 @@ class InstanceActions(BASE, NovaBase):
     error = Column(Text)
 
 
+class InstanceTypes(BASE, NovaBase):
+    """Represent possible instance_types or flavor of VM offered"""
+    __tablename__ = "instance_types"
+    id = Column(Integer, primary_key=True)
+    name = Column(String(255), unique=True)
+    memory_mb = Column(Integer)
+    vcpus = Column(Integer)
+    local_gb = Column(Integer)
+    flavorid = Column(Integer, unique=True)
+    swap = Column(Integer, nullable=False, default=0)
+    rxtx_quota = Column(Integer, nullable=False, default=0)
+    rxtx_cap = Column(Integer, nullable=False, default=0)
+
+
 class Volume(BASE, NovaBase):
     """Represents a block storage device that can be attached to a vm."""
     __tablename__ = 'volumes'
@@ -243,6 +302,9 @@ class Volume(BASE, NovaBase):
     display_name = Column(String(255))
     display_description = Column(String(255))
 
+    provider_location = Column(String(255))
+    provider_auth = Column(String(255))
+
 
 class Quota(BASE, NovaBase):
     """Represents quota overrides for a project."""
@@ -256,6 +318,7 @@ class Quota(BASE, NovaBase):
     volumes = Column(Integer)
     gigabytes = Column(Integer)
     floating_ips = Column(Integer)
+    metadata_items = Column(Integer)
 
 
 class ExportDevice(BASE, NovaBase):
@@ -366,6 +429,18 @@ class KeyPair(BASE, NovaBase):
     public_key = Column(Text)
 
 
+class Migration(BASE, NovaBase):
+    """Represents a running host-to-host migration."""
+    __tablename__ = 'migrations'
+    id = Column(Integer, primary_key=True, nullable=False)
+    source_compute = Column(String(255))
+    dest_compute = Column(String(255))
+    dest_host = Column(String(255))
+    instance_id = Column(Integer, ForeignKey('instances.id'), nullable=True)
+    #TODO(_cerberus_): enum
+    status = Column(String(255))
+
+
 class Network(BASE, NovaBase):
     """Represents a network."""
     __tablename__ = 'networks'
@@ -433,6 +508,9 @@ class FixedIp(BASE, NovaBase):
     allocated = Column(Boolean, default=False)
     leased = Column(Boolean, default=False)
     reserved = Column(Boolean, default=False)
+    addressV6 = Column(String(255))
+    netmaskV6 = Column(String(3))
+    gatewayV6 = Column(String(255))
 
 
 class User(BASE, NovaBase):
@@ -536,6 +614,20 @@ class Console(BASE, NovaBase):
     pool = relationship(ConsolePool, backref=backref('consoles'))
 
 
+class InstanceMetadata(BASE, NovaBase):
+    """Represents a metadata key/value pair for an instance"""
+    __tablename__ = 'instance_metadata'
+    id = Column(Integer, primary_key=True)
+    key = Column(String(255))
+    value = Column(String(255))
+    instance_id = Column(Integer, ForeignKey('instances.id'), nullable=False)
+    instance = relationship(Instance, backref="metadata",
+                            foreign_keys=instance_id,
+                            primaryjoin='and_('
+                                'InstanceMetadata.instance_id == Instance.id,'
+                                'InstanceMetadata.deleted == False)')
+
+
 class Zone(BASE, NovaBase):
     """Represents a child zone of this zone."""
     __tablename__ = 'zones'
@@ -553,11 +645,12 @@ def register_models():
     connection is lost and needs to be reestablished.
     """
     from sqlalchemy import create_engine
-    models = (Service, Instance, InstanceActions,
+    models = (Service, Instance, InstanceActions, InstanceTypes,
               Volume, ExportDevice, IscsiTarget, FixedIp, FloatingIp,
               Network, SecurityGroup, SecurityGroupIngressRule,
               SecurityGroupInstanceAssociation, AuthToken, User,
-              Project, Certificate, ConsolePool, Console, Zone)
+              Project, Certificate, ConsolePool, Console, Zone,
+              InstanceMetadata, Migration)
     engine = create_engine(FLAGS.sql_connection, echo=False)
     for model in models:
         model.metadata.create_all(engine)
diff --git a/nova/exception.py b/nova/exception.py
index 7d65bd6a5..93c5fe3d7 100644
--- a/nova/exception.py
+++ b/nova/exception.py
@@ -88,6 +88,10 @@ class InvalidInputException(Error):
     pass
 
 
+class InvalidContentType(Error):
+    pass
+
+
 class TimeoutException(Error):
     pass
 
diff --git a/nova/fakerabbit.py b/nova/fakerabbit.py
index dd82a9366..a7dee8caf 100644
--- a/nova/fakerabbit.py
+++ b/nova/fakerabbit.py
@@ -48,7 +48,6 @@ class Exchange(object):
         nm = self.name
         LOG.debug(_('(%(nm)s) publish (key: %(routing_key)s)'
                 ' %(message)s') % locals())
-        routing_key = routing_key.split('.')[0]
         if routing_key in self._routes:
             for f in self._routes[routing_key]:
                 LOG.debug(_('Publishing to route %s'), f)
diff --git a/nova/flags.py b/nova/flags.py
index f64a62da9..9123e9ac7 100644
--- a/nova/flags.py
+++ b/nova/flags.py
@@ -160,9 +160,45 @@ class StrWrapper(object):
         raise KeyError(name)
 
 
-FLAGS = FlagValues()
-gflags.FLAGS = FLAGS
-gflags.DEFINE_flag(gflags.HelpFlag(), FLAGS)
+# Copied from gflags with small mods to get the naming correct.
+# Originally gflags checks for the first module that is not gflags that is
+# in the call chain, we want to check for the first module that is not gflags
+# and not this module.
+def _GetCallingModule():
+    """Returns the name of the module that's calling into this module.
+
+    We generally use this function to get the name of the module calling a
+    DEFINE_foo... function.
+    """
+    # Walk down the stack to find the first globals dict that's not ours.
+    for depth in range(1, sys.getrecursionlimit()):
+        if not sys._getframe(depth).f_globals is globals():
+            module_name = __GetModuleName(sys._getframe(depth).f_globals)
+            if module_name == 'gflags':
+                continue
+            if module_name is not None:
+                return module_name
+    raise AssertionError("No module was found")
+
+
+# Copied from gflags because it is a private function
+def __GetModuleName(globals_dict):
+    """Given a globals dict, returns the name of the module that defines it.
+
+    Args:
+    globals_dict: A dictionary that should correspond to an environment
+      providing the values of the globals.
+
+    Returns:
+    A string (the name of the module) or None (if the module could not
+    be identified.
+    """
+    for name, module in sys.modules.iteritems():
+        if getattr(module, '__dict__', None) is globals_dict:
+            if name == '__main__':
+                return sys.argv[0]
+            return name
+    return None
 
 
 def _wrapper(func):
@@ -173,6 +209,11 @@ def _wrapper(func):
     return _wrapped
 
 
+FLAGS = FlagValues()
+gflags.FLAGS = FLAGS
+gflags._GetCallingModule = _GetCallingModule
+
+
 DEFINE = _wrapper(gflags.DEFINE)
 DEFINE_string = _wrapper(gflags.DEFINE_string)
 DEFINE_integer = _wrapper(gflags.DEFINE_integer)
@@ -185,8 +226,6 @@ DEFINE_spaceseplist = _wrapper(gflags.DEFINE_spaceseplist)
 DEFINE_multistring = _wrapper(gflags.DEFINE_multistring)
 DEFINE_multi_int = _wrapper(gflags.DEFINE_multi_int)
 DEFINE_flag = _wrapper(gflags.DEFINE_flag)
-
-
 HelpFlag = gflags.HelpFlag
 HelpshortFlag = gflags.HelpshortFlag
 HelpXMLFlag = gflags.HelpXMLFlag
@@ -282,11 +321,14 @@ DEFINE_integer('auth_token_ttl', 3600, 'Seconds for auth tokens to linger')
 
 DEFINE_string('state_path', os.path.join(os.path.dirname(__file__), '../'),
               "Top-level directory for maintaining nova's state")
+DEFINE_string('lock_path', os.path.join(os.path.dirname(__file__), '../'),
+              "Directory for lock files")
 DEFINE_string('logdir', None, 'output to a per-service log file in named '
                               'directory')
 
+DEFINE_string('sqlite_db', 'nova.sqlite', 'file name for sqlite')
 DEFINE_string('sql_connection',
-              'sqlite:///$state_path/nova.sqlite',
+              'sqlite:///$state_path/$sqlite_db',
               'connection string for sql database')
 DEFINE_integer('sql_idle_timeout',
               3600,
@@ -306,7 +348,7 @@ DEFINE_string('scheduler_manager', 'nova.scheduler.manager.SchedulerManager',
               'Manager for scheduler')
 
 # The service to use for image search and retrieval
-DEFINE_string('image_service', 'nova.image.s3.S3ImageService',
+DEFINE_string('image_service', 'nova.image.local.LocalImageService',
               'The service to use for retrieving and searching for images.')
 
 DEFINE_string('host', socket.gethostname(),
@@ -314,3 +356,7 @@ DEFINE_string('host', socket.gethostname(),
 
 DEFINE_string('node_availability_zone', 'nova',
               'availability zone of this node')
+
+DEFINE_string('zone_name', 'nova', 'name of this zone')
+DEFINE_string('zone_capabilities', 'kypervisor:xenserver;os:linux',
+              'Key/Value tags which represent capabilities of this zone')
diff --git a/nova/image/glance.py b/nova/image/glance.py
index 593c4bce6..15fca69b8 100644
--- a/nova/image/glance.py
+++ b/nova/image/glance.py
@@ -17,9 +17,8 @@
 """Implementation of an image service that uses Glance as the backend"""
 
 from __future__ import absolute_import
-import httplib
-import json
-import urlparse
+
+from glance.common import exception as glance_exception
 
 from nova import exception
 from nova import flags
@@ -53,31 +52,64 @@ class GlanceImageService(service.BaseImageService):
         """
         return self.client.get_images_detailed()
 
-    def show(self, context, id):
+    def show(self, context, image_id):
         """
         Returns a dict containing image data for the given opaque image id.
         """
-        image = self.client.get_image_meta(id)
-        if image:
-            return image
-        raise exception.NotFound
+        try:
+            image = self.client.get_image_meta(image_id)
+        except glance_exception.NotFound:
+            raise exception.NotFound
+        return image
 
-    def create(self, context, data):
+    def show_by_name(self, context, name):
+        """
+        Returns a dict containing image data for the given name.
+        """
+        # TODO(vish): replace this with more efficient call when glance
+        #             supports it.
+        images = self.detail(context)
+        image = None
+        for cantidate in images:
+            if name == cantidate.get('name'):
+                image = cantidate
+                break
+        if image is None:
+            raise exception.NotFound
+        return image
+
+    def get(self, context, image_id, data):
+        """
+        Calls out to Glance for metadata and data and writes data.
+        """
+        try:
+            metadata, image_chunks = self.client.get_image(image_id)
+        except glance_exception.NotFound:
+            raise exception.NotFound
+        for chunk in image_chunks:
+            data.write(chunk)
+        return metadata
+
+    def create(self, context, metadata, data=None):
         """
         Store the image data and return the new image id.
 
         :raises AlreadyExists if the image already exist.
 
         """
-        return self.client.add_image(image_meta=data)
+        return self.client.add_image(metadata, data)
 
-    def update(self, context, image_id, data):
+    def update(self, context, image_id, metadata, data=None):
         """Replace the contents of the given image with the new data.
 
         :raises NotFound if the image does not exist.
 
         """
-        return self.client.update_image(image_id, data)
+        try:
+            result = self.client.update_image(image_id, metadata, data)
+        except glance_exception.NotFound:
+            raise exception.NotFound
+        return result
 
     def delete(self, context, image_id):
         """
@@ -86,7 +118,11 @@ class GlanceImageService(service.BaseImageService):
         :raises NotFound if the image does not exist.
 
         """
-        return self.client.delete_image(image_id)
+        try:
+            result = self.client.delete_image(image_id)
+        except glance_exception.NotFound:
+            raise exception.NotFound
+        return result
 
     def delete_all(self):
         """
diff --git a/nova/image/local.py b/nova/image/local.py
index f78b9aa89..c4ac3baaa 100644
--- a/nova/image/local.py
+++ b/nova/image/local.py
@@ -15,57 +15,110 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import cPickle as pickle
+import json
 import os.path
 import random
-import tempfile
+import shutil
 
+from nova import flags
 from nova import exception
 from nova.image import service
 
 
-class LocalImageService(service.BaseImageService):
+FLAGS = flags.FLAGS
+flags.DEFINE_string('images_path', '$state_path/images',
+                    'path to decrypted images')
+
 
+class LocalImageService(service.BaseImageService):
     """Image service storing images to local disk.
+
     It assumes that image_ids are integers.
 
     """
 
     def __init__(self):
-        self._path = tempfile.mkdtemp()
+        self._path = FLAGS.images_path
 
-    def _path_to(self, image_id):
-        return os.path.join(self._path, str(image_id))
+    def _path_to(self, image_id, fname='info.json'):
+        if fname:
+            return os.path.join(self._path, '%08x' % int(image_id), fname)
+        return os.path.join(self._path, '%08x' % int(image_id))
 
     def _ids(self):
         """The list of all image ids."""
-        return [int(i) for i in os.listdir(self._path)]
+        return [int(i, 16) for i in os.listdir(self._path)]
 
     def index(self, context):
-        return [dict(id=i['id'], name=i['name']) for i in self.detail(context)]
+        return [dict(image_id=i['id'], name=i.get('name'))
+                for i in self.detail(context)]
 
     def detail(self, context):
-        return [self.show(context, id) for id in self._ids()]
+        images = []
+        for image_id in self._ids():
+            try:
+                image = self.show(context, image_id)
+                images.append(image)
+            except exception.NotFound:
+                continue
+        return images
+
+    def show(self, context, image_id):
+        try:
+            with open(self._path_to(image_id)) as metadata_file:
+                return json.load(metadata_file)
+        except (IOError, ValueError):
+            raise exception.NotFound
 
-    def show(self, context, id):
+    def show_by_name(self, context, name):
+        """Returns a dict containing image data for the given name."""
+        # NOTE(vish): Not very efficient, but the local image service
+        #             is for testing so it should be fine.
+        images = self.detail(context)
+        image = None
+        for cantidate in images:
+            if name == cantidate.get('name'):
+                image = cantidate
+                break
+        if image == None:
+            raise exception.NotFound
+        return image
+
+    def get(self, context, image_id, data):
+        """Get image and metadata."""
         try:
-            return pickle.load(open(self._path_to(id)))
-        except IOError:
+            with open(self._path_to(image_id)) as metadata_file:
+                metadata = json.load(metadata_file)
+            with open(self._path_to(image_id, 'image')) as image_file:
+                shutil.copyfileobj(image_file, data)
+        except (IOError, ValueError):
             raise exception.NotFound
+        return metadata
 
-    def create(self, context, data):
-        """Store the image data and return the new image id."""
-        id = random.randint(0, 2 ** 31 - 1)
-        data['id'] = id
-        self.update(context, id, data)
-        return id
+    def create(self, context, metadata, data=None):
+        """Store the image data and return the new image."""
+        image_id = random.randint(0, 2 ** 31 - 1)
+        image_path = self._path_to(image_id, None)
+        if not os.path.exists(image_path):
+            os.mkdir(image_path)
+        return self.update(context, image_id, metadata, data)
 
-    def update(self, context, image_id, data):
+    def update(self, context, image_id, metadata, data=None):
         """Replace the contents of the given image with the new data."""
+        metadata['id'] = image_id
         try:
-            pickle.dump(data, open(self._path_to(image_id), 'w'))
-        except IOError:
+            if data:
+                location = self._path_to(image_id, 'image')
+                with open(location, 'w') as image_file:
+                    shutil.copyfileobj(data, image_file)
+                # NOTE(vish): update metadata similarly to glance
+                metadata['status'] = 'active'
+                metadata['location'] = location
+            with open(self._path_to(image_id), 'w') as metadata_file:
+                json.dump(metadata, metadata_file)
+        except (IOError, ValueError):
             raise exception.NotFound
+        return metadata
 
     def delete(self, context, image_id):
         """Delete the given image.
@@ -73,18 +126,11 @@ class LocalImageService(service.BaseImageService):
 
         """
         try:
-            os.unlink(self._path_to(image_id))
-        except IOError:
+            shutil.rmtree(self._path_to(image_id, None))
+        except (IOError, ValueError):
             raise exception.NotFound
 
     def delete_all(self):
         """Clears out all images in local directory."""
-        for id in self._ids():
-            os.unlink(self._path_to(id))
-
-    def delete_imagedir(self):
-        """Deletes the local directory.
-        Raises OSError if directory is not empty.
-
-        """
-        os.rmdir(self._path)
+        for image_id in self._ids():
+            shutil.rmtree(self._path_to(image_id, None))
diff --git a/nova/image/s3.py b/nova/image/s3.py
index 14135a1ee..85a2c651c 100644
--- a/nova/image/s3.py
+++ b/nova/image/s3.py
@@ -21,8 +21,13 @@ Proxy AMI-related calls from the cloud controller, to the running
 objectstore service.
 """
 
-import json
-import urllib
+import binascii
+import eventlet
+import os
+import shutil
+import tarfile
+import tempfile
+from xml.etree import ElementTree
 
 import boto.s3.connection
 
@@ -31,84 +36,78 @@ from nova import flags
 from nova import utils
 from nova.auth import manager
 from nova.image import service
+from nova.api.ec2 import ec2utils
 
 
 FLAGS = flags.FLAGS
+flags.DEFINE_string('image_decryption_dir', '/tmp',
+                    'parent dir for tempdir used for image decryption')
 
 
-def map_s3_to_base(image):
-    """Convert from S3 format to format defined by BaseImageService."""
-    i = {}
-    i['id'] = image.get('imageId')
-    i['name'] = image.get('imageId')
-    i['kernel_id'] = image.get('kernelId')
-    i['ramdisk_id'] = image.get('ramdiskId')
-    i['location'] = image.get('imageLocation')
-    i['owner_id'] = image.get('imageOwnerId')
-    i['status'] = image.get('imageState')
-    i['type'] = image.get('type')
-    i['is_public'] = image.get('isPublic')
-    i['architecture'] = image.get('architecture')
-    return i
+class S3ImageService(service.BaseImageService):
+    def __init__(self, service=None, *args, **kwargs):
+        if service == None:
+            service = utils.import_object(FLAGS.image_service)
+        self.service = service
+        self.service.__init__(*args, **kwargs)
 
+    def create(self, context, metadata, data=None):
+        """metadata['properties'] should contain image_location"""
+        image = self._s3_create(context, metadata)
+        return image
 
-class S3ImageService(service.BaseImageService):
+    def delete(self, context, image_id):
+        # FIXME(vish): call to show is to check filter
+        self.show(context, image_id)
+        self.service.delete(context, image_id)
 
-    def modify(self, context, image_id, operation):
-        self._conn(context).make_request(
-            method='POST',
-            bucket='_images',
-            query_args=self._qs({'image_id': image_id,
-                                 'operation': operation}))
-        return True
-
-    def update(self, context, image_id, attributes):
-        """update an image's attributes / info.json"""
-        attributes.update({"image_id": image_id})
-        self._conn(context).make_request(
-            method='POST',
-            bucket='_images',
-            query_args=self._qs(attributes))
-        return True
-
-    def register(self, context, image_location):
-        """ rpc call to register a new image based from a manifest """
-        image_id = utils.generate_uid('ami')
-        self._conn(context).make_request(
-            method='PUT',
-            bucket='_images',
-            query_args=self._qs({'image_location': image_location,
-                                 'image_id': image_id}))
-        return image_id
+    def update(self, context, image_id, metadata, data=None):
+        # FIXME(vish): call to show is to check filter
+        self.show(context, image_id)
+        image = self.service.update(context, image_id, metadata, data)
+        return image
 
     def index(self, context):
-        """Return a list of all images that a user can see."""
-        response = self._conn(context).make_request(
-            method='GET',
-            bucket='_images')
-        images = json.loads(response.read())
-        return [map_s3_to_base(i) for i in images]
+        images = self.service.index(context)
+        # FIXME(vish): index doesn't filter so we do it manually
+        return self._filter(context, images)
+
+    def detail(self, context):
+        images = self.service.detail(context)
+        # FIXME(vish): detail doesn't filter so we do it manually
+        return self._filter(context, images)
+
+    @classmethod
+    def _is_visible(cls, context, image):
+        return (context.is_admin
+                or context.project_id == image['properties']['owner_id']
+                or image['properties']['is_public'] == 'True')
+
+    @classmethod
+    def _filter(cls, context, images):
+        filtered = []
+        for image in images:
+            if not cls._is_visible(context, image):
+                continue
+            filtered.append(image)
+        return filtered
 
     def show(self, context, image_id):
-        """return a image object if the context has permissions"""
-        if FLAGS.connection_type == 'fake':
-            return {'imageId': 'bar'}
-        result = self.index(context)
-        result = [i for i in result if i['id'] == image_id]
-        if not result:
-            raise exception.NotFound(_('Image %s could not be found')
-                                     % image_id)
-        image = result[0]
+        image = self.service.show(context, image_id)
+        if not self._is_visible(context, image):
+            raise exception.NotFound
         return image
 
-    def deregister(self, context, image_id):
-        """ unregister an image """
-        self._conn(context).make_request(
-             method='DELETE',
-             bucket='_images',
-             query_args=self._qs({'image_id': image_id}))
+    def show_by_name(self, context, name):
+        image = self.service.show_by_name(context, name)
+        if not self._is_visible(context, image):
+            raise exception.NotFound
+        return image
 
-    def _conn(self, context):
+    @staticmethod
+    def _conn(context):
+        # TODO(vish): is there a better way to get creds to sign
+        #             for the user?
         access = manager.AuthManager().get_access_key(context.user,
                                                       context.project)
         secret = str(context.user.secret)
@@ -120,8 +119,159 @@ class S3ImageService(service.BaseImageService):
                                                port=FLAGS.s3_port,
                                                host=FLAGS.s3_host)
 
-    def _qs(self, params):
-        pairs = []
-        for key in params.keys():
-            pairs.append(key + '=' + urllib.quote(params[key]))
-        return '&'.join(pairs)
+    @staticmethod
+    def _download_file(bucket, filename, local_dir):
+        key = bucket.get_key(filename)
+        local_filename = os.path.join(local_dir, filename)
+        key.get_contents_to_filename(local_filename)
+        return local_filename
+
+    def _s3_create(self, context, metadata):
+        """Gets a manifext from s3 and makes an image"""
+
+        image_path = tempfile.mkdtemp(dir=FLAGS.image_decryption_dir)
+
+        image_location = metadata['properties']['image_location']
+        bucket_name = image_location.split("/")[0]
+        manifest_path = image_location[len(bucket_name) + 1:]
+        bucket = self._conn(context).get_bucket(bucket_name)
+        key = bucket.get_key(manifest_path)
+        manifest = key.get_contents_as_string()
+
+        manifest = ElementTree.fromstring(manifest)
+        image_format = 'ami'
+        image_type = 'machine'
+
+        try:
+            kernel_id = manifest.find("machine_configuration/kernel_id").text
+            if kernel_id == 'true':
+                image_format = 'aki'
+                image_type = 'kernel'
+                kernel_id = None
+        except Exception:
+            kernel_id = None
+
+        try:
+            ramdisk_id = manifest.find("machine_configuration/ramdisk_id").text
+            if ramdisk_id == 'true':
+                image_format = 'ari'
+                image_type = 'ramdisk'
+                ramdisk_id = None
+        except Exception:
+            ramdisk_id = None
+
+        try:
+            arch = manifest.find("machine_configuration/architecture").text
+        except Exception:
+            arch = 'x86_64'
+
+        properties = metadata['properties']
+        properties['owner_id'] = context.project_id
+        properties['architecture'] = arch
+
+        if kernel_id:
+            properties['kernel_id'] = ec2utils.ec2_id_to_id(kernel_id)
+
+        if ramdisk_id:
+            properties['ramdisk_id'] = ec2utils.ec2_id_to_id(ramdisk_id)
+
+        properties['is_public'] = False
+        properties['type'] = image_type
+        metadata.update({'disk_format': image_format,
+                         'container_format': image_format,
+                         'status': 'queued',
+                         'is_public': True,
+                         'properties': properties})
+        metadata['properties']['image_state'] = 'pending'
+        image = self.service.create(context, metadata)
+        image_id = image['id']
+
+        def delayed_create():
+            """This handles the fetching and decrypting of the part files."""
+            parts = []
+            for fn_element in manifest.find("image").getiterator("filename"):
+                part = self._download_file(bucket, fn_element.text, image_path)
+                parts.append(part)
+
+            # NOTE(vish): this may be suboptimal, should we use cat?
+            encrypted_filename = os.path.join(image_path, 'image.encrypted')
+            with open(encrypted_filename, 'w') as combined:
+                for filename in parts:
+                    with open(filename) as part:
+                        shutil.copyfileobj(part, combined)
+
+            metadata['properties']['image_state'] = 'decrypting'
+            self.service.update(context, image_id, metadata)
+
+            hex_key = manifest.find("image/ec2_encrypted_key").text
+            encrypted_key = binascii.a2b_hex(hex_key)
+            hex_iv = manifest.find("image/ec2_encrypted_iv").text
+            encrypted_iv = binascii.a2b_hex(hex_iv)
+
+            # FIXME(vish): grab key from common service so this can run on
+            #              any host.
+            cloud_pk = os.path.join(FLAGS.ca_path, "private/cakey.pem")
+
+            decrypted_filename = os.path.join(image_path, 'image.tar.gz')
+            self._decrypt_image(encrypted_filename, encrypted_key,
+                                encrypted_iv, cloud_pk, decrypted_filename)
+
+            metadata['properties']['image_state'] = 'untarring'
+            self.service.update(context, image_id, metadata)
+
+            unz_filename = self._untarzip_image(image_path, decrypted_filename)
+
+            metadata['properties']['image_state'] = 'uploading'
+            with open(unz_filename) as image_file:
+                self.service.update(context, image_id, metadata, image_file)
+            metadata['properties']['image_state'] = 'available'
+            self.service.update(context, image_id, metadata)
+
+            shutil.rmtree(image_path)
+
+        eventlet.spawn_n(delayed_create)
+
+        return image
+
+    @staticmethod
+    def _decrypt_image(encrypted_filename, encrypted_key, encrypted_iv,
+                       cloud_private_key, decrypted_filename):
+        key, err = utils.execute('openssl',
+                                 'rsautl',
+                                 '-decrypt',
+                                 '-inkey', '%s' % cloud_private_key,
+                                 process_input=encrypted_key,
+                                 check_exit_code=False)
+        if err:
+            raise exception.Error(_("Failed to decrypt private key: %s")
+                                  % err)
+        iv, err = utils.execute('openssl',
+                                'rsautl',
+                                '-decrypt',
+                                '-inkey', '%s' % cloud_private_key,
+                                process_input=encrypted_iv,
+                                check_exit_code=False)
+        if err:
+            raise exception.Error(_("Failed to decrypt initialization "
+                                    "vector: %s") % err)
+
+        _out, err = utils.execute('openssl', 'enc',
+                                  '-d', '-aes-128-cbc',
+                                  '-in', '%s' % (encrypted_filename,),
+                                  '-K', '%s' % (key,),
+                                  '-iv', '%s' % (iv,),
+                                  '-out', '%s' % (decrypted_filename,),
+                                  check_exit_code=False)
+        if err:
+            raise exception.Error(_("Failed to decrypt image file "
+                                    "%(image_file)s: %(err)s") %
+                                    {'image_file': encrypted_filename,
+                                     'err': err})
+
+    @staticmethod
+    def _untarzip_image(path, filename):
+        tar_file = tarfile.open(filename, "r|gz")
+        tar_file.extractall(path)
+        image_file = tar_file.getnames()[0]
+        tar_file.close()
+        return os.path.join(path, image_file)
diff --git a/nova/image/service.py b/nova/image/service.py
index ebee2228d..c09052cab 100644
--- a/nova/image/service.py
+++ b/nova/image/service.py
@@ -56,9 +56,9 @@ class BaseImageService(object):
         """
         raise NotImplementedError
 
-    def show(self, context, id):
+    def show(self, context, image_id):
         """
-        Returns a dict containing image data for the given opaque image id.
+        Returns a dict containing image metadata for the given opaque image id.
 
         :retval a mapping with the following signature:
 
@@ -76,17 +76,27 @@ class BaseImageService(object):
         """
         raise NotImplementedError
 
-    def create(self, context, data):
+    def get(self, context, data):
         """
-        Store the image data and return the new image id.
+        Returns a dict containing image metadata and writes image data to data.
+
+        :param data: a file-like object to hold binary image data
+
+        :raises NotFound if the image does not exist
+        """
+        raise NotImplementedError
+
+    def create(self, context, metadata, data=None):
+        """
+        Store the image metadata and data and return the new image id.
 
         :raises AlreadyExists if the image already exist.
 
         """
         raise NotImplementedError
 
-    def update(self, context, image_id, data):
-        """Replace the contents of the given image with the new data.
+    def update(self, context, image_id, metadata, data=None):
+        """Update the given image with the new metadata and data.
 
         :raises NotFound if the image does not exist.
 
diff --git a/nova/log.py b/nova/log.py
index 87a6dd51b..d194ab8f0 100644
--- a/nova/log.py
+++ b/nova/log.py
@@ -54,7 +54,7 @@ flags.DEFINE_string('logging_default_format_string',
                     'format string to use for log messages without context')
 
 flags.DEFINE_string('logging_debug_format_suffix',
-                    'from %(processName)s (pid=%(process)d) %(funcName)s'
+                    'from (pid=%(process)d) %(funcName)s'
                     ' %(pathname)s:%(lineno)d',
                     'data to append to log format when level is DEBUG')
 
@@ -65,6 +65,7 @@ flags.DEFINE_string('logging_exception_prefix',
 flags.DEFINE_list('default_log_levels',
                   ['amqplib=WARN',
                    'sqlalchemy=WARN',
+                   'boto=WARN',
                    'eventlet.wsgi.server=WARN'],
                   'list of logger=LEVEL pairs')
 
@@ -94,7 +95,7 @@ critical = logging.critical
 log = logging.log
 # handlers
 StreamHandler = logging.StreamHandler
-RotatingFileHandler = logging.handlers.RotatingFileHandler
+WatchedFileHandler = logging.handlers.WatchedFileHandler
 # logging.SysLogHandler is nicer than logging.logging.handler.SysLogHandler.
 SysLogHandler = logging.handlers.SysLogHandler
 
@@ -117,7 +118,7 @@ def _get_binary_name():
     return os.path.basename(inspect.stack()[-1][1])
 
 
-def get_log_file_path(binary=None):
+def _get_log_file_path(binary=None):
     if FLAGS.logfile:
         return FLAGS.logfile
     if FLAGS.logdir:
@@ -125,25 +126,6 @@ def get_log_file_path(binary=None):
         return '%s.log' % (os.path.join(FLAGS.logdir, binary),)
 
 
-def basicConfig():
-    logging.basicConfig()
-    for handler in logging.root.handlers:
-        handler.setFormatter(_formatter)
-    if FLAGS.verbose:
-        logging.root.setLevel(logging.DEBUG)
-    else:
-        logging.root.setLevel(logging.INFO)
-    if FLAGS.use_syslog:
-        syslog = SysLogHandler(address='/dev/log')
-        syslog.setFormatter(_formatter)
-        logging.root.addHandler(syslog)
-    logpath = get_log_file_path()
-    if logpath:
-        logfile = RotatingFileHandler(logpath)
-        logfile.setFormatter(_formatter)
-        logging.root.addHandler(logfile)
-
-
 class NovaLogger(logging.Logger):
     """
     NovaLogger manages request context and formatting.
@@ -151,23 +133,19 @@ class NovaLogger(logging.Logger):
     This becomes the class that is instanciated by logging.getLogger.
     """
     def __init__(self, name, level=NOTSET):
-        level_name = self._get_level_from_flags(name, FLAGS)
-        level = globals()[level_name]
         logging.Logger.__init__(self, name, level)
+        self.setup_from_flags()
 
-    def _get_level_from_flags(self, name, FLAGS):
-        # if exactly "nova", or a child logger, honor the verbose flag
-        if (name == "nova" or name.startswith("nova.")) and FLAGS.verbose:
-            return 'DEBUG'
+    def setup_from_flags(self):
+        """Setup logger from flags"""
+        level = NOTSET
         for pair in FLAGS.default_log_levels:
-            logger, _sep, level = pair.partition('=')
+            logger, _sep, level_name = pair.partition('=')
             # NOTE(todd): if we set a.b, we want a.b.c to have the same level
             #             (but not a.bc, so we check the dot)
-            if name == logger:
-                return level
-            if name.startswith(logger) and name[len(logger)] == '.':
-                return level
-        return 'INFO'
+            if self.name == logger or self.name.startswith("%s." % logger):
+                level = globals()[level_name]
+        self.setLevel(level)
 
     def _log(self, level, msg, args, exc_info=None, extra=None, context=None):
         """Extract context from any log call"""
@@ -176,12 +154,12 @@ class NovaLogger(logging.Logger):
         if context:
             extra.update(_dictify_context(context))
         extra.update({"nova_version": version.version_string_with_vcs()})
-        logging.Logger._log(self, level, msg, args, exc_info, extra)
+        return logging.Logger._log(self, level, msg, args, exc_info, extra)
 
     def addHandler(self, handler):
         """Each handler gets our custom formatter"""
         handler.setFormatter(_formatter)
-        logging.Logger.addHandler(self, handler)
+        return logging.Logger.addHandler(self, handler)
 
     def audit(self, msg, *args, **kwargs):
         """Shortcut for our AUDIT level"""
@@ -208,23 +186,6 @@ class NovaLogger(logging.Logger):
             self.error(message, **kwargs)
 
 
-def handle_exception(type, value, tb):
-    logging.root.critical(str(value), exc_info=(type, value, tb))
-
-
-sys.excepthook = handle_exception
-logging.setLoggerClass(NovaLogger)
-
-
-class NovaRootLogger(NovaLogger):
-    pass
-
-if not isinstance(logging.root, NovaRootLogger):
-    logging.root = NovaRootLogger("nova.root", WARNING)
-    NovaLogger.root = logging.root
-    NovaLogger.manager.root = logging.root
-
-
 class NovaFormatter(logging.Formatter):
     """
     A nova.context.RequestContext aware formatter configured through flags.
@@ -271,8 +232,76 @@ class NovaFormatter(logging.Formatter):
 _formatter = NovaFormatter()
 
 
+class NovaRootLogger(NovaLogger):
+    def __init__(self, name, level=NOTSET):
+        self.logpath = None
+        self.filelog = None
+        self.streamlog = StreamHandler()
+        self.syslog = None
+        NovaLogger.__init__(self, name, level)
+
+    def setup_from_flags(self):
+        """Setup logger from flags"""
+        global _filelog
+        if FLAGS.use_syslog:
+            self.syslog = SysLogHandler(address='/dev/log')
+            self.addHandler(self.syslog)
+        elif self.syslog:
+            self.removeHandler(self.syslog)
+        logpath = _get_log_file_path()
+        if logpath:
+            self.removeHandler(self.streamlog)
+            if logpath != self.logpath:
+                self.removeHandler(self.filelog)
+                self.filelog = WatchedFileHandler(logpath)
+                self.addHandler(self.filelog)
+                self.logpath = logpath
+        else:
+            self.removeHandler(self.filelog)
+            self.addHandler(self.streamlog)
+        if FLAGS.verbose:
+            self.setLevel(DEBUG)
+        else:
+            self.setLevel(INFO)
+
+
+def handle_exception(type, value, tb):
+    extra = {}
+    if FLAGS.verbose:
+        extra['exc_info'] = (type, value, tb)
+    logging.root.critical(str(value), **extra)
+
+
+def reset():
+    """Resets logging handlers.  Should be called if FLAGS changes."""
+    for logger in NovaLogger.manager.loggerDict.itervalues():
+        if isinstance(logger, NovaLogger):
+            logger.setup_from_flags()
+
+
+def setup():
+    """Setup nova logging."""
+    if not isinstance(logging.root, NovaRootLogger):
+        logging._acquireLock()
+        for handler in logging.root.handlers:
+            logging.root.removeHandler(handler)
+        logging.root = NovaRootLogger("nova")
+        NovaLogger.root = logging.root
+        NovaLogger.manager.root = logging.root
+        for logger in NovaLogger.manager.loggerDict.itervalues():
+            logger.root = logging.root
+            if isinstance(logger, logging.Logger):
+                NovaLogger.manager._fixupParents(logger)
+        NovaLogger.manager.loggerDict["nova"] = logging.root
+        logging._releaseLock()
+        sys.excepthook = handle_exception
+        reset()
+
+
+root = logging.root
+logging.setLoggerClass(NovaLogger)
+
+
 def audit(msg, *args, **kwargs):
     """Shortcut for logging to root log with sevrity 'AUDIT'."""
-    if len(logging.root.handlers) == 0:
-        basicConfig()
     logging.root.log(AUDIT, msg, *args, **kwargs)
diff --git a/nova/network/api.py b/nova/network/api.py
index bf43acb51..4ee1148cb 100644
--- a/nova/network/api.py
+++ b/nova/network/api.py
@@ -21,6 +21,7 @@ Handles all requests relating to instances (guest vms).
 """
 
 from nova import db
+from nova import exception
 from nova import flags
 from nova import log as logging
 from nova import quota
diff --git a/nova/network/linux_net.py b/nova/network/linux_net.py
index 535ce87bc..7106e6164 100644
--- a/nova/network/linux_net.py
+++ b/nova/network/linux_net.py
@@ -17,7 +17,11 @@
 Implements vlans, bridges, and iptables rules using linux utilities.
 """
 
+import inspect
 import os
+import calendar
+
+from eventlet import semaphore
 
 from nova import db
 from nova import exception
@@ -25,7 +29,6 @@ from nova import flags
 from nova import log as logging
 from nova import utils
 
-
 LOG = logging.getLogger("nova.linux_net")
 
 
@@ -52,10 +55,10 @@ flags.DEFINE_string('dhcpbridge', _bin_file('nova-dhcpbridge'),
                         'location of nova-dhcpbridge')
 flags.DEFINE_string('routing_source_ip', '$my_ip',
                     'Public IP of network host')
-flags.DEFINE_bool('use_nova_chains', False,
-                  'use the nova_ routing chains instead of default')
 flags.DEFINE_string('input_chain', 'INPUT',
                     'chain to add nova_input to')
+flags.DEFINE_integer('dhcp_lease_time', 120,
+                     'Lifetime of a DHCP lease')
 
 flags.DEFINE_string('dns_server', None,
                     'if set, uses specific dns server for dnsmasq')
@@ -63,115 +66,379 @@ flags.DEFINE_string('dmz_cidr', '10.128.0.0/24',
                     'dmz range that should be accepted')
 
 
+binary_name = os.path.basename(inspect.stack()[-1][1])
+
+
+class IptablesRule(object):
+    """An iptables rule
+
+    You shouldn't need to use this class directly, it's only used by
+    IptablesManager
+    """
+    def __init__(self, chain, rule, wrap=True, top=False):
+        self.chain = chain
+        self.rule = rule
+        self.wrap = wrap
+        self.top = top
+
+    def __eq__(self, other):
+        return ((self.chain == other.chain) and
+                (self.rule == other.rule) and
+                (self.top == other.top) and
+                (self.wrap == other.wrap))
+
+    def __ne__(self, other):
+        return not self == other
+
+    def __str__(self):
+        if self.wrap:
+            chain = '%s-%s' % (binary_name, self.chain)
+        else:
+            chain = self.chain
+        return '-A %s %s' % (chain, self.rule)
+
+
+class IptablesTable(object):
+    """An iptables table"""
+
+    def __init__(self):
+        self.rules = []
+        self.chains = set()
+        self.unwrapped_chains = set()
+
+    def add_chain(self, name, wrap=True):
+        """Adds a named chain to the table
+
+        The chain name is wrapped to be unique for the component creating
+        it, so different components of Nova can safely create identically
+        named chains without interfering with one another.
+
+        At the moment, its wrapped name is <binary name>-<chain name>,
+        so if nova-compute creates a chain named "OUTPUT", it'll actually
+        end up named "nova-compute-OUTPUT".
+        """
+        if wrap:
+            self.chains.add(name)
+        else:
+            self.unwrapped_chains.add(name)
+
+    def remove_chain(self, name, wrap=True):
+        """Remove named chain
+
+        This removal "cascades". All rule in the chain are removed, as are
+        all rules in other chains that jump to it.
+
+        If the chain is not found, this is merely logged.
+        """
+        if wrap:
+            chain_set = self.chains
+        else:
+            chain_set = self.unwrapped_chains
+
+        if name not in chain_set:
+            LOG.debug(_("Attempted to remove chain %s which doesn't exist"),
+                      name)
+            return
+
+        chain_set.remove(name)
+        self.rules = filter(lambda r: r.chain != name, self.rules)
+
+        if wrap:
+            jump_snippet = '-j %s-%s' % (binary_name, name)
+        else:
+            jump_snippet = '-j %s' % (name,)
+
+        self.rules = filter(lambda r: jump_snippet not in r.rule, self.rules)
+
+    def add_rule(self, chain, rule, wrap=True, top=False):
+        """Add a rule to the table
+
+        This is just like what you'd feed to iptables, just without
+        the "-A <chain name>" bit at the start.
+
+        However, if you need to jump to one of your wrapped chains,
+        prepend its name with a '$' which will ensure the wrapping
+        is applied correctly.
+        """
+        if wrap and chain not in self.chains:
+            raise ValueError(_("Unknown chain: %r") % chain)
+
+        if '$' in rule:
+            rule = ' '.join(map(self._wrap_target_chain, rule.split(' ')))
+
+        self.rules.append(IptablesRule(chain, rule, wrap, top))
+
+    def _wrap_target_chain(self, s):
+        if s.startswith('$'):
+            return '%s-%s' % (binary_name, s[1:])
+        return s
+
+    def remove_rule(self, chain, rule, wrap=True, top=False):
+        """Remove a rule from a chain
+
+        Note: The rule must be exactly identical to the one that was added.
+        You cannot switch arguments around like you can with the iptables
+        CLI tool.
+        """
+        try:
+            self.rules.remove(IptablesRule(chain, rule, wrap, top))
+        except ValueError:
+            LOG.debug(_("Tried to remove rule that wasn't there:"
+                        " %(chain)r %(rule)r %(wrap)r %(top)r"),
+                      {'chain': chain, 'rule': rule,
+                       'top': top, 'wrap': wrap})
+
+
+class IptablesManager(object):
+    """Wrapper for iptables
+
+    See IptablesTable for some usage docs
+
+    A number of chains are set up to begin with.
+
+    First, nova-filter-top. It's added at the top of FORWARD and OUTPUT. Its
+    name is not wrapped, so it's shared between the various nova workers. It's
+    intended for rules that need to live at the top of the FORWARD and OUTPUT
+    chains. It's in both the ipv4 and ipv6 set of tables.
+
+    For ipv4 and ipv6, the builtin INPUT, OUTPUT, and FORWARD filter chains are
+    wrapped, meaning that the "real" INPUT chain has a rule that jumps to the
+    wrapped INPUT chain, etc. Additionally, there's a wrapped chain named
+    "local" which is jumped to from nova-filter-top.
+
+    For ipv4, the builtin PREROUTING, OUTPUT, and POSTROUTING nat chains are
+    wrapped in the same was as the builtin filter chains. Additionally, there's
+    a snat chain that is applied after the POSTROUTING chain.
+    """
+    def __init__(self, execute=None):
+        if not execute:
+            if FLAGS.fake_network:
+                self.execute = lambda *args, **kwargs: ('', '')
+            else:
+                self.execute = utils.execute
+        else:
+            self.execute = execute
+
+        self.ipv4 = {'filter': IptablesTable(),
+                     'nat': IptablesTable()}
+        self.ipv6 = {'filter': IptablesTable()}
+
+        # Add a nova-filter-top chain. It's intended to be shared
+        # among the various nova components. It sits at the very top
+        # of FORWARD and OUTPUT.
+        for tables in [self.ipv4, self.ipv6]:
+            tables['filter'].add_chain('nova-filter-top', wrap=False)
+            tables['filter'].add_rule('FORWARD', '-j nova-filter-top',
+                                      wrap=False, top=True)
+            tables['filter'].add_rule('OUTPUT', '-j nova-filter-top',
+                                      wrap=False, top=True)
+
+            tables['filter'].add_chain('local')
+            tables['filter'].add_rule('nova-filter-top', '-j $local',
+                                      wrap=False)
+
+        # Wrap the builtin chains
+        builtin_chains = {4: {'filter': ['INPUT', 'OUTPUT', 'FORWARD'],
+                              'nat': ['PREROUTING', 'OUTPUT', 'POSTROUTING']},
+                          6: {'filter': ['INPUT', 'OUTPUT', 'FORWARD']}}
+
+        for ip_version in builtin_chains:
+            if ip_version == 4:
+                tables = self.ipv4
+            elif ip_version == 6:
+                tables = self.ipv6
+
+            for table, chains in builtin_chains[ip_version].iteritems():
+                for chain in chains:
+                    tables[table].add_chain(chain)
+                    tables[table].add_rule(chain, '-j $%s' % (chain,),
+                                           wrap=False)
+
+        # Add a nova-postrouting-bottom chain. It's intended to be shared
+        # among the various nova components. We set it as the last chain
+        # of POSTROUTING chain.
+        self.ipv4['nat'].add_chain('nova-postrouting-bottom', wrap=False)
+        self.ipv4['nat'].add_rule('POSTROUTING', '-j nova-postrouting-bottom',
+                                  wrap=False)
+
+        # We add a snat chain to the shared nova-postrouting-bottom chain
+        # so that it's applied last.
+        self.ipv4['nat'].add_chain('snat')
+        self.ipv4['nat'].add_rule('nova-postrouting-bottom', '-j $snat',
+                                  wrap=False)
+
+        # And then we add a floating-snat chain and jump to first thing in
+        # the snat chain.
+        self.ipv4['nat'].add_chain('floating-snat')
+        self.ipv4['nat'].add_rule('snat', '-j $floating-snat')
+
+        self.semaphore = semaphore.Semaphore()
+
+    @utils.synchronized('iptables')
+    def apply(self):
+        """Apply the current in-memory set of iptables rules
+
+        This will blow away any rules left over from previous runs of the
+        same component of Nova, and replace them with our current set of
+        rules. This happens atomically, thanks to iptables-restore.
+
+        We wrap the call in a semaphore lock, so that we don't race with
+        ourselves. In the event of a race with another component running
+        an iptables-* command at the same time, we retry up to 5 times.
+        """
+        with self.semaphore:
+            s = [('iptables', self.ipv4)]
+            if FLAGS.use_ipv6:
+                s += [('ip6tables', self.ipv6)]
+
+            for cmd, tables in s:
+                for table in tables:
+                    current_table, _ = self.execute('sudo',
+                                                    '%s-save' % (cmd,),
+                                                    '-t', '%s' % (table,),
+                                                    attempts=5)
+                    current_lines = current_table.split('\n')
+                    new_filter = self._modify_rules(current_lines,
+                                                    tables[table])
+                    self.execute('sudo', '%s-restore' % (cmd,),
+                                 process_input='\n'.join(new_filter),
+                                 attempts=5)
+
+    def _modify_rules(self, current_lines, table, binary=None):
+        unwrapped_chains = table.unwrapped_chains
+        chains = table.chains
+        rules = table.rules
+
+        # Remove any trace of our rules
+        new_filter = filter(lambda line: binary_name not in line,
+                            current_lines)
+
+        seen_chains = False
+        rules_index = 0
+        for rules_index, rule in enumerate(new_filter):
+            if not seen_chains:
+                if rule.startswith(':'):
+                    seen_chains = True
+            else:
+                if not rule.startswith(':'):
+                    break
+
+        our_rules = []
+        for rule in rules:
+            rule_str = str(rule)
+            if rule.top:
+                # rule.top == True means we want this rule to be at the top.
+                # Further down, we weed out duplicates from the bottom of the
+                # list, so here we remove the dupes ahead of time.
+                new_filter = filter(lambda s: s.strip() != rule_str.strip(),
+                                    new_filter)
+            our_rules += [rule_str]
+
+        new_filter[rules_index:rules_index] = our_rules
+
+        new_filter[rules_index:rules_index] = [':%s - [0:0]' % \
+                                               (name,) \
+                                               for name in unwrapped_chains]
+        new_filter[rules_index:rules_index] = [':%s-%s - [0:0]' % \
+                                               (binary_name, name,) \
+                                               for name in chains]
+
+        seen_lines = set()
+
+        def _weed_out_duplicates(line):
+            line = line.strip()
+            if line in seen_lines:
+                return False
+            else:
+                seen_lines.add(line)
+                return True
+
+        # We filter duplicates, letting the *last* occurrence take
+        # precendence.
+        new_filter.reverse()
+        new_filter = filter(_weed_out_duplicates, new_filter)
+        new_filter.reverse()
+        return new_filter
+
+
+iptables_manager = IptablesManager()
+
+
 def metadata_forward():
     """Create forwarding rule for metadata"""
-    _confirm_rule("PREROUTING", "-t nat -s 0.0.0.0/0 "
-             "-d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j DNAT "
-             "--to-destination %s:%s" % (FLAGS.ec2_dmz_host, FLAGS.ec2_port))
+    iptables_manager.ipv4['nat'].add_rule("PREROUTING",
+                                          "-s 0.0.0.0/0 -d 169.254.169.254/32 "
+                                          "-p tcp -m tcp --dport 80 -j DNAT "
+                                          "--to-destination %s:%s" % \
+                                          (FLAGS.ec2_dmz_host, FLAGS.ec2_port))
+    iptables_manager.apply()
 
 
 def init_host():
     """Basic networking setup goes here"""
-
-    if FLAGS.use_nova_chains:
-        _execute("sudo iptables -N nova_input", check_exit_code=False)
-        _execute("sudo iptables -D %s -j nova_input" % FLAGS.input_chain,
-                 check_exit_code=False)
-        _execute("sudo iptables -A %s -j nova_input" % FLAGS.input_chain)
-
-        _execute("sudo iptables -N nova_forward", check_exit_code=False)
-        _execute("sudo iptables -D FORWARD -j nova_forward",
-                 check_exit_code=False)
-        _execute("sudo iptables -A FORWARD -j nova_forward")
-
-        _execute("sudo iptables -N nova_output", check_exit_code=False)
-        _execute("sudo iptables -D OUTPUT -j nova_output",
-                 check_exit_code=False)
-        _execute("sudo iptables -A OUTPUT -j nova_output")
-
-        _execute("sudo iptables -t nat -N nova_prerouting",
-                 check_exit_code=False)
-        _execute("sudo iptables -t nat -D PREROUTING -j nova_prerouting",
-                 check_exit_code=False)
-        _execute("sudo iptables -t nat -A PREROUTING -j nova_prerouting")
-
-        _execute("sudo iptables -t nat -N nova_postrouting",
-                 check_exit_code=False)
-        _execute("sudo iptables -t nat -D POSTROUTING -j nova_postrouting",
-                 check_exit_code=False)
-        _execute("sudo iptables -t nat -A POSTROUTING -j nova_postrouting")
-
-        _execute("sudo iptables -t nat -N nova_snatting",
-                 check_exit_code=False)
-        _execute("sudo iptables -t nat -D POSTROUTING -j nova_snatting",
-                 check_exit_code=False)
-        _execute("sudo iptables -t nat -A POSTROUTING -j nova_snatting")
-
-        _execute("sudo iptables -t nat -N nova_output", check_exit_code=False)
-        _execute("sudo iptables -t nat -D OUTPUT -j nova_output",
-                 check_exit_code=False)
-        _execute("sudo iptables -t nat -A OUTPUT -j nova_output")
-    else:
-        # NOTE(vish): This makes it easy to ensure snatting rules always
-        #             come after the accept rules in the postrouting chain
-        _execute("sudo iptables -t nat -N SNATTING",
-                 check_exit_code=False)
-        _execute("sudo iptables -t nat -D POSTROUTING -j SNATTING",
-                 check_exit_code=False)
-        _execute("sudo iptables -t nat -A POSTROUTING -j SNATTING")
-
     # NOTE(devcamcar): Cloud public SNAT entries and the default
     # SNAT rule for outbound traffic.
-    _confirm_rule("SNATTING", "-t nat -s %s "
-             "-j SNAT --to-source %s"
-             % (FLAGS.fixed_range, FLAGS.routing_source_ip), append=True)
+    iptables_manager.ipv4['nat'].add_rule("snat",
+                                          "-s %s -j SNAT --to-source %s" % \
+                                           (FLAGS.fixed_range,
+                                            FLAGS.routing_source_ip))
+
+    iptables_manager.ipv4['nat'].add_rule("POSTROUTING",
+                                          "-s %s -d %s -j ACCEPT" % \
+                                          (FLAGS.fixed_range, FLAGS.dmz_cidr))
 
-    _confirm_rule("POSTROUTING", "-t nat -s %s -d %s -j ACCEPT" %
-                  (FLAGS.fixed_range, FLAGS.dmz_cidr))
-    _confirm_rule("POSTROUTING", "-t nat -s %(range)s -d %(range)s -j ACCEPT" %
-                  {'range': FLAGS.fixed_range})
+    iptables_manager.ipv4['nat'].add_rule("POSTROUTING",
+                                          "-s %(range)s -d %(range)s "
+                                          "-j ACCEPT" % \
+                                          {'range': FLAGS.fixed_range})
+    iptables_manager.apply()
 
 
 def bind_floating_ip(floating_ip, check_exit_code=True):
     """Bind ip to public interface"""
-    _execute("sudo ip addr add %s dev %s" % (floating_ip,
-                                             FLAGS.public_interface),
+    _execute('sudo', 'ip', 'addr', 'add', floating_ip,
+             'dev', FLAGS.public_interface,
              check_exit_code=check_exit_code)
 
 
 def unbind_floating_ip(floating_ip):
     """Unbind a public ip from public interface"""
-    _execute("sudo ip addr del %s dev %s" % (floating_ip,
-                                             FLAGS.public_interface))
+    _execute('sudo', 'ip', 'addr', 'del', floating_ip,
+             'dev', FLAGS.public_interface)
 
 
 def ensure_vlan_forward(public_ip, port, private_ip):
     """Sets up forwarding rules for vlan"""
-    _confirm_rule("FORWARD", "-d %s -p udp --dport 1194 -j ACCEPT" %
-                  private_ip)
-    _confirm_rule("PREROUTING",
-                  "-t nat -d %s -p udp --dport %s -j DNAT --to %s:1194"
-            % (public_ip, port, private_ip))
+    iptables_manager.ipv4['filter'].add_rule("FORWARD",
+                                             "-d %s -p udp "
+                                             "--dport 1194 "
+                                             "-j ACCEPT" % private_ip)
+    iptables_manager.ipv4['nat'].add_rule("PREROUTING",
+                                          "-d %s -p udp "
+                                          "--dport %s -j DNAT --to %s:1194" %
+                                          (public_ip, port, private_ip))
+    iptables_manager.apply()
 
 
 def ensure_floating_forward(floating_ip, fixed_ip):
     """Ensure floating ip forwarding rule"""
-    _confirm_rule("PREROUTING", "-t nat -d %s -j DNAT --to %s"
-                           % (floating_ip, fixed_ip))
-    _confirm_rule("OUTPUT", "-t nat -d %s -j DNAT --to %s"
-                           % (floating_ip, fixed_ip))
-    _confirm_rule("SNATTING", "-t nat -s %s -j SNAT --to %s"
-                           % (fixed_ip, floating_ip))
+    for chain, rule in floating_forward_rules(floating_ip, fixed_ip):
+        iptables_manager.ipv4['nat'].add_rule(chain, rule)
+    iptables_manager.apply()
 
 
 def remove_floating_forward(floating_ip, fixed_ip):
     """Remove forwarding for floating ip"""
-    _remove_rule("PREROUTING", "-t nat -d %s -j DNAT --to %s"
-                          % (floating_ip, fixed_ip))
-    _remove_rule("OUTPUT", "-t nat -d %s -j DNAT --to %s"
-                          % (floating_ip, fixed_ip))
-    _remove_rule("SNATTING", "-t nat -s %s -j SNAT --to %s"
-                          % (fixed_ip, floating_ip))
+    for chain, rule in floating_forward_rules(floating_ip, fixed_ip):
+        iptables_manager.ipv4['nat'].remove_rule(chain, rule)
+    iptables_manager.apply()
+
+
+def floating_forward_rules(floating_ip, fixed_ip):
+    return [("PREROUTING", "-d %s -j DNAT --to %s" % (floating_ip, fixed_ip)),
+            ("OUTPUT", "-d %s -j DNAT --to %s" % (floating_ip, fixed_ip)),
+            ("floating-snat",
+             "-s %s -j SNAT --to %s" % (fixed_ip, floating_ip))]
 
 
 def ensure_vlan_bridge(vlan_num, bridge, net_attrs=None):
@@ -185,9 +452,9 @@ def ensure_vlan(vlan_num):
     interface = "vlan%s" % vlan_num
     if not _device_exists(interface):
         LOG.debug(_("Starting VLAN inteface %s"), interface)
-        _execute("sudo vconfig set_name_type VLAN_PLUS_VID_NO_PAD")
-        _execute("sudo vconfig add %s %s" % (FLAGS.vlan_interface, vlan_num))
-        _execute("sudo ip link set %s up" % interface)
+        _execute('sudo', 'vconfig', 'set_name_type', 'VLAN_PLUS_VID_NO_PAD')
+        _execute('sudo', 'vconfig', 'add', FLAGS.vlan_interface, vlan_num)
+        _execute('sudo', 'ip', 'link', 'set', interface, 'up')
     return interface
 
 
@@ -206,75 +473,80 @@ def ensure_bridge(bridge, interface, net_attrs=None):
     """
     if not _device_exists(bridge):
         LOG.debug(_("Starting Bridge interface for %s"), interface)
-        _execute("sudo brctl addbr %s" % bridge)
-        _execute("sudo brctl setfd %s 0" % bridge)
+        _execute('sudo', 'brctl', 'addbr', bridge)
+        _execute('sudo', 'brctl', 'setfd', bridge, 0)
         # _execute("sudo brctl setageing %s 10" % bridge)
-        _execute("sudo brctl stp %s off" % bridge)
-        _execute("sudo ip link set %s up" % bridge)
+        _execute('sudo', 'brctl', 'stp', bridge, 'off')
+        _execute('sudo', 'ip', 'link', 'set', bridge, 'up')
     if net_attrs:
         # NOTE(vish): The ip for dnsmasq has to be the first address on the
         #             bridge for it to respond to reqests properly
         suffix = net_attrs['cidr'].rpartition('/')[2]
-        out, err = _execute("sudo ip addr add %s/%s brd %s dev %s" %
-                            (net_attrs['gateway'],
-                             suffix,
-                             net_attrs['broadcast'],
-                             bridge),
+        out, err = _execute('sudo', 'ip', 'addr', 'add',
+                            "%s/%s" %
+                            (net_attrs['gateway'], suffix),
+                            'brd',
+                            net_attrs['broadcast'],
+                            'dev',
+                            bridge,
                             check_exit_code=False)
         if err and err != "RTNETLINK answers: File exists\n":
             raise exception.Error("Failed to add ip: %s" % err)
         if(FLAGS.use_ipv6):
-            _execute("sudo ip -f inet6 addr change %s dev %s" %
-                     (net_attrs['cidr_v6'], bridge))
+            _execute('sudo', 'ip', '-f', 'inet6', 'addr',
+                     'change', net_attrs['cidr_v6'],
+                     'dev', bridge)
         # NOTE(vish): If the public interface is the same as the
         #             bridge, then the bridge has to be in promiscuous
         #             to forward packets properly.
         if(FLAGS.public_interface == bridge):
-            _execute("sudo ip link set dev %s promisc on" % bridge)
+            _execute('sudo', 'ip', 'link', 'set',
+                     'dev', bridge, 'promisc', 'on')
     if interface:
         # NOTE(vish): This will break if there is already an ip on the
         #             interface, so we move any ips to the bridge
         gateway = None
-        out, err = _execute("sudo route -n")
+        out, err = _execute('sudo', 'route', '-n')
         for line in out.split("\n"):
             fields = line.split()
             if fields and fields[0] == "0.0.0.0" and fields[-1] == interface:
                 gateway = fields[1]
-        out, err = _execute("sudo ip addr show dev %s scope global" %
-                            interface)
+        out, err = _execute('sudo', 'ip', 'addr', 'show', 'dev', interface,
+                            'scope', 'global')
         for line in out.split("\n"):
             fields = line.split()
             if fields and fields[0] == "inet":
-                params = ' '.join(fields[1:-1])
-                _execute("sudo ip addr del %s dev %s" % (params, fields[-1]))
-                _execute("sudo ip addr add %s dev %s" % (params, bridge))
+                params = fields[1:-1]
+                _execute(*_ip_bridge_cmd('del', params, fields[-1]))
+                _execute(*_ip_bridge_cmd('add', params, bridge))
         if gateway:
-            _execute("sudo route add 0.0.0.0 gw %s" % gateway)
-        out, err = _execute("sudo brctl addif %s %s" %
-                            (bridge, interface),
+            _execute('sudo', 'route', 'add', '0.0.0.0', 'gw', gateway)
+        out, err = _execute('sudo', 'brctl', 'addif', bridge, interface,
                             check_exit_code=False)
 
         if (err and err != "device %s is already a member of a bridge; can't "
                            "enslave it to bridge %s.\n" % (interface, bridge)):
             raise exception.Error("Failed to add interface: %s" % err)
 
-    if FLAGS.use_nova_chains:
-        (out, err) = _execute("sudo iptables -N nova_forward",
-                              check_exit_code=False)
-        if err != 'iptables: Chain already exists.\n':
-            # NOTE(vish): chain didn't exist link chain
-            _execute("sudo iptables -D FORWARD -j nova_forward",
-                     check_exit_code=False)
-            _execute("sudo iptables -A FORWARD -j nova_forward")
+    iptables_manager.ipv4['filter'].add_rule("FORWARD",
+                                             "--in-interface %s -j ACCEPT" % \
+                                             bridge)
+    iptables_manager.ipv4['filter'].add_rule("FORWARD",
+                                             "--out-interface %s -j ACCEPT" % \
+                                             bridge)
 
-    _confirm_rule("FORWARD", "--in-interface %s -j ACCEPT" % bridge)
-    _confirm_rule("FORWARD", "--out-interface %s -j ACCEPT" % bridge)
-    _execute("sudo iptables -N nova-local", check_exit_code=False)
-    _confirm_rule("FORWARD", "-j nova-local")
+
+def get_dhcp_leases(context, network_id):
+    """Return a network's hosts config in dnsmasq leasefile format"""
+    hosts = []
+    for fixed_ip_ref in db.network_get_associated_fixed_ips(context,
+                                                            network_id):
+        hosts.append(_host_lease(fixed_ip_ref))
+    return '\n'.join(hosts)
 
 
 def get_dhcp_hosts(context, network_id):
-    """Get a string containing a network's hosts config in dnsmasq format"""
+    """Get a string containing a network's hosts config in dhcp-host format"""
     hosts = []
     for fixed_ip_ref in db.network_get_associated_fixed_ips(context,
                                                             network_id):
@@ -304,11 +576,11 @@ def update_dhcp(context, network_id):
 
     # if dnsmasq is already running, then tell it to reload
     if pid:
-        out, _err = _execute('cat /proc/%d/cmdline' % pid,
+        out, _err = _execute('cat', "/proc/%d/cmdline" % pid,
                              check_exit_code=False)
         if conffile in out:
             try:
-                _execute('sudo kill -HUP %d' % pid)
+                _execute('sudo', 'kill', '-HUP', pid)
                 return
             except Exception as exc:  # pylint: disable-msg=W0703
                 LOG.debug(_("Hupping dnsmasq threw %s"), exc)
@@ -319,7 +591,7 @@ def update_dhcp(context, network_id):
     env = {'FLAGFILE': FLAGS.dhcpbridge_flagfile,
            'DNSMASQ_INTERFACE': network_ref['bridge']}
     command = _dnsmasq_cmd(network_ref)
-    _execute(command, addl_env=env)
+    _execute(*command, addl_env=env)
 
 
 def update_ra(context, network_id):
@@ -349,24 +621,40 @@ interface %s
 
     # if radvd is already running, then tell it to reload
     if pid:
-        out, _err = _execute('cat /proc/%d/cmdline'
+        out, _err = _execute('cat', '/proc/%d/cmdline'
                              % pid, check_exit_code=False)
         if conffile in out:
             try:
-                _execute('sudo kill %d' % pid)
+                _execute('sudo', 'kill', pid)
             except Exception as exc:  # pylint: disable-msg=W0703
                 LOG.debug(_("killing radvd threw %s"), exc)
         else:
             LOG.debug(_("Pid %d is stale, relaunching radvd"), pid)
     command = _ra_cmd(network_ref)
-    _execute(command)
+    _execute(*command)
     db.network_update(context, network_id,
                       {"ra_server":
                        utils.get_my_linklocal(network_ref['bridge'])})
 
 
+def _host_lease(fixed_ip_ref):
+    """Return a host string for an address in leasefile format"""
+    instance_ref = fixed_ip_ref['instance']
+    if instance_ref['updated_at']:
+        timestamp = instance_ref['updated_at']
+    else:
+        timestamp = instance_ref['created_at']
+
+    seconds_since_epoch = calendar.timegm(timestamp.utctimetuple())
+
+    return "%d %s %s %s *" % (seconds_since_epoch + FLAGS.dhcp_lease_time,
+                              instance_ref['mac_address'],
+                              fixed_ip_ref['address'],
+                              instance_ref['hostname'] or '*')
+
+
 def _host_dhcp(fixed_ip_ref):
-    """Return a host string for an address"""
+    """Return a host string for an address in dhcp-host format"""
     instance_ref = fixed_ip_ref['instance']
     return "%s,%s.%s,%s" % (instance_ref['mac_address'],
                                    instance_ref['hostname'],
@@ -374,68 +662,48 @@ def _host_dhcp(fixed_ip_ref):
                                    fixed_ip_ref['address'])
 
 
-def _execute(cmd, *args, **kwargs):
+def _execute(*cmd, **kwargs):
     """Wrapper around utils._execute for fake_network"""
     if FLAGS.fake_network:
-        LOG.debug("FAKE NET: %s", cmd)
+        LOG.debug("FAKE NET: %s", " ".join(map(str, cmd)))
         return "fake", 0
     else:
-        return utils.execute(cmd, *args, **kwargs)
+        return utils.execute(*cmd, **kwargs)
 
 
 def _device_exists(device):
     """Check if ethernet device exists"""
-    (_out, err) = _execute("ip link show dev %s" % device,
+    (_out, err) = _execute('ip', 'link', 'show', 'dev', device,
                            check_exit_code=False)
     return not err
 
 
-def _confirm_rule(chain, cmd, append=False):
-    """Delete and re-add iptables rule"""
-    if FLAGS.use_nova_chains:
-        chain = "nova_%s" % chain.lower()
-    if append:
-        loc = "-A"
-    else:
-        loc = "-I"
-    _execute("sudo iptables --delete %s %s" % (chain, cmd),
-             check_exit_code=False)
-    _execute("sudo iptables %s %s %s" % (loc, chain, cmd))
-
-
-def _remove_rule(chain, cmd):
-    """Remove iptables rule"""
-    if FLAGS.use_nova_chains:
-        chain = "%s" % chain.lower()
-    _execute("sudo iptables --delete %s %s" % (chain, cmd))
-
-
 def _dnsmasq_cmd(net):
     """Builds dnsmasq command"""
-    cmd = ['sudo -E dnsmasq',
-           ' --strict-order',
-           ' --bind-interfaces',
-           ' --conf-file=',
-           ' --domain=%s' % FLAGS.dhcp_domain,
-           ' --pid-file=%s' % _dhcp_file(net['bridge'], 'pid'),
-           ' --listen-address=%s' % net['gateway'],
-           ' --except-interface=lo',
-           ' --dhcp-range=%s,static,120s' % net['dhcp_start'],
-           ' --dhcp-hostsfile=%s' % _dhcp_file(net['bridge'], 'conf'),
-           ' --dhcp-script=%s' % FLAGS.dhcpbridge,
-           ' --leasefile-ro']
+    cmd = ['sudo', '-E', 'dnsmasq',
+           '--strict-order',
+           '--bind-interfaces',
+           '--conf-file=',
+           '--domain=%s' % FLAGS.dhcp_domain,
+           '--pid-file=%s' % _dhcp_file(net['bridge'], 'pid'),
+           '--listen-address=%s' % net['gateway'],
+           '--except-interface=lo',
+           '--dhcp-range=%s,static,120s' % net['dhcp_start'],
+           '--dhcp-hostsfile=%s' % _dhcp_file(net['bridge'], 'conf'),
+           '--dhcp-script=%s' % FLAGS.dhcpbridge,
+           '--leasefile-ro']
     if FLAGS.dns_server:
-        cmd.append(' -h -R --server=%s' % FLAGS.dns_server)
-    return ''.join(cmd)
+        cmd += ['-h', '-R', '--server=%s' % FLAGS.dns_server]
+    return cmd
 
 
 def _ra_cmd(net):
     """Builds radvd command"""
-    cmd = ['sudo -E radvd',
-#           ' -u nobody',
-           ' -C %s' % _ra_file(net['bridge'], 'conf'),
-           ' -p %s' % _ra_file(net['bridge'], 'pid')]
-    return ''.join(cmd)
+    cmd = ['sudo', '-E', 'radvd',
+#           '-u', 'nobody',
+           '-C', '%s' % _ra_file(net['bridge'], 'conf'),
+           '-p', '%s' % _ra_file(net['bridge'], 'pid')]
+    return cmd
 
 
 def _stop_dnsmasq(network):
@@ -444,7 +712,7 @@ def _stop_dnsmasq(network):
 
     if pid:
         try:
-            _execute('sudo kill -TERM %d' % pid)
+            _execute('sudo', 'kill', '-TERM', pid)
         except Exception as exc:  # pylint: disable-msg=W0703
             LOG.debug(_("Killing dnsmasq threw %s"), exc)
 
@@ -497,3 +765,12 @@ def _ra_pid_for(bridge):
     if os.path.exists(pid_file):
         with open(pid_file, 'r') as f:
             return int(f.read())
+
+
+def _ip_bridge_cmd(action, params, device):
+    """Build commands to add/del ips to bridges/devices"""
+
+    cmd = ['sudo', 'ip', 'addr', action]
+    cmd.extend(params)
+    cmd.extend(['dev', device])
+    return cmd
diff --git a/nova/network/manager.py b/nova/network/manager.py
index c6eba225e..3dfc48934 100644
--- a/nova/network/manager.py
+++ b/nova/network/manager.py
@@ -163,11 +163,22 @@ class NetworkManager(manager.Manager):
 
     def allocate_fixed_ip(self, context, instance_id, *args, **kwargs):
         """Gets a fixed ip from the pool."""
-        raise NotImplementedError()
+        # TODO(vish): when this is called by compute, we can associate compute
+        #             with a network, or a cluster of computes with a network
+        #             and use that network here with a method like
+        #             network_get_by_compute_host
+        network_ref = self.db.network_get_by_bridge(context,
+                                                    FLAGS.flat_network_bridge)
+        address = self.db.fixed_ip_associate_pool(context.elevated(),
+                                                  network_ref['id'],
+                                                  instance_id)
+        self.db.fixed_ip_update(context, address, {'allocated': True})
+        return address
 
     def deallocate_fixed_ip(self, context, address, *args, **kwargs):
         """Returns a fixed ip to the pool."""
-        raise NotImplementedError()
+        self.db.fixed_ip_update(context, address, {'allocated': False})
+        self.db.fixed_ip_disassociate(context.elevated(), address)
 
     def setup_fixed_ip(self, context, address):
         """Sets up rules for fixed ip."""
@@ -257,12 +268,58 @@ class NetworkManager(manager.Manager):
 
     def get_network_host(self, context):
         """Get the network host for the current context."""
-        raise NotImplementedError()
+        network_ref = self.db.network_get_by_bridge(context,
+                                                    FLAGS.flat_network_bridge)
+        # NOTE(vish): If the network has no host, use the network_host flag.
+        #             This could eventually be a a db lookup of some sort, but
+        #             a flag is easy to handle for now.
+        host = network_ref['host']
+        if not host:
+            topic = self.db.queue_get_for(context,
+                                          FLAGS.network_topic,
+                                          FLAGS.network_host)
+            if FLAGS.fake_call:
+                return self.set_network_host(context, network_ref['id'])
+            host = rpc.call(context,
+                            FLAGS.network_topic,
+                            {"method": "set_network_host",
+                             "args": {"network_id": network_ref['id']}})
+        return host
 
     def create_networks(self, context, cidr, num_networks, network_size,
-                        cidr_v6, *args, **kwargs):
+                        cidr_v6, label, *args, **kwargs):
         """Create networks based on parameters."""
-        raise NotImplementedError()
+        fixed_net = IPy.IP(cidr)
+        fixed_net_v6 = IPy.IP(cidr_v6)
+        significant_bits_v6 = 64
+        count = 1
+        for index in range(num_networks):
+            start = index * network_size
+            significant_bits = 32 - int(math.log(network_size, 2))
+            cidr = "%s/%s" % (fixed_net[start], significant_bits)
+            project_net = IPy.IP(cidr)
+            net = {}
+            net['bridge'] = FLAGS.flat_network_bridge
+            net['dns'] = FLAGS.flat_network_dns
+            net['cidr'] = cidr
+            net['netmask'] = str(project_net.netmask())
+            net['gateway'] = str(project_net[1])
+            net['broadcast'] = str(project_net.broadcast())
+            net['dhcp_start'] = str(project_net[2])
+            if num_networks > 1:
+                net['label'] = "%s_%d" % (label, count)
+            else:
+                net['label'] = label
+            count += 1
+
+            if(FLAGS.use_ipv6):
+                cidr_v6 = "%s/%s" % (fixed_net_v6[0], significant_bits_v6)
+                net['cidr_v6'] = cidr_v6
+
+            network_ref = self.db.network_create_safe(context, net)
+
+            if network_ref:
+                self._create_fixed_ips(context, network_ref['id'])
 
     @property
     def _bottom_reserved_ips(self):  # pylint: disable-msg=R0201
@@ -322,83 +379,20 @@ class FlatManager(NetworkManager):
     """
     timeout_fixed_ips = False
 
-    def allocate_fixed_ip(self, context, instance_id, *args, **kwargs):
-        """Gets a fixed ip from the pool."""
-        # TODO(vish): when this is called by compute, we can associate compute
-        #             with a network, or a cluster of computes with a network
-        #             and use that network here with a method like
-        #             network_get_by_compute_host
-        network_ref = self.db.network_get_by_bridge(context,
-                                                    FLAGS.flat_network_bridge)
-        address = self.db.fixed_ip_associate_pool(context.elevated(),
-                                                  network_ref['id'],
-                                                  instance_id)
-        self.db.fixed_ip_update(context, address, {'allocated': True})
-        return address
-
-    def deallocate_fixed_ip(self, context, address, *args, **kwargs):
-        """Returns a fixed ip to the pool."""
-        self.db.fixed_ip_update(context, address, {'allocated': False})
-        self.db.fixed_ip_disassociate(context.elevated(), address)
+    def init_host(self):
+        """Do any initialization that needs to be run if this is a
+        standalone service.
+        """
+        #Fix for bug 723298 - do not call init_host on superclass
+        #Following code has been copied for NetworkManager.init_host
+        ctxt = context.get_admin_context()
+        for network in self.db.host_get_networks(ctxt, self.host):
+            self._on_set_network_host(ctxt, network['id'])
 
     def setup_compute_network(self, context, instance_id):
         """Network is created manually."""
         pass
 
-    def create_networks(self, context, cidr, num_networks, network_size,
-                        cidr_v6, label, *args, **kwargs):
-        """Create networks based on parameters."""
-        fixed_net = IPy.IP(cidr)
-        fixed_net_v6 = IPy.IP(cidr_v6)
-        significant_bits_v6 = 64
-        count = 1
-        for index in range(num_networks):
-            start = index * network_size
-            significant_bits = 32 - int(math.log(network_size, 2))
-            cidr = "%s/%s" % (fixed_net[start], significant_bits)
-            project_net = IPy.IP(cidr)
-            net = {}
-            net['bridge'] = FLAGS.flat_network_bridge
-            net['cidr'] = cidr
-            net['netmask'] = str(project_net.netmask())
-            net['gateway'] = str(project_net[1])
-            net['broadcast'] = str(project_net.broadcast())
-            net['dhcp_start'] = str(project_net[2])
-            if num_networks > 1:
-                net['label'] = "%s_%d" % (label, count)
-            else:
-                net['label'] = label
-            count += 1
-
-            if(FLAGS.use_ipv6):
-                cidr_v6 = "%s/%s" % (fixed_net_v6[0], significant_bits_v6)
-                net['cidr_v6'] = cidr_v6
-
-            network_ref = self.db.network_create_safe(context, net)
-
-            if network_ref:
-                self._create_fixed_ips(context, network_ref['id'])
-
-    def get_network_host(self, context):
-        """Get the network host for the current context."""
-        network_ref = self.db.network_get_by_bridge(context,
-                                                    FLAGS.flat_network_bridge)
-        # NOTE(vish): If the network has no host, use the network_host flag.
-        #             This could eventually be a a db lookup of some sort, but
-        #             a flag is easy to handle for now.
-        host = network_ref['host']
-        if not host:
-            topic = self.db.queue_get_for(context,
-                                          FLAGS.network_topic,
-                                          FLAGS.network_host)
-            if FLAGS.fake_call:
-                return self.set_network_host(context, network_ref['id'])
-            host = rpc.call(context,
-                            FLAGS.network_topic,
-                            {"method": "set_network_host",
-                             "args": {"network_id": network_ref['id']}})
-        return host
-
     def _on_set_network_host(self, context, network_id):
         """Called when this host becomes the host for a network."""
         net = {}
@@ -406,8 +400,24 @@ class FlatManager(NetworkManager):
         net['dns'] = FLAGS.flat_network_dns
         self.db.network_update(context, network_id, net)
 
+    def allocate_floating_ip(self, context, project_id):
+        #Fix for bug 723298
+        raise NotImplementedError()
+
+    def associate_floating_ip(self, context, floating_address, fixed_address):
+        #Fix for bug 723298
+        raise NotImplementedError()
 
-class FlatDHCPManager(FlatManager):
+    def disassociate_floating_ip(self, context, floating_address):
+        #Fix for bug 723298
+        raise NotImplementedError()
+
+    def deallocate_floating_ip(self, context, floating_address):
+        #Fix for bug 723298
+        raise NotImplementedError()
+
+
+class FlatDHCPManager(NetworkManager):
     """Flat networking with dhcp.
 
     FlatDHCPManager will start up one dhcp server to give out addresses.
@@ -521,6 +531,11 @@ class VlanManager(NetworkManager):
                                ' than 4094'))
 
         fixed_net = IPy.IP(cidr)
+        if fixed_net.len() < num_networks * network_size:
+            raise ValueError(_('The network range is not big enough to fit '
+                  '%(num_networks)s. Network size is %(network_size)s' %
+                  locals()))
+
         fixed_net_v6 = IPy.IP(cidr_v6)
         network_size_v6 = 1 << 64
         significant_bits_v6 = 64
@@ -548,6 +563,16 @@ class VlanManager(NetworkManager):
             # NOTE(vish): This makes ports unique accross the cloud, a more
             #             robust solution would be to make them unique per ip
             net['vpn_public_port'] = vpn_start + index
+            network_ref = None
+            try:
+                network_ref = db.network_get_by_cidr(context, cidr)
+            except exception.NotFound:
+                pass
+
+            if network_ref is not None:
+                raise ValueError(_('Network with cidr %s already exists' %
+                                   cidr))
+
             network_ref = self.db.network_create_safe(context, net)
             if network_ref:
                 self._create_fixed_ips(context, network_ref['id'])
diff --git a/nova/objectstore/bucket.py b/nova/objectstore/bucket.py
index 82767e52f..b213e18e8 100644
--- a/nova/objectstore/bucket.py
+++ b/nova/objectstore/bucket.py
@@ -107,7 +107,7 @@ class Bucket(object):
 
     def is_authorized(self, context):
         try:
-            return context.user.is_admin() or \
+            return context.is_admin or \
                    self.owner_id == context.project_id
         except Exception, e:
             return False
diff --git a/nova/objectstore/image.py b/nova/objectstore/image.py
index 41e0abd80..c90b5b54b 100644
--- a/nova/objectstore/image.py
+++ b/nova/objectstore/image.py
@@ -37,8 +37,7 @@ from nova.objectstore import bucket
 
 
 FLAGS = flags.FLAGS
-flags.DEFINE_string('images_path', '$state_path/images',
-                    'path to decrypted images')
+flags.DECLARE('images_path', 'nova.image.local')
 
 
 class Image(object):
@@ -69,7 +68,7 @@ class Image(object):
         #                  but only modified by admin or owner.
         try:
             return (self.metadata['isPublic'] and readonly) or \
-                   context.user.is_admin() or \
+                   context.is_admin or \
                    self.metadata['imageOwnerId'] == context.project_id
         except:
             return False
@@ -254,25 +253,34 @@ class Image(object):
     @staticmethod
     def decrypt_image(encrypted_filename, encrypted_key, encrypted_iv,
                       cloud_private_key, decrypted_filename):
-        key, err = utils.execute(
-                'openssl rsautl -decrypt -inkey %s' % cloud_private_key,
-                process_input=encrypted_key,
-                check_exit_code=False)
+        key, err = utils.execute('openssl',
+                                 'rsautl',
+                                 '-decrypt',
+                                 '-inkey', '%s' % cloud_private_key,
+                                 process_input=encrypted_key,
+                                 check_exit_code=False)
         if err:
             raise exception.Error(_("Failed to decrypt private key: %s")
                                   % err)
-        iv, err = utils.execute(
-                'openssl rsautl -decrypt -inkey %s' % cloud_private_key,
-                process_input=encrypted_iv,
-                check_exit_code=False)
+        iv, err = utils.execute('openssl',
+                                'rsautl',
+                                '-decrypt',
+                                '-inkey', '%s' % cloud_private_key,
+                                process_input=encrypted_iv,
+                                check_exit_code=False)
         if err:
             raise exception.Error(_("Failed to decrypt initialization "
                                     "vector: %s") % err)
 
-        _out, err = utils.execute(
-                'openssl enc -d -aes-128-cbc -in %s -K %s -iv %s -out %s'
-                 % (encrypted_filename, key, iv, decrypted_filename),
-                 check_exit_code=False)
+        _out, err = utils.execute('openssl',
+                                  'enc',
+                                  '-d',
+                                  '-aes-128-cbc',
+                                  '-in', '%s' % (encrypted_filename,),
+                                  '-K', '%s' % (key,),
+                                  '-iv', '%s' % (iv,),
+                                  '-out', '%s' % (decrypted_filename,),
+                                  check_exit_code=False)
         if err:
             raise exception.Error(_("Failed to decrypt image file "
                                     "%(image_file)s: %(err)s") %
diff --git a/nova/quota.py b/nova/quota.py
index 3884eb308..6b52a97fa 100644
--- a/nova/quota.py
+++ b/nova/quota.py
@@ -35,6 +35,8 @@ flags.DEFINE_integer('quota_gigabytes', 1000,
                      'number of volume gigabytes allowed per project')
 flags.DEFINE_integer('quota_floating_ips', 10,
                      'number of floating ips allowed per project')
+flags.DEFINE_integer('quota_metadata_items', 128,
+                     'number of metadata items allowed per instance')
 
 
 def get_quota(context, project_id):
@@ -42,7 +44,8 @@ def get_quota(context, project_id):
             'cores': FLAGS.quota_cores,
             'volumes': FLAGS.quota_volumes,
             'gigabytes': FLAGS.quota_gigabytes,
-            'floating_ips': FLAGS.quota_floating_ips}
+            'floating_ips': FLAGS.quota_floating_ips,
+            'metadata_items': FLAGS.quota_metadata_items}
     try:
         quota = db.quota_get(context, project_id)
         for key in rval.keys():
@@ -94,6 +97,15 @@ def allowed_floating_ips(context, num_floating_ips):
     return min(num_floating_ips, allowed_floating_ips)
 
 
+def allowed_metadata_items(context, num_metadata_items):
+    """Check quota; return min(num_metadata_items,allowed_metadata_items)"""
+    project_id = context.project_id
+    context = context.elevated()
+    quota = get_quota(context, project_id)
+    num_allowed_metadata_items = quota['metadata_items']
+    return min(num_metadata_items, num_allowed_metadata_items)
+
+
 class QuotaError(exception.ApiError):
     """Quota Exceeeded"""
     pass
diff --git a/nova/rpc.py b/nova/rpc.py
index 205bb524a..fbb90299b 100644
--- a/nova/rpc.py
+++ b/nova/rpc.py
@@ -91,18 +91,19 @@ class Consumer(messaging.Consumer):
                 super(Consumer, self).__init__(*args, **kwargs)
                 self.failed_connection = False
                 break
-            except:  # Catching all because carrot sucks
+            except Exception as e:  # Catching all because carrot sucks
                 fl_host = FLAGS.rabbit_host
                 fl_port = FLAGS.rabbit_port
                 fl_intv = FLAGS.rabbit_retry_interval
-                LOG.exception(_("AMQP server on %(fl_host)s:%(fl_port)d is"
-                        " unreachable. Trying again in %(fl_intv)d seconds.")
+                LOG.error(_("AMQP server on %(fl_host)s:%(fl_port)d is"
+                        " unreachable: %(e)s. Trying again in %(fl_intv)d"
+                        " seconds.")
                         % locals())
                 self.failed_connection = True
         if self.failed_connection:
-            LOG.exception(_("Unable to connect to AMQP server "
-                          "after %d tries. Shutting down."),
-                          FLAGS.rabbit_max_retries)
+            LOG.error(_("Unable to connect to AMQP server "
+                        "after %d tries. Shutting down."),
+                      FLAGS.rabbit_max_retries)
             sys.exit(1)
 
     def fetch(self, no_ack=None, auto_ack=None, enable_callbacks=False):
@@ -122,7 +123,7 @@ class Consumer(messaging.Consumer):
                 LOG.error(_("Reconnected to queue"))
                 self.failed_connection = False
         # NOTE(vish): This is catching all errors because we really don't
-        #             exceptions to be logged 10 times a second if some
+        #             want exceptions to be logged 10 times a second if some
         #             persistent failure occurs.
         except Exception:  # pylint: disable-msg=W0703
             if not self.failed_connection:
diff --git a/nova/scheduler/api.py b/nova/scheduler/api.py
new file mode 100644
index 000000000..2405f1343
--- /dev/null
+++ b/nova/scheduler/api.py
@@ -0,0 +1,49 @@
+# Copyright (c) 2011 Openstack, LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Handles all requests relating to schedulers.
+"""
+
+from nova import flags
+from nova import log as logging
+from nova import rpc
+
+FLAGS = flags.FLAGS
+LOG = logging.getLogger('nova.scheduler.api')
+
+
+class API(object):
+    """API for interacting with the scheduler."""
+
+    def _call_scheduler(self, method, context, params=None):
+        """Generic handler for RPC calls to the scheduler.
+
+        :param params: Optional dictionary of arguments to be passed to the
+                       scheduler worker
+
+        :retval: Result returned by scheduler worker
+        """
+        if not params:
+            params = {}
+        queue = FLAGS.scheduler_topic
+        kwargs = {'method': method, 'args': params}
+        return rpc.call(context, queue, kwargs)
+
+    def get_zone_list(self, context):
+        items = self._call_scheduler('get_zone_list', context)
+        for item in items:
+            item['api_url'] = item['api_url'].replace('\\/', '/')
+        return items
diff --git a/nova/scheduler/driver.py b/nova/scheduler/driver.py
index 66e46c1b9..ed3dfe1c0 100644
--- a/nova/scheduler/driver.py
+++ b/nova/scheduler/driver.py
@@ -26,10 +26,14 @@ import datetime
 from nova import db
 from nova import exception
 from nova import flags
+from nova import log as logging
+from nova import rpc
+from nova.compute import power_state
 
 FLAGS = flags.FLAGS
 flags.DEFINE_integer('service_down_time', 60,
                      'maximum time since last checkin for up service')
+flags.DECLARE('instances_path', 'nova.compute.manager')
 
 
 class NoValidHost(exception.Error):
@@ -64,3 +68,236 @@ class Scheduler(object):
     def schedule(self, context, topic, *_args, **_kwargs):
         """Must override at least this method for scheduler to work."""
         raise NotImplementedError(_("Must implement a fallback schedule"))
+
+    def schedule_live_migration(self, context, instance_id, dest):
+        """Live migration scheduling method.
+
+        :param context:
+        :param instance_id:
+        :param dest: destination host
+        :return:
+            The host where instance is running currently.
+            Then scheduler send request that host.
+
+        """
+
+        # Whether instance exists and is running.
+        instance_ref = db.instance_get(context, instance_id)
+
+        # Checking instance.
+        self._live_migration_src_check(context, instance_ref)
+
+        # Checking destination host.
+        self._live_migration_dest_check(context, instance_ref, dest)
+
+        # Common checking.
+        self._live_migration_common_check(context, instance_ref, dest)
+
+        # Changing instance_state.
+        db.instance_set_state(context,
+                              instance_id,
+                              power_state.PAUSED,
+                              'migrating')
+
+        # Changing volume state
+        for volume_ref in instance_ref['volumes']:
+            db.volume_update(context,
+                             volume_ref['id'],
+                             {'status': 'migrating'})
+
+        # Return value is necessary to send request to src
+        # Check _schedule() in detail.
+        src = instance_ref['host']
+        return src
+
+    def _live_migration_src_check(self, context, instance_ref):
+        """Live migration check routine (for src host).
+
+        :param context: security context
+        :param instance_ref: nova.db.sqlalchemy.models.Instance object
+
+        """
+
+        # Checking instance is running.
+        if (power_state.RUNNING != instance_ref['state'] or \
+           'running' != instance_ref['state_description']):
+            ec2_id = instance_ref['hostname']
+            raise exception.Invalid(_('Instance(%s) is not running') % ec2_id)
+
+        # Checing volume node is running when any volumes are mounted
+        # to the instance.
+        if len(instance_ref['volumes']) != 0:
+            services = db.service_get_all_by_topic(context, 'volume')
+            if len(services) < 1 or  not self.service_is_up(services[0]):
+                raise exception.Invalid(_("volume node is not alive"
+                                          "(time synchronize problem?)"))
+
+        # Checking src host exists and compute node
+        src = instance_ref['host']
+        services = db.service_get_all_compute_by_host(context, src)
+
+        # Checking src host is alive.
+        if not self.service_is_up(services[0]):
+            raise exception.Invalid(_("%s is not alive(time "
+                                      "synchronize problem?)") % src)
+
+    def _live_migration_dest_check(self, context, instance_ref, dest):
+        """Live migration check routine (for destination host).
+
+        :param context: security context
+        :param instance_ref: nova.db.sqlalchemy.models.Instance object
+        :param dest: destination host
+
+        """
+
+        # Checking dest exists and compute node.
+        dservice_refs = db.service_get_all_compute_by_host(context, dest)
+        dservice_ref = dservice_refs[0]
+
+        # Checking dest host is alive.
+        if not self.service_is_up(dservice_ref):
+            raise exception.Invalid(_("%s is not alive(time "
+                                      "synchronize problem?)") % dest)
+
+        # Checking whether The host where instance is running
+        # and dest is not same.
+        src = instance_ref['host']
+        if dest == src:
+            ec2_id = instance_ref['hostname']
+            raise exception.Invalid(_("%(dest)s is where %(ec2_id)s is "
+                                       "running now. choose other host.")
+                                       % locals())
+
+        # Checking dst host still has enough capacities.
+        self.assert_compute_node_has_enough_resources(context,
+                                                      instance_ref,
+                                                      dest)
+
+    def _live_migration_common_check(self, context, instance_ref, dest):
+        """Live migration common check routine.
+
+        Below checkings are followed by
+        http://wiki.libvirt.org/page/TodoPreMigrationChecks
+
+        :param context: security context
+        :param instance_ref: nova.db.sqlalchemy.models.Instance object
+        :param dest: destination host
+
+        """
+
+        # Checking shared storage connectivity
+        self.mounted_on_same_shared_storage(context, instance_ref, dest)
+
+        # Checking dest exists.
+        dservice_refs = db.service_get_all_compute_by_host(context, dest)
+        dservice_ref = dservice_refs[0]['compute_node'][0]
+
+        # Checking original host( where instance was launched at) exists.
+        try:
+            oservice_refs = db.service_get_all_compute_by_host(context,
+                                           instance_ref['launched_on'])
+        except exception.NotFound:
+            raise exception.Invalid(_("host %s where instance was launched "
+                                      "does not exist.")
+                                       % instance_ref['launched_on'])
+        oservice_ref = oservice_refs[0]['compute_node'][0]
+
+        # Checking hypervisor is same.
+        orig_hypervisor = oservice_ref['hypervisor_type']
+        dest_hypervisor = dservice_ref['hypervisor_type']
+        if orig_hypervisor != dest_hypervisor:
+            raise exception.Invalid(_("Different hypervisor type"
+                                      "(%(orig_hypervisor)s->"
+                                      "%(dest_hypervisor)s)')" % locals()))
+
+        # Checkng hypervisor version.
+        orig_hypervisor = oservice_ref['hypervisor_version']
+        dest_hypervisor = dservice_ref['hypervisor_version']
+        if orig_hypervisor > dest_hypervisor:
+            raise exception.Invalid(_("Older hypervisor version"
+                                      "(%(orig_hypervisor)s->"
+                                      "%(dest_hypervisor)s)") % locals())
+
+        # Checking cpuinfo.
+        try:
+            rpc.call(context,
+                     db.queue_get_for(context, FLAGS.compute_topic, dest),
+                     {"method": 'compare_cpu',
+                      "args": {'cpu_info': oservice_ref['cpu_info']}})
+
+        except rpc.RemoteError:
+            src = instance_ref['host']
+            logging.exception(_("host %(dest)s is not compatible with "
+                                "original host %(src)s.") % locals())
+            raise
+
+    def assert_compute_node_has_enough_resources(self, context,
+                                                 instance_ref, dest):
+        """Checks if destination host has enough resource for live migration.
+
+        Currently, only memory checking has been done.
+        If storage migration(block migration, meaning live-migration
+        without any shared storage) will be available, local storage
+        checking is also necessary.
+
+        :param context: security context
+        :param instance_ref: nova.db.sqlalchemy.models.Instance object
+        :param dest: destination host
+
+        """
+
+        # Getting instance information
+        ec2_id = instance_ref['hostname']
+
+        # Getting host information
+        service_refs = db.service_get_all_compute_by_host(context, dest)
+        compute_node_ref = service_refs[0]['compute_node'][0]
+
+        mem_total = int(compute_node_ref['memory_mb'])
+        mem_used = int(compute_node_ref['memory_mb_used'])
+        mem_avail = mem_total - mem_used
+        mem_inst = instance_ref['memory_mb']
+        if mem_avail <= mem_inst:
+            raise exception.NotEmpty(_("Unable to migrate %(ec2_id)s "
+                                       "to destination: %(dest)s "
+                                       "(host:%(mem_avail)s "
+                                       "<= instance:%(mem_inst)s)")
+                                       % locals())
+
+    def mounted_on_same_shared_storage(self, context, instance_ref, dest):
+        """Check if the src and dest host mount same shared storage.
+
+        At first, dest host creates temp file, and src host can see
+        it if they mounts same shared storage. Then src host erase it.
+
+        :param context: security context
+        :param instance_ref: nova.db.sqlalchemy.models.Instance object
+        :param dest: destination host
+
+        """
+
+        src = instance_ref['host']
+        dst_t = db.queue_get_for(context, FLAGS.compute_topic, dest)
+        src_t = db.queue_get_for(context, FLAGS.compute_topic, src)
+
+        try:
+            # create tmpfile at dest host
+            filename = rpc.call(context, dst_t,
+                                {"method": 'create_shared_storage_test_file'})
+
+            # make sure existence at src host.
+            rpc.call(context, src_t,
+                     {"method": 'check_shared_storage_test_file',
+                      "args": {'filename': filename}})
+
+        except rpc.RemoteError:
+            ipath = FLAGS.instances_path
+            logging.error(_("Cannot confirm tmpfile at %(ipath)s is on "
+                            "same shared storage between %(src)s "
+                            "and %(dest)s.") % locals())
+            raise
+
+        finally:
+            rpc.call(context, dst_t,
+                     {"method": 'cleanup_shared_storage_test_file',
+                      "args": {'filename': filename}})
diff --git a/nova/scheduler/manager.py b/nova/scheduler/manager.py
index e9b47512e..053a53356 100644
--- a/nova/scheduler/manager.py
+++ b/nova/scheduler/manager.py
@@ -29,6 +29,7 @@ from nova import log as logging
 from nova import manager
 from nova import rpc
 from nova import utils
+from nova.scheduler import zone_manager
 
 LOG = logging.getLogger('nova.scheduler.manager')
 FLAGS = flags.FLAGS
@@ -43,12 +44,21 @@ class SchedulerManager(manager.Manager):
         if not scheduler_driver:
             scheduler_driver = FLAGS.scheduler_driver
         self.driver = utils.import_object(scheduler_driver)
+        self.zone_manager = zone_manager.ZoneManager()
         super(SchedulerManager, self).__init__(*args, **kwargs)
 
     def __getattr__(self, key):
         """Converts all method calls to use the schedule method"""
         return functools.partial(self._schedule, key)
 
+    def periodic_tasks(self, context=None):
+        """Poll child zones periodically to get status."""
+        self.zone_manager.ping(context)
+
+    def get_zone_list(self, context=None):
+        """Get a list of zones from the ZoneManager."""
+        return self.zone_manager.get_zone_list()
+
     def _schedule(self, method, context, topic, *args, **kwargs):
         """Tries to call schedule_* method on the driver to retrieve host.
 
@@ -67,3 +77,55 @@ class SchedulerManager(manager.Manager):
                  {"method": method,
                   "args": kwargs})
         LOG.debug(_("Casting to %(topic)s %(host)s for %(method)s") % locals())
+
+    # NOTE (masumotok) : This method should be moved to nova.api.ec2.admin.
+    #                    Based on bexar design summit discussion,
+    #                    just put this here for bexar release.
+    def show_host_resources(self, context, host, *args):
+        """Shows the physical/usage resource given by hosts.
+
+        :param context: security context
+        :param host: hostname
+        :returns:
+            example format is below.
+            {'resource':D, 'usage':{proj_id1:D, proj_id2:D}}
+            D: {'vcpus':3, 'memory_mb':2048, 'local_gb':2048}
+
+        """
+
+        compute_ref = db.service_get_all_compute_by_host(context, host)
+        compute_ref = compute_ref[0]
+
+        # Getting physical resource information
+        compute_node_ref = compute_ref['compute_node'][0]
+        resource = {'vcpus': compute_node_ref['vcpus'],
+                    'memory_mb': compute_node_ref['memory_mb'],
+                    'local_gb': compute_node_ref['local_gb'],
+                    'vcpus_used': compute_node_ref['vcpus_used'],
+                    'memory_mb_used': compute_node_ref['memory_mb_used'],
+                    'local_gb_used': compute_node_ref['local_gb_used']}
+
+        # Getting usage resource information
+        usage = {}
+        instance_refs = db.instance_get_all_by_host(context,
+                                                    compute_ref['host'])
+        if not instance_refs:
+            return {'resource': resource, 'usage': usage}
+
+        project_ids = [i['project_id'] for i in instance_refs]
+        project_ids = list(set(project_ids))
+        for project_id in project_ids:
+            vcpus = db.instance_get_vcpu_sum_by_host_and_project(context,
+                                                                 host,
+                                                                 project_id)
+            mem = db.instance_get_memory_sum_by_host_and_project(context,
+                                                                 host,
+                                                                 project_id)
+            hdd = db.instance_get_disk_sum_by_host_and_project(context,
+                                                               host,
+                                                               project_id)
+            usage[project_id] = {'vcpus': int(vcpus),
+                                 'memory_mb': int(mem),
+                                 'local_gb': int(hdd)}
+
+        return {'resource': resource, 'usage': usage}
diff --git a/nova/scheduler/zone_manager.py b/nova/scheduler/zone_manager.py
new file mode 100644
index 000000000..edf9000cc
--- /dev/null
+++ b/nova/scheduler/zone_manager.py
@@ -0,0 +1,143 @@
+# Copyright (c) 2011 Openstack, LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+ZoneManager oversees all communications with child Zones.
+"""
+
+import novaclient
+import thread
+import traceback
+
+from datetime import datetime
+from eventlet import greenpool
+
+from nova import db
+from nova import flags
+from nova import log as logging
+
+FLAGS = flags.FLAGS
+flags.DEFINE_integer('zone_db_check_interval', 60,
+                    'Seconds between getting fresh zone info from db.')
+flags.DEFINE_integer('zone_failures_to_offline', 3,
+             'Number of consecutive errors before marking zone offline')
+
+
+class ZoneState(object):
+    """Holds the state of all connected child zones."""
+    def __init__(self):
+        self.is_active = True
+        self.name = None
+        self.capabilities = None
+        self.attempt = 0
+        self.last_seen = datetime.min
+        self.last_exception = None
+        self.last_exception_time = None
+
+    def update_credentials(self, zone):
+        """Update zone credentials from db"""
+        self.zone_id = zone.id
+        self.api_url = zone.api_url
+        self.username = zone.username
+        self.password = zone.password
+
+    def update_metadata(self, zone_metadata):
+        """Update zone metadata after successful communications with
+           child zone."""
+        self.last_seen = datetime.now()
+        self.attempt = 0
+        self.name = zone_metadata["name"]
+        self.capabilities = zone_metadata["capabilities"]
+        self.is_active = True
+
+    def to_dict(self):
+        return dict(name=self.name, capabilities=self.capabilities,
+                    is_active=self.is_active, api_url=self.api_url,
+                    id=self.zone_id)
+
+    def log_error(self, exception):
+        """Something went wrong. Check to see if zone should be
+           marked as offline."""
+        self.last_exception = exception
+        self.last_exception_time = datetime.now()
+        api_url = self.api_url
+        logging.warning(_("'%(exception)s' error talking to "
+                          "zone %(api_url)s") % locals())
+
+        max_errors = FLAGS.zone_failures_to_offline
+        self.attempt += 1
+        if self.attempt >= max_errors:
+            self.is_active = False
+            logging.error(_("No answer from zone %(api_url)s "
+                            "after %(max_errors)d "
+                            "attempts. Marking inactive.") % locals())
+
+
+def _call_novaclient(zone):
+    """Call novaclient. Broken out for testing purposes."""
+    client = novaclient.OpenStack(zone.username, zone.password, zone.api_url)
+    return client.zones.info()._info
+
+
+def _poll_zone(zone):
+    """Eventlet worker to poll a zone."""
+    logging.debug(_("Polling zone: %s") % zone.api_url)
+    try:
+        zone.update_metadata(_call_novaclient(zone))
+    except Exception, e:
+        zone.log_error(traceback.format_exc())
+
+
+class ZoneManager(object):
+    """Keeps the zone states updated."""
+    def __init__(self):
+        self.last_zone_db_check = datetime.min
+        self.zone_states = {}
+        self.green_pool = greenpool.GreenPool()
+
+    def get_zone_list(self):
+        """Return the list of zones we know about."""
+        return [zone.to_dict() for zone in self.zone_states.values()]
+
+    def _refresh_from_db(self, context):
+        """Make our zone state map match the db."""
+        # Add/update existing zones ...
+        zones = db.zone_get_all(context)
+        existing = self.zone_states.keys()
+        db_keys = []
+        for zone in zones:
+            db_keys.append(zone.id)
+            if zone.id not in existing:
+                self.zone_states[zone.id] = ZoneState()
+            self.zone_states[zone.id].update_credentials(zone)
+
+        # Cleanup zones removed from db ...
+        keys = self.zone_states.keys()  # since we're deleting
+        for zone_id in keys:
+            if zone_id not in db_keys:
+                del self.zone_states[zone_id]
+
+    def _poll_zones(self, context):
+        """Try to connect to each child zone and get update."""
+        self.green_pool.imap(_poll_zone, self.zone_states.values())
+
+    def ping(self, context=None):
+        """Ping should be called periodically to update zone status."""
+        diff = datetime.now() - self.last_zone_db_check
+        if diff.seconds >= FLAGS.zone_db_check_interval:
+            logging.debug(_("Updating zone cache from db."))
+            self.last_zone_db_check = datetime.now()
+            self._refresh_from_db(context)
+        self._poll_zones(context)
diff --git a/nova/service.py b/nova/service.py
index 59648adf2..d60df987c 100644
--- a/nova/service.py
+++ b/nova/service.py
@@ -2,6 +2,7 @@
 
 # Copyright 2010 United States Government as represented by the
 # Administrator of the National Aeronautics and Space Administration.
+# Copyright 2011 Justin Santa Barbara
 # All Rights Reserved.
 #
 #    Licensed under the Apache License, Version 2.0 (the "License"); you may
@@ -39,24 +40,24 @@ from nova import flags
 from nova import rpc
 from nova import utils
 from nova import version
+from nova import wsgi
 
 
 FLAGS = flags.FLAGS
 flags.DEFINE_integer('report_interval', 10,
                      'seconds between nodes reporting state to datastore',
                      lower_bound=1)
-
 flags.DEFINE_integer('periodic_interval', 60,
                      'seconds between running periodic tasks',
                      lower_bound=1)
-
-flags.DEFINE_string('pidfile', None,
-                    'pidfile to use for this service')
-
-
-flags.DEFINE_flag(flags.HelpFlag())
-flags.DEFINE_flag(flags.HelpshortFlag())
-flags.DEFINE_flag(flags.HelpXMLFlag())
+flags.DEFINE_string('ec2_listen', "0.0.0.0",
+                    'IP address for EC2 API to listen')
+flags.DEFINE_integer('ec2_listen_port', 8773, 'port for ec2 api to listen')
+flags.DEFINE_string('osapi_listen', "0.0.0.0",
+                    'IP address for OpenStack API to listen')
+flags.DEFINE_integer('osapi_listen_port', 8774, 'port for os api to listen')
+flags.DEFINE_string('api_paste_config', "api-paste.ini",
+                    'File name for the paste.deploy config for nova-api')
 
 
 class Service(object):
@@ -68,6 +69,8 @@ class Service(object):
         self.binary = binary
         self.topic = topic
         self.manager_class_name = manager
+        manager_class = utils.import_class(self.manager_class_name)
+        self.manager = manager_class(host=self.host, *args, **kwargs)
         self.report_interval = report_interval
         self.periodic_interval = periodic_interval
         super(Service, self).__init__(*args, **kwargs)
@@ -75,9 +78,9 @@ class Service(object):
         self.timers = []
 
     def start(self):
-        manager_class = utils.import_class(self.manager_class_name)
-        self.manager = manager_class(host=self.host, *self.saved_args,
-                                                     **self.saved_kwargs)
+        vcs_string = version.version_string_with_vcs()
+        logging.audit(_("Starting %(topic)s node (version %(vcs_string)s)"),
+                      {'topic': self.topic, 'vcs_string': vcs_string})
         self.manager.init_host()
         self.model_disconnected = False
         ctxt = context.get_admin_context()
@@ -89,6 +92,9 @@ class Service(object):
         except exception.NotFound:
             self._create_service_ref(ctxt)
 
+        if 'nova-compute' == self.binary:
+            self.manager.update_available_resource(ctxt)
+
         conn1 = rpc.Connection.instance(new=True)
         conn2 = rpc.Connection.instance(new=True)
         if self.report_interval:
@@ -157,9 +163,6 @@ class Service(object):
             report_interval = FLAGS.report_interval
         if not periodic_interval:
             periodic_interval = FLAGS.periodic_interval
-        vcs_string = version.version_string_with_vcs()
-        logging.audit(_("Starting %(topic)s node (version %(vcs_string)s)")
-                % locals())
         service_obj = cls(host, binary, topic, manager,
                           report_interval, periodic_interval)
 
@@ -181,6 +184,13 @@ class Service(object):
                 pass
         self.timers = []
 
+    def wait(self):
+        for x in self.timers:
+            try:
+                x.wait()
+            except Exception:
+                pass
+
     def periodic_tasks(self):
         """Tasks to be run at a periodic interval"""
         self.manager.periodic_tasks(context.get_admin_context())
@@ -213,12 +223,55 @@ class Service(object):
                 logging.exception(_("model server went away"))
 
 
-def serve(*services):
-    FLAGS(sys.argv)
-    logging.basicConfig()
+class WsgiService(object):
+    """Base class for WSGI based services.
+
+    For each api you define, you must also define these flags:
+    :<api>_listen:            The address on which to listen
+    :<api>_listen_port:       The port on which to listen
+    """
 
-    if not services:
-        services = [Service.create()]
+    def __init__(self, conf, apis):
+        self.conf = conf
+        self.apis = apis
+        self.wsgi_app = None
+
+    def start(self):
+        self.wsgi_app = _run_wsgi(self.conf, self.apis)
+
+    def wait(self):
+        self.wsgi_app.wait()
+
+
+class ApiService(WsgiService):
+    """Class for our nova-api service"""
+    @classmethod
+    def create(cls, conf=None):
+        if not conf:
+            conf = wsgi.paste_config_file(FLAGS.api_paste_config)
+            if not conf:
+                message = (_("No paste configuration found for: %s"),
+                           FLAGS.api_paste_config)
+                raise exception.Error(message)
+        api_endpoints = ['ec2', 'osapi']
+        service = cls(conf, api_endpoints)
+        return service
+
+
+def serve(*services):
+    try:
+        if not services:
+            services = [Service.create()]
+    except Exception:
+        logging.exception('in Service.create()')
+        raise
+    finally:
+        # After we've loaded up all our dynamic bits, check
+        # whether we should print help
+        flags.DEFINE_flag(flags.HelpFlag())
+        flags.DEFINE_flag(flags.HelpshortFlag())
+        flags.DEFINE_flag(flags.HelpXMLFlag())
+        FLAGS.ParseNewFlags()
 
     name = '_'.join(x.binary for x in services)
     logging.debug(_("Serving %s"), name)
@@ -234,3 +287,46 @@ def serve(*services):
 def wait():
     while True:
         greenthread.sleep(5)
+
+
+def serve_wsgi(cls, conf=None):
+    try:
+        service = cls.create(conf)
+    except Exception:
+        logging.exception('in WsgiService.create()')
+        raise
+    finally:
+        # After we've loaded up all our dynamic bits, check
+        # whether we should print help
+        flags.DEFINE_flag(flags.HelpFlag())
+        flags.DEFINE_flag(flags.HelpshortFlag())
+        flags.DEFINE_flag(flags.HelpXMLFlag())
+        FLAGS.ParseNewFlags()
+
+    service.start()
+
+    return service
+
+
+def _run_wsgi(paste_config_file, apis):
+    logging.debug(_("Using paste.deploy config at: %s"), paste_config_file)
+    apps = []
+    for api in apis:
+        config = wsgi.load_paste_configuration(paste_config_file, api)
+        if config is None:
+            logging.debug(_("No paste configuration for app: %s"), api)
+            continue
+        logging.debug(_("App Config: %(api)s\n%(config)r") % locals())
+        logging.info(_("Running %s API"), api)
+        app = wsgi.load_paste_app(paste_config_file, api)
+        apps.append((app, getattr(FLAGS, "%s_listen_port" % api),
+                     getattr(FLAGS, "%s_listen" % api)))
+    if len(apps) == 0:
+        logging.error(_("No known API applications configured in %s."),
+                      paste_config_file)
+        return
+
+    server = wsgi.Server()
+    for app in apps:
+        server.start(*app)
+    return server
diff --git a/nova/test.py b/nova/test.py
index a12cf9d32..d8a47464f 100644
--- a/nova/test.py
+++ b/nova/test.py
@@ -22,10 +22,15 @@ Allows overriding of flags for use of fakes,
 and some black magic for inline callbacks.
 """
 
+
 import datetime
+import os
+import shutil
+import uuid
 import unittest
 
 import mox
+import shutil
 import stubout
 
 from nova import context
@@ -33,13 +38,12 @@ from nova import db
 from nova import fakerabbit
 from nova import flags
 from nova import rpc
-from nova.network import manager as network_manager
-from nova.tests import fake_flags
+from nova import service
 
 
 FLAGS = flags.FLAGS
-flags.DEFINE_bool('flush_db', True,
-                  'Flush the database before running fake tests')
+flags.DEFINE_string('sqlite_clean_db', 'clean.sqlite',
+                    'File name of clean sqlite db')
 flags.DEFINE_bool('fake_tests', True,
                   'should we use everything for testing')
 
@@ -64,15 +68,8 @@ class TestCase(unittest.TestCase):
         #             now that we have some required db setup for the system
         #             to work properly.
         self.start = datetime.datetime.utcnow()
-        ctxt = context.get_admin_context()
-        if db.network_count(ctxt) != 5:
-            network_manager.VlanManager().create_networks(ctxt,
-                                                          FLAGS.fixed_range,
-                                                          5, 16,
-                                                          FLAGS.fixed_range_v6,
-                                                          FLAGS.vlan_start,
-                                                          FLAGS.vpn_start,
-                                                          )
+        shutil.copyfile(os.path.join(FLAGS.state_path, FLAGS.sqlite_clean_db),
+                        os.path.join(FLAGS.state_path, FLAGS.sqlite_db))
 
         # emulate some of the mox stuff, we can't use the metaclass
         # because it screws with our generators
@@ -80,6 +77,7 @@ class TestCase(unittest.TestCase):
         self.stubs = stubout.StubOutForTesting()
         self.flag_overrides = {}
         self.injected = []
+        self._services = []
         self._monkey_patch_attach()
         self._original_flags = FLAGS.FlagValuesDict()
 
@@ -91,25 +89,31 @@ class TestCase(unittest.TestCase):
             self.stubs.UnsetAll()
             self.stubs.SmartUnsetAll()
             self.mox.VerifyAll()
-            # NOTE(vish): Clean up any ips associated during the test.
-            ctxt = context.get_admin_context()
-            db.fixed_ip_disassociate_all_by_timeout(ctxt, FLAGS.host,
-                                                    self.start)
-            db.network_disassociate_all(ctxt)
+            super(TestCase, self).tearDown()
+        finally:
+            # Clean out fake_rabbit's queue if we used it
+            if FLAGS.fake_rabbit:
+                fakerabbit.reset_all()
+
+            # Reset any overriden flags
+            self.reset_flags()
+
+            # Reset our monkey-patches
             rpc.Consumer.attach_to_eventlet = self.originalAttach
+
+            # Stop any timers
             for x in self.injected:
                 try:
                     x.stop()
                 except AssertionError:
                     pass
 
-            if FLAGS.fake_rabbit:
-                fakerabbit.reset_all()
-
-            db.security_group_destroy_all(ctxt)
-            super(TestCase, self).tearDown()
-        finally:
-            self.reset_flags()
+            # Kill any services
+            for x in self._services:
+                try:
+                    x.kill()
+                except Exception:
+                    pass
 
     def flags(self, **kw):
         """Override flag variables for a test"""
@@ -127,6 +131,15 @@ class TestCase(unittest.TestCase):
         for k, v in self._original_flags.iteritems():
             setattr(FLAGS, k, v)
 
+    def start_service(self, name, host=None, **kwargs):
+        host = host and host or uuid.uuid4().hex
+        kwargs.setdefault('host', host)
+        kwargs.setdefault('binary', 'nova-%s' % name)
+        svc = service.Service.create(**kwargs)
+        svc.start()
+        self._services.append(svc)
+        return svc
+
     def _monkey_patch_attach(self):
         self.originalAttach = rpc.Consumer.attach_to_eventlet
 
diff --git a/nova/tests/__init__.py b/nova/tests/__init__.py
index 592d5bea9..7fba02a93 100644
--- a/nova/tests/__init__.py
+++ b/nova/tests/__init__.py
@@ -37,5 +37,30 @@ setattr(__builtin__, '_', lambda x: x)
 
 
 def setup():
+    import os
+    import shutil
+
+    from nova import context
+    from nova import flags
     from nova.db import migration
+    from nova.network import manager as network_manager
+    from nova.tests import fake_flags
+
+    FLAGS = flags.FLAGS
+
+    testdb = os.path.join(FLAGS.state_path, FLAGS.sqlite_db)
+    if os.path.exists(testdb):
+        os.unlink(testdb)
     migration.db_sync()
+    ctxt = context.get_admin_context()
+    network_manager.VlanManager().create_networks(ctxt,
+                                                  FLAGS.fixed_range,
+                                                  FLAGS.num_networks,
+                                                  FLAGS.network_size,
+                                                  FLAGS.fixed_range_v6,
+                                                  FLAGS.vlan_start,
+                                                  FLAGS.vpn_start,
+                                                  )
+
+    cleandb = os.path.join(FLAGS.state_path, FLAGS.sqlite_clean_db)
+    shutil.copyfile(testdb, cleandb)
diff --git a/nova/tests/api/openstack/__init__.py b/nova/tests/api/openstack/__init__.py
index 77b1dd37f..e18120285 100644
--- a/nova/tests/api/openstack/__init__.py
+++ b/nova/tests/api/openstack/__init__.py
@@ -16,7 +16,7 @@
 #    under the License.
 
 import webob.dec
-import unittest
+from nova import test
 
 from nova import context
 from nova import flags
@@ -33,7 +33,7 @@ def simple_wsgi(req):
     return ""
 
 
-class RateLimitingMiddlewareTest(unittest.TestCase):
+class RateLimitingMiddlewareTest(test.TestCase):
 
     def test_get_action_name(self):
         middleware = RateLimitingMiddleware(simple_wsgi)
diff --git a/nova/tests/api/openstack/common.py b/nova/tests/api/openstack/common.py
new file mode 100644
index 000000000..74bb8729a
--- /dev/null
+++ b/nova/tests/api/openstack/common.py
@@ -0,0 +1,36 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import json
+
+import webob
+
+
+def webob_factory(url):
+    """Factory for removing duplicate webob code from tests"""
+
+    base_url = url
+
+    def web_request(url, method=None, body=None):
+        req = webob.Request.blank("%s%s" % (base_url, url))
+        if method:
+            req.content_type = "application/json"
+            req.method = method
+        if body:
+            req.body = json.dumps(body)
+        return req
+    return web_request
diff --git a/nova/tests/api/openstack/fakes.py b/nova/tests/api/openstack/fakes.py
index fb282f1c9..e50d11a3d 100644
--- a/nova/tests/api/openstack/fakes.py
+++ b/nova/tests/api/openstack/fakes.py
@@ -25,8 +25,8 @@ import webob.dec
 from paste import urlmap
 
 from glance import client as glance_client
+from glance.common import exception as glance_exc
 
-from nova import auth
 from nova import context
 from nova import exception as exc
 from nova import flags
@@ -35,6 +35,7 @@ import nova.api.openstack.auth
 from nova.api import openstack
 from nova.api.openstack import auth
 from nova.api.openstack import ratelimiting
+from nova.auth.manager import User, Project
 from nova.image import glance
 from nova.image import local
 from nova.image import service
@@ -149,25 +150,26 @@ def stub_out_glance(stubs, initial_fixtures=None):
             for f in self.fixtures:
                 if f['id'] == image_id:
                     return f
-            return None
+            raise glance_exc.NotFound
 
-        def fake_add_image(self, image_meta):
+        def fake_add_image(self, image_meta, data=None):
             id = ''.join(random.choice(string.letters) for _ in range(20))
             image_meta['id'] = id
             self.fixtures.append(image_meta)
-            return id
+            return image_meta
 
-        def fake_update_image(self, image_id, image_meta):
+        def fake_update_image(self, image_id, image_meta, data=None):
             f = self.fake_get_image_meta(image_id)
             if not f:
-                raise exc.NotFound
+                raise glance_exc.NotFound
 
             f.update(image_meta)
+            return f
 
         def fake_delete_image(self, image_id):
             f = self.fake_get_image_meta(image_id)
             if not f:
-                raise exc.NotFound
+                raise glance_exc.NotFound
 
             self.fixtures.remove(f)
 
@@ -188,7 +190,11 @@ def stub_out_glance(stubs, initial_fixtures=None):
 
 
 class FakeToken(object):
+    id = 0
+
     def __init__(self, **kwargs):
+        FakeToken.id += 1
+        self.id = FakeToken.id
         for k, v in kwargs.iteritems():
             setattr(self, k, v)
 
@@ -203,36 +209,117 @@ class FakeAuthDatabase(object):
     data = {}
 
     @staticmethod
-    def auth_get_token(context, token_hash):
+    def auth_token_get(context, token_hash):
         return FakeAuthDatabase.data.get(token_hash, None)
 
     @staticmethod
-    def auth_create_token(context, token):
+    def auth_token_create(context, token):
         fake_token = FakeToken(created_at=datetime.datetime.now(), **token)
         FakeAuthDatabase.data[fake_token.token_hash] = fake_token
+        FakeAuthDatabase.data['id_%i' % fake_token.id] = fake_token
         return fake_token
 
     @staticmethod
-    def auth_destroy_token(context, token):
-        if token.token_hash in FakeAuthDatabase.data:
-            del FakeAuthDatabase.data['token_hash']
+    def auth_token_destroy(context, token_id):
+        token = FakeAuthDatabase.data.get('id_%i' % token_id)
+        if token and token.token_hash in FakeAuthDatabase.data:
+            del FakeAuthDatabase.data[token.token_hash]
+            del FakeAuthDatabase.data['id_%i' % token_id]
 
 
 class FakeAuthManager(object):
     auth_data = {}
+    projects = {}
+
+    @classmethod
+    def clear_fakes(cls):
+        cls.auth_data = {}
+        cls.projects = {}
+
+    @classmethod
+    def reset_fake_data(cls):
+        cls.auth_data = dict(acc1=User('guy1', 'guy1', 'acc1',
+                                       'fortytwo!', False))
+        cls.projects = dict(testacct=Project('testacct',
+                                             'testacct',
+                                             'guy1',
+                                             'test',
+                                              []))
 
     def add_user(self, key, user):
         FakeAuthManager.auth_data[key] = user
 
+    def get_users(self):
+        return FakeAuthManager.auth_data.values()
+
     def get_user(self, uid):
         for k, v in FakeAuthManager.auth_data.iteritems():
             if v.id == uid:
                 return v
         return None
 
-    def get_project(self, pid):
+    def delete_user(self, uid):
+        for k, v in FakeAuthManager.auth_data.items():
+            if v.id == uid:
+                del FakeAuthManager.auth_data[k]
         return None
 
+    def create_user(self, name, access=None, secret=None, admin=False):
+        u = User(name, name, access, secret, admin)
+        FakeAuthManager.auth_data[access] = u
+        return u
+
+    def modify_user(self, user_id, access=None, secret=None, admin=None):
+        user = None
+        for k, v in FakeAuthManager.auth_data.iteritems():
+            if v.id == user_id:
+                user = v
+        if user:
+            user.access = access
+            user.secret = secret
+            if admin is not None:
+                user.admin = admin
+
+    def is_admin(self, user):
+        return user.admin
+
+    def is_project_member(self, user, project):
+        return ((user.id in project.member_ids) or
+                (user.id == project.project_manager_id))
+
+    def create_project(self, name, manager_user, description=None,
+                       member_users=None):
+        member_ids = [User.safe_id(m) for m in member_users] \
+                     if member_users else []
+        p = Project(name, name, User.safe_id(manager_user),
+                                 description, member_ids)
+        FakeAuthManager.projects[name] = p
+        return p
+
+    def delete_project(self, pid):
+        if pid in FakeAuthManager.projects:
+            del FakeAuthManager.projects[pid]
+
+    def modify_project(self, project, manager_user=None, description=None):
+        p = FakeAuthManager.projects.get(project)
+        p.project_manager_id = User.safe_id(manager_user)
+        p.description = description
+
+    def get_project(self, pid):
+        p = FakeAuthManager.projects.get(pid)
+        if p:
+            return p
+        else:
+            raise exc.NotFound
+
+    def get_projects(self, user=None):
+        if not user:
+            return FakeAuthManager.projects.values()
+        else:
+            return [p for p in FakeAuthManager.projects.values()
+                    if (user.id in p.member_ids) or
+                       (user.id == p.project_manager_id)]
+
     def get_user_from_access_key(self, key):
         return FakeAuthManager.auth_data.get(key, None)
 
diff --git a/nova/tests/api/openstack/test_accounts.py b/nova/tests/api/openstack/test_accounts.py
new file mode 100644
index 000000000..60edce769
--- /dev/null
+++ b/nova/tests/api/openstack/test_accounts.py
@@ -0,0 +1,125 @@
+# Copyright 2010 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+
+import json
+
+import stubout
+import webob
+
+import nova.api
+import nova.api.openstack.auth
+from nova import context
+from nova import flags
+from nova import test
+from nova.auth.manager import User
+from nova.tests.api.openstack import fakes
+
+
+FLAGS = flags.FLAGS
+FLAGS.verbose = True
+
+
+def fake_init(self):
+    self.manager = fakes.FakeAuthManager()
+
+
+def fake_admin_check(self, req):
+    return True
+
+
+class AccountsTest(test.TestCase):
+    def setUp(self):
+        super(AccountsTest, self).setUp()
+        self.stubs = stubout.StubOutForTesting()
+        self.stubs.Set(nova.api.openstack.accounts.Controller, '__init__',
+                       fake_init)
+        self.stubs.Set(nova.api.openstack.accounts.Controller, '_check_admin',
+                       fake_admin_check)
+        fakes.FakeAuthManager.clear_fakes()
+        fakes.FakeAuthDatabase.data = {}
+        fakes.stub_out_networking(self.stubs)
+        fakes.stub_out_rate_limiting(self.stubs)
+        fakes.stub_out_auth(self.stubs)
+
+        self.allow_admin = FLAGS.allow_admin_api
+        FLAGS.allow_admin_api = True
+        fakemgr = fakes.FakeAuthManager()
+        joeuser = User('guy1', 'guy1', 'acc1', 'fortytwo!', False)
+        superuser = User('guy2', 'guy2', 'acc2', 'swordfish', True)
+        fakemgr.add_user(joeuser.access, joeuser)
+        fakemgr.add_user(superuser.access, superuser)
+        fakemgr.create_project('test1', joeuser)
+        fakemgr.create_project('test2', superuser)
+
+    def tearDown(self):
+        self.stubs.UnsetAll()
+        FLAGS.allow_admin_api = self.allow_admin
+        super(AccountsTest, self).tearDown()
+
+    def test_get_account(self):
+        req = webob.Request.blank('/v1.0/accounts/test1')
+        res = req.get_response(fakes.wsgi_app())
+        res_dict = json.loads(res.body)
+
+        self.assertEqual(res_dict['account']['id'], 'test1')
+        self.assertEqual(res_dict['account']['name'], 'test1')
+        self.assertEqual(res_dict['account']['manager'], 'guy1')
+        self.assertEqual(res.status_int, 200)
+
+    def test_account_delete(self):
+        req = webob.Request.blank('/v1.0/accounts/test1')
+        req.method = 'DELETE'
+        res = req.get_response(fakes.wsgi_app())
+        self.assertTrue('test1' not in fakes.FakeAuthManager.projects)
+        self.assertEqual(res.status_int, 200)
+
+    def test_account_create(self):
+        body = dict(account=dict(description='test account',
+                              manager='guy1'))
+        req = webob.Request.blank('/v1.0/accounts/newacct')
+        req.headers["Content-Type"] = "application/json"
+        req.method = 'PUT'
+        req.body = json.dumps(body)
+
+        res = req.get_response(fakes.wsgi_app())
+        res_dict = json.loads(res.body)
+
+        self.assertEqual(res.status_int, 200)
+        self.assertEqual(res_dict['account']['id'], 'newacct')
+        self.assertEqual(res_dict['account']['name'], 'newacct')
+        self.assertEqual(res_dict['account']['description'], 'test account')
+        self.assertEqual(res_dict['account']['manager'], 'guy1')
+        self.assertTrue('newacct' in
+                        fakes.FakeAuthManager.projects)
+        self.assertEqual(len(fakes.FakeAuthManager.projects.values()), 3)
+
+    def test_account_update(self):
+        body = dict(account=dict(description='test account',
+                              manager='guy2'))
+        req = webob.Request.blank('/v1.0/accounts/test1')
+        req.headers["Content-Type"] = "application/json"
+        req.method = 'PUT'
+        req.body = json.dumps(body)
+
+        res = req.get_response(fakes.wsgi_app())
+        res_dict = json.loads(res.body)
+
+        self.assertEqual(res.status_int, 200)
+        self.assertEqual(res_dict['account']['id'], 'test1')
+        self.assertEqual(res_dict['account']['name'], 'test1')
+        self.assertEqual(res_dict['account']['description'], 'test account')
+        self.assertEqual(res_dict['account']['manager'], 'guy2')
+        self.assertEqual(len(fakes.FakeAuthManager.projects.values()), 2)
diff --git a/nova/tests/api/openstack/test_adminapi.py b/nova/tests/api/openstack/test_adminapi.py
index 73120c31d..4568cb9f5 100644
--- a/nova/tests/api/openstack/test_adminapi.py
+++ b/nova/tests/api/openstack/test_adminapi.py
@@ -15,13 +15,13 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import unittest
 
 import stubout
 import webob
 from paste import urlmap
 
 from nova import flags
+from nova import test
 from nova.api import openstack
 from nova.api.openstack import ratelimiting
 from nova.api.openstack import auth
@@ -30,11 +30,12 @@ from nova.tests.api.openstack import fakes
 FLAGS = flags.FLAGS
 
 
-class AdminAPITest(unittest.TestCase):
+class AdminAPITest(test.TestCase):
 
     def setUp(self):
+        super(AdminAPITest, self).setUp()
         self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.auth_data = {}
+        fakes.FakeAuthManager.reset_fake_data()
         fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
@@ -44,6 +45,7 @@ class AdminAPITest(unittest.TestCase):
     def tearDown(self):
         self.stubs.UnsetAll()
         FLAGS.allow_admin_api = self.allow_admin
+        super(AdminAPITest, self).tearDown()
 
     def test_admin_enabled(self):
         FLAGS.allow_admin_api = True
@@ -58,8 +60,5 @@ class AdminAPITest(unittest.TestCase):
         # We should still be able to access public operations.
         req = webob.Request.blank('/v1.0/flavors')
         res = req.get_response(fakes.wsgi_app())
-        self.assertEqual(res.status_int, 200)
         # TODO: Confirm admin operations are unavailable.
-
-if __name__ == '__main__':
-    unittest.main()
+        self.assertEqual(res.status_int, 200)
diff --git a/nova/tests/api/openstack/test_api.py b/nova/tests/api/openstack/test_api.py
index db0fe1060..5112c486f 100644
--- a/nova/tests/api/openstack/test_api.py
+++ b/nova/tests/api/openstack/test_api.py
@@ -15,17 +15,17 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import unittest
 import webob.exc
 import webob.dec
 
 from webob import Request
 
+from nova import test
 from nova.api import openstack
 from nova.api.openstack import faults
 
 
-class APITest(unittest.TestCase):
+class APITest(test.TestCase):
 
     def _wsgi_app(self, inner_app):
         # simpler version of the app than fakes.wsgi_app
diff --git a/nova/tests/api/openstack/test_auth.py b/nova/tests/api/openstack/test_auth.py
index 0dd65d321..aaaa4e415 100644
--- a/nova/tests/api/openstack/test_auth.py
+++ b/nova/tests/api/openstack/test_auth.py
@@ -16,7 +16,6 @@
 #    under the License.
 
 import datetime
-import unittest
 
 import stubout
 import webob
@@ -27,12 +26,15 @@ import nova.api.openstack.auth
 import nova.auth.manager
 from nova import auth
 from nova import context
+from nova import db
+from nova import test
 from nova.tests.api.openstack import fakes
 
 
-class Test(unittest.TestCase):
+class Test(test.TestCase):
 
     def setUp(self):
+        super(Test, self).setUp()
         self.stubs = stubout.StubOutForTesting()
         self.stubs.Set(nova.api.openstack.auth.AuthMiddleware,
             '__init__', fakes.fake_auth_init)
@@ -45,6 +47,7 @@ class Test(unittest.TestCase):
     def tearDown(self):
         self.stubs.UnsetAll()
         fakes.fake_data_store = {}
+        super(Test, self).tearDown()
 
     def test_authorize_user(self):
         f = fakes.FakeAuthManager()
@@ -62,7 +65,9 @@ class Test(unittest.TestCase):
 
     def test_authorize_token(self):
         f = fakes.FakeAuthManager()
-        f.add_user('derp', nova.auth.manager.User(1, 'herp', None, None, None))
+        u = nova.auth.manager.User(1, 'herp', None, None, None)
+        f.add_user('derp', u)
+        f.create_project('test', u)
 
         req = webob.Request.blank('/v1.0/', {'HTTP_HOST': 'foo'})
         req.headers['X-Auth-User'] = 'herp'
@@ -97,10 +102,10 @@ class Test(unittest.TestCase):
                     token_hash=token_hash,
                     created_at=datetime.datetime(1990, 1, 1))
 
-        self.stubs.Set(fakes.FakeAuthDatabase, 'auth_destroy_token',
+        self.stubs.Set(fakes.FakeAuthDatabase, 'auth_token_destroy',
             destroy_token_mock)
 
-        self.stubs.Set(fakes.FakeAuthDatabase, 'auth_get_token',
+        self.stubs.Set(fakes.FakeAuthDatabase, 'auth_token_get',
             bad_token)
 
         req = webob.Request.blank('/v1.0/')
@@ -128,8 +133,36 @@ class Test(unittest.TestCase):
         self.assertEqual(result.status, '401 Unauthorized')
 
 
-class TestLimiter(unittest.TestCase):
+class TestFunctional(test.TestCase):
+    def test_token_expiry(self):
+        ctx = context.get_admin_context()
+        tok = db.auth_token_create(ctx, dict(
+                token_hash='bacon',
+                cdn_management_url='',
+                server_management_url='',
+                storage_url='',
+                user_id='ham',
+                ))
+
+        db.auth_token_update(ctx, tok.token_hash, dict(
+                created_at=datetime.datetime(2000, 1, 1, 12, 0, 0),
+                ))
+
+        req = webob.Request.blank('/v1.0/')
+        req.headers['X-Auth-Token'] = 'bacon'
+        result = req.get_response(fakes.wsgi_app())
+        self.assertEqual(result.status, '401 Unauthorized')
+
+    def test_token_doesnotexist(self):
+        req = webob.Request.blank('/v1.0/')
+        req.headers['X-Auth-Token'] = 'ham'
+        result = req.get_response(fakes.wsgi_app())
+        self.assertEqual(result.status, '401 Unauthorized')
+
+
+class TestLimiter(test.TestCase):
     def setUp(self):
+        super(TestLimiter, self).setUp()
         self.stubs = stubout.StubOutForTesting()
         self.stubs.Set(nova.api.openstack.auth.AuthMiddleware,
             '__init__', fakes.fake_auth_init)
@@ -141,10 +174,13 @@ class TestLimiter(unittest.TestCase):
     def tearDown(self):
         self.stubs.UnsetAll()
         fakes.fake_data_store = {}
+        super(TestLimiter, self).tearDown()
 
     def test_authorize_token(self):
         f = fakes.FakeAuthManager()
-        f.add_user('derp', nova.auth.manager.User(1, 'herp', None, None, None))
+        u = nova.auth.manager.User(1, 'herp', None, None, None)
+        f.add_user('derp', u)
+        f.create_project('test', u)
 
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-User'] = 'herp'
@@ -161,7 +197,3 @@ class TestLimiter(unittest.TestCase):
         result = req.get_response(fakes.wsgi_app())
         self.assertEqual(result.status, '200 OK')
         self.assertEqual(result.headers['X-Test-Success'], 'True')
-
-
-if __name__ == '__main__':
-    unittest.main()
diff --git a/nova/tests/api/openstack/test_common.py b/nova/tests/api/openstack/test_common.py
index 9d9837cc9..8f57c5b67 100644
--- a/nova/tests/api/openstack/test_common.py
+++ b/nova/tests/api/openstack/test_common.py
@@ -19,14 +19,15 @@
 Test suites for 'common' code used throughout the OpenStack HTTP API.
 """
 
-import unittest
+import webob.exc
 
 from webob import Request
 
+from nova import test
 from nova.api.openstack.common import limited
 
 
-class LimiterTest(unittest.TestCase):
+class LimiterTest(test.TestCase):
     """
     Unit tests for the `nova.api.openstack.common.limited` method which takes
     in a list of items and, depending on the 'offset' and 'limit' GET params,
@@ -37,6 +38,7 @@ class LimiterTest(unittest.TestCase):
         """
         Run before each test.
         """
+        super(LimiterTest, self).setUp()
         self.tiny = range(1)
         self.small = range(10)
         self.medium = range(1000)
@@ -77,20 +79,14 @@ class LimiterTest(unittest.TestCase):
         Test offset key works with a blank offset.
         """
         req = Request.blank('/?offset=')
-        self.assertEqual(limited(self.tiny, req), self.tiny)
-        self.assertEqual(limited(self.small, req), self.small)
-        self.assertEqual(limited(self.medium, req), self.medium)
-        self.assertEqual(limited(self.large, req), self.large[:1000])
+        self.assertRaises(webob.exc.HTTPBadRequest, limited, self.tiny, req)
 
     def test_limiter_offset_bad(self):
         """
         Test offset key works with a BAD offset.
         """
         req = Request.blank(u'/?offset=\u0020aa')
-        self.assertEqual(limited(self.tiny, req), self.tiny)
-        self.assertEqual(limited(self.small, req), self.small)
-        self.assertEqual(limited(self.medium, req), self.medium)
-        self.assertEqual(limited(self.large, req), self.large[:1000])
+        self.assertRaises(webob.exc.HTTPBadRequest, limited, self.tiny, req)
 
     def test_limiter_nothing(self):
         """
@@ -159,3 +155,17 @@ class LimiterTest(unittest.TestCase):
         self.assertEqual(limited(items, req, max_limit=2000), items[3:])
         req = Request.blank('/?offset=3000&limit=10')
         self.assertEqual(limited(items, req, max_limit=2000), [])
+
+    def test_limiter_negative_limit(self):
+        """
+        Test a negative limit.
+        """
+        req = Request.blank('/?limit=-3000')
+        self.assertRaises(webob.exc.HTTPBadRequest, limited, self.tiny, req)
+
+    def test_limiter_negative_offset(self):
+        """
+        Test a negative offset.
+        """
+        req = Request.blank('/?offset=-30')
+        self.assertRaises(webob.exc.HTTPBadRequest, limited, self.tiny, req)
diff --git a/nova/tests/api/openstack/test_faults.py b/nova/tests/api/openstack/test_faults.py
index fda2b5ede..7667753f4 100644
--- a/nova/tests/api/openstack/test_faults.py
+++ b/nova/tests/api/openstack/test_faults.py
@@ -15,15 +15,15 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import unittest
 import webob
 import webob.dec
 import webob.exc
 
+from nova import test
 from nova.api.openstack import faults
 
 
-class TestFaults(unittest.TestCase):
+class TestFaults(test.TestCase):
 
     def test_fault_parts(self):
         req = webob.Request.blank('/.xml')
diff --git a/nova/tests/api/openstack/test_flavors.py b/nova/tests/api/openstack/test_flavors.py
index 1bdaea161..8280a505f 100644
--- a/nova/tests/api/openstack/test_flavors.py
+++ b/nova/tests/api/openstack/test_flavors.py
@@ -15,34 +15,38 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import unittest
-
 import stubout
 import webob
 
+from nova import test
 import nova.api
+from nova import context
+from nova import db
 from nova.api.openstack import flavors
 from nova.tests.api.openstack import fakes
 
 
-class FlavorsTest(unittest.TestCase):
+class FlavorsTest(test.TestCase):
     def setUp(self):
+        super(FlavorsTest, self).setUp()
         self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.auth_data = {}
+        fakes.FakeAuthManager.reset_fake_data()
         fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
         fakes.stub_out_auth(self.stubs)
+        self.context = context.get_admin_context()
 
     def tearDown(self):
         self.stubs.UnsetAll()
+        super(FlavorsTest, self).tearDown()
 
     def test_get_flavor_list(self):
         req = webob.Request.blank('/v1.0/flavors')
         res = req.get_response(fakes.wsgi_app())
+        self.assertEqual(res.status_int, 200)
 
     def test_get_flavor_by_id(self):
-        pass
-
-if __name__ == '__main__':
-    unittest.main()
+        req = webob.Request.blank('/v1.0/flavors/1')
+        res = req.get_response(fakes.wsgi_app())
+        self.assertEqual(res.status_int, 200)
diff --git a/nova/tests/api/openstack/test_images.py b/nova/tests/api/openstack/test_images.py
index 8ab4d7569..76f758929 100644
--- a/nova/tests/api/openstack/test_images.py
+++ b/nova/tests/api/openstack/test_images.py
@@ -22,7 +22,8 @@ and as a WSGI layer
 
 import json
 import datetime
-import unittest
+import shutil
+import tempfile
 
 import stubout
 import webob
@@ -30,6 +31,7 @@ import webob
 from nova import context
 from nova import exception
 from nova import flags
+from nova import test
 from nova import utils
 import nova.api.openstack
 from nova.api.openstack import images
@@ -54,7 +56,7 @@ class BaseImageServiceTests(object):
 
         num_images = len(self.service.index(self.context))
 
-        id = self.service.create(self.context, fixture)
+        id = self.service.create(self.context, fixture)['id']
 
         self.assertNotEquals(None, id)
         self.assertEquals(num_images + 1,
@@ -71,7 +73,7 @@ class BaseImageServiceTests(object):
 
         num_images = len(self.service.index(self.context))
 
-        id = self.service.create(self.context, fixture)
+        id = self.service.create(self.context, fixture)['id']
 
         self.assertNotEquals(None, id)
 
@@ -89,7 +91,7 @@ class BaseImageServiceTests(object):
                    'instance_id': None,
                    'progress': None}
 
-        id = self.service.create(self.context, fixture)
+        id = self.service.create(self.context, fixture)['id']
 
         fixture['status'] = 'in progress'
 
@@ -118,7 +120,7 @@ class BaseImageServiceTests(object):
 
         ids = []
         for fixture in fixtures:
-            new_id = self.service.create(self.context, fixture)
+            new_id = self.service.create(self.context, fixture)['id']
             ids.append(new_id)
 
         num_images = len(self.service.index(self.context))
@@ -130,29 +132,33 @@ class BaseImageServiceTests(object):
         self.assertEquals(1, num_images)
 
 
-class LocalImageServiceTest(unittest.TestCase,
+class LocalImageServiceTest(test.TestCase,
                             BaseImageServiceTests):
 
     """Tests the local image service"""
 
     def setUp(self):
+        super(LocalImageServiceTest, self).setUp()
+        self.tempdir = tempfile.mkdtemp()
+        self.flags(images_path=self.tempdir)
         self.stubs = stubout.StubOutForTesting()
         service_class = 'nova.image.local.LocalImageService'
         self.service = utils.import_object(service_class)
         self.context = context.RequestContext(None, None)
 
     def tearDown(self):
-        self.service.delete_all()
-        self.service.delete_imagedir()
+        shutil.rmtree(self.tempdir)
         self.stubs.UnsetAll()
+        super(LocalImageServiceTest, self).tearDown()
 
 
-class GlanceImageServiceTest(unittest.TestCase,
+class GlanceImageServiceTest(test.TestCase,
                              BaseImageServiceTests):
 
     """Tests the local image service"""
 
     def setUp(self):
+        super(GlanceImageServiceTest, self).setUp()
         self.stubs = stubout.StubOutForTesting()
         fakes.stub_out_glance(self.stubs)
         fakes.stub_out_compute_api_snapshot(self.stubs)
@@ -163,9 +169,10 @@ class GlanceImageServiceTest(unittest.TestCase,
 
     def tearDown(self):
         self.stubs.UnsetAll()
+        super(GlanceImageServiceTest, self).tearDown()
 
 
-class ImageControllerWithGlanceServiceTest(unittest.TestCase):
+class ImageControllerWithGlanceServiceTest(test.TestCase):
 
     """Test of the OpenStack API /images application controller"""
 
@@ -194,10 +201,11 @@ class ImageControllerWithGlanceServiceTest(unittest.TestCase):
          'image_type': 'ramdisk'}]
 
     def setUp(self):
+        super(ImageControllerWithGlanceServiceTest, self).setUp()
         self.orig_image_service = FLAGS.image_service
         FLAGS.image_service = 'nova.image.glance.GlanceImageService'
         self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.auth_data = {}
+        fakes.FakeAuthManager.reset_fake_data()
         fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
@@ -208,6 +216,7 @@ class ImageControllerWithGlanceServiceTest(unittest.TestCase):
     def tearDown(self):
         self.stubs.UnsetAll()
         FLAGS.image_service = self.orig_image_service
+        super(ImageControllerWithGlanceServiceTest, self).tearDown()
 
     def test_get_image_index(self):
         req = webob.Request.blank('/v1.0/images')
diff --git a/nova/tests/api/openstack/test_ratelimiting.py b/nova/tests/api/openstack/test_ratelimiting.py
index 4c9d6bc23..9ae90ee20 100644
--- a/nova/tests/api/openstack/test_ratelimiting.py
+++ b/nova/tests/api/openstack/test_ratelimiting.py
@@ -1,15 +1,16 @@
 import httplib
 import StringIO
 import time
-import unittest
 import webob
 
+from nova import test
 import nova.api.openstack.ratelimiting as ratelimiting
 
 
-class LimiterTest(unittest.TestCase):
+class LimiterTest(test.TestCase):
 
     def setUp(self):
+        super(LimiterTest, self).setUp()
         self.limits = {
                 'a': (5, ratelimiting.PER_SECOND),
                 'b': (5, ratelimiting.PER_MINUTE),
@@ -83,9 +84,10 @@ class FakeLimiter(object):
         return self._delay
 
 
-class WSGIAppTest(unittest.TestCase):
+class WSGIAppTest(test.TestCase):
 
     def setUp(self):
+        super(WSGIAppTest, self).setUp()
         self.limiter = FakeLimiter(self)
         self.app = ratelimiting.WSGIApp(self.limiter)
 
@@ -206,7 +208,7 @@ def wire_HTTPConnection_to_WSGI(host, app):
     httplib.HTTPConnection = HTTPConnectionDecorator(httplib.HTTPConnection)
 
 
-class WSGIAppProxyTest(unittest.TestCase):
+class WSGIAppProxyTest(test.TestCase):
 
     def setUp(self):
         """Our WSGIAppProxy is going to call across an HTTPConnection to a
@@ -218,6 +220,7 @@ class WSGIAppProxyTest(unittest.TestCase):
         at the WSGIApp.  And the limiter isn't real -- it's a fake that
         behaves the way we tell it to.
         """
+        super(WSGIAppProxyTest, self).setUp()
         self.limiter = FakeLimiter(self)
         app = ratelimiting.WSGIApp(self.limiter)
         wire_HTTPConnection_to_WSGI('100.100.100.100:80', app)
@@ -238,7 +241,3 @@ class WSGIAppProxyTest(unittest.TestCase):
             self.limiter.mock('murder', 'brutus', None)
             self.proxy.perform('stab', 'brutus')
         self.assertRaises(AssertionError, shouldRaise)
-
-
-if __name__ == '__main__':
-    unittest.main()
diff --git a/nova/tests/api/openstack/test_servers.py b/nova/tests/api/openstack/test_servers.py
index a7be0796e..5d7a208e9 100644
--- a/nova/tests/api/openstack/test_servers.py
+++ b/nova/tests/api/openstack/test_servers.py
@@ -1,6 +1,6 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
-# Copyright 2010 OpenStack LLC.
+# Copyright 2010-2011 OpenStack LLC.
 # All Rights Reserved.
 #
 #    Licensed under the Apache License, Version 2.0 (the "License"); you may
@@ -17,18 +17,21 @@
 
 import datetime
 import json
-import unittest
 
 import stubout
 import webob
 
 from nova import db
 from nova import flags
+from nova import test
 import nova.api.openstack
 from nova.api.openstack import servers
+import nova.compute.api
 import nova.db.api
 from nova.db.sqlalchemy.models import Instance
+from nova.db.sqlalchemy.models import InstanceMetadata
 import nova.rpc
+from nova.tests.api.openstack import common
 from nova.tests.api.openstack import fakes
 
 
@@ -64,6 +67,9 @@ def instance_address(context, instance_id):
 
 
 def stub_instance(id, user_id=1, private_address=None, public_addresses=None):
+    metadata = []
+    metadata.append(InstanceMetadata(key='seq', value=id))
+
     if public_addresses == None:
         public_addresses = list()
 
@@ -84,7 +90,7 @@ def stub_instance(id, user_id=1, private_address=None, public_addresses=None):
         "vcpus": 0,
         "local_gb": 0,
         "hostname": "",
-        "host": "",
+        "host": None,
         "instance_type": "",
         "user_data": "",
         "reservation_id": "",
@@ -95,7 +101,8 @@ def stub_instance(id, user_id=1, private_address=None, public_addresses=None):
         "availability_zone": "",
         "display_name": "server%s" % id,
         "display_description": "",
-        "locked": False}
+        "locked": False,
+        "metadata": metadata}
 
     instance["fixed_ip"] = {
         "address": private_address,
@@ -108,11 +115,12 @@ def fake_compute_api(cls, req, id):
     return True
 
 
-class ServersTest(unittest.TestCase):
+class ServersTest(test.TestCase):
 
     def setUp(self):
+        super(ServersTest, self).setUp()
         self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.auth_data = {}
+        fakes.FakeAuthManager.reset_fake_data()
         fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
@@ -138,9 +146,12 @@ class ServersTest(unittest.TestCase):
         self.stubs.Set(nova.compute.API, "get_actions", fake_compute_api)
         self.allow_admin = FLAGS.allow_admin_api
 
+        self.webreq = common.webob_factory('/v1.0/servers')
+
     def tearDown(self):
         self.stubs.UnsetAll()
         FLAGS.allow_admin_api = self.allow_admin
+        super(ServersTest, self).tearDown()
 
     def test_get_server_by_id(self):
         req = webob.Request.blank('/v1.0/servers/1')
@@ -177,9 +188,37 @@ class ServersTest(unittest.TestCase):
             self.assertEqual(s.get('imageId', None), None)
             i += 1
 
+    def test_get_servers_with_limit(self):
+        req = webob.Request.blank('/v1.0/servers?limit=3')
+        res = req.get_response(fakes.wsgi_app())
+        servers = json.loads(res.body)['servers']
+        self.assertEqual([s['id'] for s in servers], [0, 1, 2])
+
+        req = webob.Request.blank('/v1.0/servers?limit=aaa')
+        res = req.get_response(fakes.wsgi_app())
+        self.assertEqual(res.status_int, 400)
+        self.assertTrue('limit' in res.body)
+
+    def test_get_servers_with_offset(self):
+        req = webob.Request.blank('/v1.0/servers?offset=2')
+        res = req.get_response(fakes.wsgi_app())
+        servers = json.loads(res.body)['servers']
+        self.assertEqual([s['id'] for s in servers], [2, 3, 4])
+
+        req = webob.Request.blank('/v1.0/servers?offset=aaa')
+        res = req.get_response(fakes.wsgi_app())
+        self.assertEqual(res.status_int, 400)
+        self.assertTrue('offset' in res.body)
+
+    def test_get_servers_with_limit_and_offset(self):
+        req = webob.Request.blank('/v1.0/servers?limit=2&offset=1')
+        res = req.get_response(fakes.wsgi_app())
+        servers = json.loads(res.body)['servers']
+        self.assertEqual([s['id'] for s in servers], [1, 2])
+
     def test_create_instance(self):
         def instance_create(context, inst):
-            return {'id': '1', 'display_name': ''}
+            return {'id': '1', 'display_name': 'server_test'}
 
         def server_update(context, id, params):
             return instance_create(context, id)
@@ -214,14 +253,22 @@ class ServersTest(unittest.TestCase):
             "get_image_id_from_image_hash", image_id_from_hash)
 
         body = dict(server=dict(
-            name='server_test', imageId=2, flavorId=2, metadata={},
+            name='server_test', imageId=2, flavorId=2,
+            metadata={'hello': 'world', 'open': 'stack'},
             personality={}))
         req = webob.Request.blank('/v1.0/servers')
         req.method = 'POST'
         req.body = json.dumps(body)
+        req.headers["Content-Type"] = "application/json"
 
         res = req.get_response(fakes.wsgi_app())
 
+        server = json.loads(res.body)['server']
+        self.assertEqual('serv', server['adminPass'][:4])
+        self.assertEqual(16, len(server['adminPass']))
+        self.assertEqual('server_test', server['name'])
+        self.assertEqual('1', server['id'])
+
         self.assertEqual(res.status_int, 200)
 
     def test_update_no_body(self):
@@ -289,10 +336,45 @@ class ServersTest(unittest.TestCase):
         i = 0
         for s in res_dict['servers']:
             self.assertEqual(s['id'], i)
+            self.assertEqual(s['hostId'], '')
             self.assertEqual(s['name'], 'server%d' % i)
             self.assertEqual(s['imageId'], 10)
+            self.assertEqual(s['metadata']['seq'], i)
             i += 1
 
+    def test_get_all_server_details_with_host(self):
+        '''
+        We want to make sure that if two instances are on the same host, then
+        they return the same hostId. If two instances are on different hosts,
+        they should return different hostId's. In this test, there are 5
+        instances - 2 on one host and 3 on another.
+        '''
+
+        def stub_instance(id, user_id=1):
+            return Instance(id=id, state=0, image_id=10, user_id=user_id,
+                display_name='server%s' % id, host='host%s' % (id % 2))
+
+        def return_servers_with_host(context, user_id=1):
+            return [stub_instance(i) for i in xrange(5)]
+
+        self.stubs.Set(nova.db.api, 'instance_get_all_by_user',
+            return_servers_with_host)
+
+        req = webob.Request.blank('/v1.0/servers/detail')
+        res = req.get_response(fakes.wsgi_app())
+        res_dict = json.loads(res.body)
+
+        server_list = res_dict['servers']
+        host_ids = [server_list[0]['hostId'], server_list[1]['hostId']]
+        self.assertTrue(host_ids[0] and host_ids[1])
+        self.assertNotEqual(host_ids[0], host_ids[1])
+
+        for i, s in enumerate(res_dict['servers']):
+            self.assertEqual(s['id'], i)
+            self.assertEqual(s['hostId'], host_ids[i % 2])
+            self.assertEqual(s['name'], 'server%d' % i)
+            self.assertEqual(s['imageId'], 10)
+
     def test_server_pause(self):
         FLAGS.allow_admin_api = True
         body = dict(server=dict(
@@ -353,6 +435,19 @@ class ServersTest(unittest.TestCase):
         res = req.get_response(fakes.wsgi_app())
         self.assertEqual(res.status_int, 202)
 
+    def test_server_inject_network_info(self):
+        FLAGS.allow_admin_api = True
+        body = dict(server=dict(
+            name='server_test', imageId=2, flavorId=2, metadata={},
+            personality={}))
+        req = webob.Request.blank(
+              '/v1.0/servers/1/inject_network_info')
+        req.method = 'POST'
+        req.content_type = 'application/json'
+        req.body = json.dumps(body)
+        res = req.get_response(fakes.wsgi_app())
+        self.assertEqual(res.status_int, 202)
+
     def test_server_diagnostics(self):
         req = webob.Request.blank("/v1.0/servers/1/diagnostics")
         req.method = "GET"
@@ -411,6 +506,98 @@ class ServersTest(unittest.TestCase):
         self.assertEqual(res.status, '202 Accepted')
         self.assertEqual(self.server_delete_called, True)
 
+    def test_resize_server(self):
+        req = self.webreq('/1/action', 'POST', dict(resize=dict(flavorId=3)))
+
+        self.resize_called = False
+
+        def resize_mock(*args):
+            self.resize_called = True
+
+        self.stubs.Set(nova.compute.api.API, 'resize', resize_mock)
+
+        res = req.get_response(fakes.wsgi_app())
+        self.assertEqual(res.status_int, 202)
+        self.assertEqual(self.resize_called, True)
+
+    def test_resize_bad_flavor_fails(self):
+        req = self.webreq('/1/action', 'POST', dict(resize=dict(derp=3)))
+
+        self.resize_called = False
+
+        def resize_mock(*args):
+            self.resize_called = True
+
+        self.stubs.Set(nova.compute.api.API, 'resize', resize_mock)
+
+        res = req.get_response(fakes.wsgi_app())
+        self.assertEqual(res.status_int, 422)
+        self.assertEqual(self.resize_called, False)
+
+    def test_resize_raises_fails(self):
+        req = self.webreq('/1/action', 'POST', dict(resize=dict(flavorId=3)))
+
+        def resize_mock(*args):
+            raise Exception('hurr durr')
+
+        self.stubs.Set(nova.compute.api.API, 'resize', resize_mock)
+
+        res = req.get_response(fakes.wsgi_app())
+        self.assertEqual(res.status_int, 400)
+
+    def test_confirm_resize_server(self):
+        req = self.webreq('/1/action', 'POST', dict(confirmResize=None))
+
+        self.resize_called = False
+
+        def confirm_resize_mock(*args):
+            self.resize_called = True
+
+        self.stubs.Set(nova.compute.api.API, 'confirm_resize',
+                confirm_resize_mock)
+
+        res = req.get_response(fakes.wsgi_app())
+        self.assertEqual(res.status_int, 204)
+        self.assertEqual(self.resize_called, True)
+
+    def test_confirm_resize_server_fails(self):
+        req = self.webreq('/1/action', 'POST', dict(confirmResize=None))
+
+        def confirm_resize_mock(*args):
+            raise Exception('hurr durr')
+
+        self.stubs.Set(nova.compute.api.API, 'confirm_resize',
+                confirm_resize_mock)
+
+        res = req.get_response(fakes.wsgi_app())
+        self.assertEqual(res.status_int, 400)
+
+    def test_revert_resize_server(self):
+        req = self.webreq('/1/action', 'POST', dict(revertResize=None))
+
+        self.resize_called = False
+
+        def revert_resize_mock(*args):
+            self.resize_called = True
+
+        self.stubs.Set(nova.compute.api.API, 'revert_resize',
+                revert_resize_mock)
+
+        res = req.get_response(fakes.wsgi_app())
+        self.assertEqual(res.status_int, 202)
+        self.assertEqual(self.resize_called, True)
+
+    def test_revert_resize_server_fails(self):
+        req = self.webreq('/1/action', 'POST', dict(revertResize=None))
+
+        def revert_resize_mock(*args):
+            raise Exception('hurr durr')
+
+        self.stubs.Set(nova.compute.api.API, 'revert_resize',
+                revert_resize_mock)
+
+        res = req.get_response(fakes.wsgi_app())
+        self.assertEqual(res.status_int, 400)
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/nova/tests/api/openstack/test_shared_ip_groups.py b/nova/tests/api/openstack/test_shared_ip_groups.py
index c2fc3a203..b4de2ef41 100644
--- a/nova/tests/api/openstack/test_shared_ip_groups.py
+++ b/nova/tests/api/openstack/test_shared_ip_groups.py
@@ -15,19 +15,20 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import unittest
-
 import stubout
 
+from nova import test
 from nova.api.openstack import shared_ip_groups
 
 
-class SharedIpGroupsTest(unittest.TestCase):
+class SharedIpGroupsTest(test.TestCase):
     def setUp(self):
+        super(SharedIpGroupsTest, self).setUp()
         self.stubs = stubout.StubOutForTesting()
 
     def tearDown(self):
         self.stubs.UnsetAll()
+        super(SharedIpGroupsTest, self).tearDown()
 
     def test_get_shared_ip_groups(self):
         pass
diff --git a/nova/tests/api/openstack/test_users.py b/nova/tests/api/openstack/test_users.py
new file mode 100644
index 000000000..2dda4319b
--- /dev/null
+++ b/nova/tests/api/openstack/test_users.py
@@ -0,0 +1,141 @@
+# Copyright 2010 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import json
+
+import stubout
+import webob
+
+import nova.api
+import nova.api.openstack.auth
+from nova import context
+from nova import flags
+from nova import test
+from nova.auth.manager import User, Project
+from nova.tests.api.openstack import fakes
+
+
+FLAGS = flags.FLAGS
+FLAGS.verbose = True
+
+
+def fake_init(self):
+    self.manager = fakes.FakeAuthManager()
+
+
+def fake_admin_check(self, req):
+    return True
+
+
+class UsersTest(test.TestCase):
+    def setUp(self):
+        super(UsersTest, self).setUp()
+        self.stubs = stubout.StubOutForTesting()
+        self.stubs.Set(nova.api.openstack.users.Controller, '__init__',
+                       fake_init)
+        self.stubs.Set(nova.api.openstack.users.Controller, '_check_admin',
+                       fake_admin_check)
+        fakes.FakeAuthManager.auth_data = {}
+        fakes.FakeAuthManager.projects = dict(testacct=Project('testacct',
+                                                               'testacct',
+                                                               'guy1',
+                                                               'test',
+                                                               []))
+        fakes.FakeAuthDatabase.data = {}
+        fakes.stub_out_networking(self.stubs)
+        fakes.stub_out_rate_limiting(self.stubs)
+        fakes.stub_out_auth(self.stubs)
+
+        self.allow_admin = FLAGS.allow_admin_api
+        FLAGS.allow_admin_api = True
+        fakemgr = fakes.FakeAuthManager()
+        fakemgr.add_user('acc1', User('guy1', 'guy1', 'acc1',
+                                      'fortytwo!', False))
+        fakemgr.add_user('acc2', User('guy2', 'guy2', 'acc2',
+                                      'swordfish', True))
+
+    def tearDown(self):
+        self.stubs.UnsetAll()
+        FLAGS.allow_admin_api = self.allow_admin
+        super(UsersTest, self).tearDown()
+
+    def test_get_user_list(self):
+        req = webob.Request.blank('/v1.0/users')
+        res = req.get_response(fakes.wsgi_app())
+        res_dict = json.loads(res.body)
+
+        self.assertEqual(res.status_int, 200)
+        self.assertEqual(len(res_dict['users']), 2)
+
+    def test_get_user_by_id(self):
+        req = webob.Request.blank('/v1.0/users/guy2')
+        res = req.get_response(fakes.wsgi_app())
+        res_dict = json.loads(res.body)
+
+        self.assertEqual(res_dict['user']['id'], 'guy2')
+        self.assertEqual(res_dict['user']['name'], 'guy2')
+        self.assertEqual(res_dict['user']['secret'], 'swordfish')
+        self.assertEqual(res_dict['user']['admin'], True)
+        self.assertEqual(res.status_int, 200)
+
+    def test_user_delete(self):
+        req = webob.Request.blank('/v1.0/users/guy1')
+        req.method = 'DELETE'
+        res = req.get_response(fakes.wsgi_app())
+        self.assertTrue('guy1' not in [u.id for u in
+                        fakes.FakeAuthManager.auth_data.values()])
+        self.assertEqual(res.status_int, 200)
+
+    def test_user_create(self):
+        body = dict(user=dict(name='test_guy',
+                              access='acc3',
+                              secret='invasionIsInNormandy',
+                              admin=True))
+        req = webob.Request.blank('/v1.0/users')
+        req.headers["Content-Type"] = "application/json"
+        req.method = 'POST'
+        req.body = json.dumps(body)
+
+        res = req.get_response(fakes.wsgi_app())
+        res_dict = json.loads(res.body)
+
+        self.assertEqual(res.status_int, 200)
+        self.assertEqual(res_dict['user']['id'], 'test_guy')
+        self.assertEqual(res_dict['user']['name'], 'test_guy')
+        self.assertEqual(res_dict['user']['access'], 'acc3')
+        self.assertEqual(res_dict['user']['secret'], 'invasionIsInNormandy')
+        self.assertEqual(res_dict['user']['admin'], True)
+        self.assertTrue('test_guy' in [u.id for u in
+                        fakes.FakeAuthManager.auth_data.values()])
+        self.assertEqual(len(fakes.FakeAuthManager.auth_data.values()), 3)
+
+    def test_user_update(self):
+        body = dict(user=dict(name='guy2',
+                              access='acc2',
+                              secret='invasionIsInNormandy'))
+        req = webob.Request.blank('/v1.0/users/guy2')
+        req.headers["Content-Type"] = "application/json"
+        req.method = 'PUT'
+        req.body = json.dumps(body)
+
+        res = req.get_response(fakes.wsgi_app())
+        res_dict = json.loads(res.body)
+
+        self.assertEqual(res.status_int, 200)
+        self.assertEqual(res_dict['user']['id'], 'guy2')
+        self.assertEqual(res_dict['user']['name'], 'guy2')
+        self.assertEqual(res_dict['user']['access'], 'acc2')
+        self.assertEqual(res_dict['user']['secret'], 'invasionIsInNormandy')
+        self.assertEqual(res_dict['user']['admin'], True)
diff --git a/nova/tests/api/openstack/test_zones.py b/nova/tests/api/openstack/test_zones.py
index 5542a1cf3..38399bb3f 100644
--- a/nova/tests/api/openstack/test_zones.py
+++ b/nova/tests/api/openstack/test_zones.py
@@ -1,4 +1,4 @@
-# Copyright 2010 OpenStack LLC.
+# Copyright 2011 OpenStack LLC.
 # All Rights Reserved.
 #
 #    Licensed under the Apache License, Version 2.0 (the "License"); you may
@@ -13,7 +13,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import unittest
 
 import stubout
 import webob
@@ -22,8 +21,10 @@ import json
 import nova.db
 from nova import context
 from nova import flags
+from nova import test
 from nova.api.openstack import zones
 from nova.tests.api.openstack import fakes
+from nova.scheduler import api
 
 
 FLAGS = flags.FLAGS
@@ -31,7 +32,7 @@ FLAGS.verbose = True
 
 
 def zone_get(context, zone_id):
-    return dict(id=1, api_url='http://foo.com', username='bob',
+    return dict(id=1, api_url='http://example.com', username='bob',
                 password='xxx')
 
 
@@ -42,7 +43,7 @@ def zone_create(context, values):
 
 
 def zone_update(context, zone_id, values):
-    zone = dict(id=zone_id, api_url='http://foo.com', username='bob',
+    zone = dict(id=zone_id, api_url='http://example.com', username='bob',
                 password='xxx')
     zone.update(values)
     return zone
@@ -52,19 +53,33 @@ def zone_delete(context, zone_id):
     pass
 
 
-def zone_get_all(context):
+def zone_get_all_scheduler(*args):
     return [
-        dict(id=1, api_url='http://foo.com', username='bob',
+        dict(id=1, api_url='http://example.com', username='bob',
                  password='xxx'),
-        dict(id=2, api_url='http://blah.com', username='alice',
-                 password='qwerty')
+        dict(id=2, api_url='http://example.org', username='alice',
+                 password='qwerty'),
     ]
 
 
-class ZonesTest(unittest.TestCase):
+def zone_get_all_scheduler_empty(*args):
+    return []
+
+
+def zone_get_all_db(context):
+    return [
+        dict(id=1, api_url='http://example.com', username='bob',
+                 password='xxx'),
+        dict(id=2, api_url='http://example.org', username='alice',
+                 password='qwerty'),
+    ]
+
+
+class ZonesTest(test.TestCase):
     def setUp(self):
+        super(ZonesTest, self).setUp()
         self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.auth_data = {}
+        fakes.FakeAuthManager.reset_fake_data()
         fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
@@ -74,7 +89,6 @@ class ZonesTest(unittest.TestCase):
         FLAGS.allow_admin_api = True
 
         self.stubs.Set(nova.db, 'zone_get', zone_get)
-        self.stubs.Set(nova.db, 'zone_get_all', zone_get_all)
         self.stubs.Set(nova.db, 'zone_update', zone_update)
         self.stubs.Set(nova.db, 'zone_create', zone_create)
         self.stubs.Set(nova.db, 'zone_delete', zone_delete)
@@ -82,8 +96,10 @@ class ZonesTest(unittest.TestCase):
     def tearDown(self):
         self.stubs.UnsetAll()
         FLAGS.allow_admin_api = self.allow_admin
+        super(ZonesTest, self).tearDown()
 
-    def test_get_zone_list(self):
+    def test_get_zone_list_scheduler(self):
+        self.stubs.Set(api.API, '_call_scheduler', zone_get_all_scheduler)
         req = webob.Request.blank('/v1.0/zones')
         res = req.get_response(fakes.wsgi_app())
         res_dict = json.loads(res.body)
@@ -91,51 +107,63 @@ class ZonesTest(unittest.TestCase):
         self.assertEqual(res.status_int, 200)
         self.assertEqual(len(res_dict['zones']), 2)
 
+    def test_get_zone_list_db(self):
+        self.stubs.Set(api.API, '_call_scheduler',
+                                zone_get_all_scheduler_empty)
+        self.stubs.Set(nova.db, 'zone_get_all', zone_get_all_db)
+        req = webob.Request.blank('/v1.0/zones')
+        req.headers["Content-Type"] = "application/json"
+        res = req.get_response(fakes.wsgi_app())
+
+        self.assertEqual(res.status_int, 200)
+        res_dict = json.loads(res.body)
+        self.assertEqual(len(res_dict['zones']), 2)
+
     def test_get_zone_by_id(self):
         req = webob.Request.blank('/v1.0/zones/1')
+        req.headers["Content-Type"] = "application/json"
         res = req.get_response(fakes.wsgi_app())
-        res_dict = json.loads(res.body)
 
+        self.assertEqual(res.status_int, 200)
+        res_dict = json.loads(res.body)
         self.assertEqual(res_dict['zone']['id'], 1)
-        self.assertEqual(res_dict['zone']['api_url'], 'http://foo.com')
+        self.assertEqual(res_dict['zone']['api_url'], 'http://example.com')
         self.assertFalse('password' in res_dict['zone'])
-        self.assertEqual(res.status_int, 200)
 
     def test_zone_delete(self):
         req = webob.Request.blank('/v1.0/zones/1')
+        req.headers["Content-Type"] = "application/json"
         res = req.get_response(fakes.wsgi_app())
 
         self.assertEqual(res.status_int, 200)
 
     def test_zone_create(self):
-        body = dict(zone=dict(api_url='http://blah.zoo', username='fred',
+        body = dict(zone=dict(api_url='http://example.com', username='fred',
                         password='fubar'))
         req = webob.Request.blank('/v1.0/zones')
+        req.headers["Content-Type"] = "application/json"
         req.method = 'POST'
         req.body = json.dumps(body)
 
         res = req.get_response(fakes.wsgi_app())
-        res_dict = json.loads(res.body)
 
         self.assertEqual(res.status_int, 200)
+        res_dict = json.loads(res.body)
         self.assertEqual(res_dict['zone']['id'], 1)
-        self.assertEqual(res_dict['zone']['api_url'], 'http://blah.zoo')
+        self.assertEqual(res_dict['zone']['api_url'], 'http://example.com')
         self.assertFalse('username' in res_dict['zone'])
 
     def test_zone_update(self):
         body = dict(zone=dict(username='zeb', password='sneaky'))
         req = webob.Request.blank('/v1.0/zones/1')
+        req.headers["Content-Type"] = "application/json"
         req.method = 'PUT'
         req.body = json.dumps(body)
 
         res = req.get_response(fakes.wsgi_app())
-        res_dict = json.loads(res.body)
 
         self.assertEqual(res.status_int, 200)
+        res_dict = json.loads(res.body)
         self.assertEqual(res_dict['zone']['id'], 1)
-        self.assertEqual(res_dict['zone']['api_url'], 'http://foo.com')
+        self.assertEqual(res_dict['zone']['api_url'], 'http://example.com')
         self.assertFalse('username' in res_dict['zone'])
-
-
-if __name__ == '__main__':
-    unittest.main()
diff --git a/nova/tests/api/test_wsgi.py b/nova/tests/api/test_wsgi.py
index 44e2d615c..b1a849cf9 100644
--- a/nova/tests/api/test_wsgi.py
+++ b/nova/tests/api/test_wsgi.py
@@ -21,15 +21,17 @@
 Test WSGI basics and provide some helper functions for other WSGI tests.
 """
 
-import unittest
+import json
+from nova import test
 
 import routes
 import webob
 
+from nova import exception
 from nova import wsgi
 
 
-class Test(unittest.TestCase):
+class Test(test.TestCase):
 
     def test_debug(self):
 
@@ -66,63 +68,164 @@ class Test(unittest.TestCase):
         result = webob.Request.blank('/bad').get_response(Router())
         self.assertNotEqual(result.body, "Router result")
 
-    def test_controller(self):
 
-        class Controller(wsgi.Controller):
-            """Test controller to call from router."""
-            test = self
+class ControllerTest(test.TestCase):
 
-            def show(self, req, id):  # pylint: disable-msg=W0622,C0103
-                """Default action called for requests with an ID."""
-                self.test.assertEqual(req.path_info, '/tests/123')
-                self.test.assertEqual(id, '123')
-                return id
-
-        class Router(wsgi.Router):
-            """Test router."""
-
-            def __init__(self):
-                mapper = routes.Mapper()
-                mapper.resource("test", "tests", controller=Controller())
-                super(Router, self).__init__(mapper)
+    class TestRouter(wsgi.Router):
 
-        result = webob.Request.blank('/tests/123').get_response(Router())
-        self.assertEqual(result.body, "123")
-        result = webob.Request.blank('/test/123').get_response(Router())
-        self.assertNotEqual(result.body, "123")
+        class TestController(wsgi.Controller):
 
+            _serialization_metadata = {
+                'application/xml': {
+                    "attributes": {
+                        "test": ["id"]}}}
 
-class SerializerTest(unittest.TestCase):
-
-    def match(self, url, accept, expect):
+            def show(self, req, id):  # pylint: disable-msg=W0622,C0103
+                return {"test": {"id": id}}
+
+        def __init__(self):
+            mapper = routes.Mapper()
+            mapper.resource("test", "tests", controller=self.TestController())
+            wsgi.Router.__init__(self, mapper)
+
+    def test_show(self):
+        request = wsgi.Request.blank('/tests/123')
+        result = request.get_response(self.TestRouter())
+        self.assertEqual(json.loads(result.body), {"test": {"id": "123"}})
+
+    def test_response_content_type_from_accept_xml(self):
+        request = webob.Request.blank('/tests/123')
+        request.headers["Accept"] = "application/xml"
+        result = request.get_response(self.TestRouter())
+        self.assertEqual(result.headers["Content-Type"], "application/xml")
+
+    def test_response_content_type_from_accept_json(self):
+        request = wsgi.Request.blank('/tests/123')
+        request.headers["Accept"] = "application/json"
+        result = request.get_response(self.TestRouter())
+        self.assertEqual(result.headers["Content-Type"], "application/json")
+
+    def test_response_content_type_from_query_extension_xml(self):
+        request = wsgi.Request.blank('/tests/123.xml')
+        result = request.get_response(self.TestRouter())
+        self.assertEqual(result.headers["Content-Type"], "application/xml")
+
+    def test_response_content_type_from_query_extension_json(self):
+        request = wsgi.Request.blank('/tests/123.json')
+        result = request.get_response(self.TestRouter())
+        self.assertEqual(result.headers["Content-Type"], "application/json")
+
+    def test_response_content_type_default_when_unsupported(self):
+        request = wsgi.Request.blank('/tests/123.unsupported')
+        request.headers["Accept"] = "application/unsupported1"
+        result = request.get_response(self.TestRouter())
+        self.assertEqual(result.status_int, 200)
+        self.assertEqual(result.headers["Content-Type"], "application/json")
+
+
+class RequestTest(test.TestCase):
+
+    def test_request_content_type_missing(self):
+        request = wsgi.Request.blank('/tests/123')
+        request.body = "<body />"
+        self.assertRaises(webob.exc.HTTPBadRequest, request.get_content_type)
+
+    def test_request_content_type_unsupported(self):
+        request = wsgi.Request.blank('/tests/123')
+        request.headers["Content-Type"] = "text/html"
+        request.body = "asdf<br />"
+        self.assertRaises(webob.exc.HTTPBadRequest, request.get_content_type)
+
+    def test_content_type_from_accept_xml(self):
+        request = wsgi.Request.blank('/tests/123')
+        request.headers["Accept"] = "application/xml"
+        result = request.best_match_content_type()
+        self.assertEqual(result, "application/xml")
+
+        request = wsgi.Request.blank('/tests/123')
+        request.headers["Accept"] = "application/json"
+        result = request.best_match_content_type()
+        self.assertEqual(result, "application/json")
+
+        request = wsgi.Request.blank('/tests/123')
+        request.headers["Accept"] = "application/xml, application/json"
+        result = request.best_match_content_type()
+        self.assertEqual(result, "application/json")
+
+        request = wsgi.Request.blank('/tests/123')
+        request.headers["Accept"] = \
+            "application/json; q=0.3, application/xml; q=0.9"
+        result = request.best_match_content_type()
+        self.assertEqual(result, "application/xml")
+
+    def test_content_type_from_query_extension(self):
+        request = wsgi.Request.blank('/tests/123.xml')
+        result = request.best_match_content_type()
+        self.assertEqual(result, "application/xml")
+
+        request = wsgi.Request.blank('/tests/123.json')
+        result = request.best_match_content_type()
+        self.assertEqual(result, "application/json")
+
+        request = wsgi.Request.blank('/tests/123.invalid')
+        result = request.best_match_content_type()
+        self.assertEqual(result, "application/json")
+
+    def test_content_type_accept_and_query_extension(self):
+        request = wsgi.Request.blank('/tests/123.xml')
+        request.headers["Accept"] = "application/json"
+        result = request.best_match_content_type()
+        self.assertEqual(result, "application/xml")
+
+    def test_content_type_accept_default(self):
+        request = wsgi.Request.blank('/tests/123.unsupported')
+        request.headers["Accept"] = "application/unsupported1"
+        result = request.best_match_content_type()
+        self.assertEqual(result, "application/json")
+
+
+class SerializerTest(test.TestCase):
+
+    def test_xml(self):
         input_dict = dict(servers=dict(a=(2, 3)))
         expected_xml = '<servers><a>(2,3)</a></servers>'
+        serializer = wsgi.Serializer()
+        result = serializer.serialize(input_dict, "application/xml")
+        result = result.replace('\n', '').replace(' ', '')
+        self.assertEqual(result, expected_xml)
+
+    def test_json(self):
+        input_dict = dict(servers=dict(a=(2, 3)))
         expected_json = '{"servers":{"a":[2,3]}}'
-        req = webob.Request.blank(url, headers=dict(Accept=accept))
-        result = wsgi.Serializer(req.environ).to_content_type(input_dict)
+        serializer = wsgi.Serializer()
+        result = serializer.serialize(input_dict, "application/json")
         result = result.replace('\n', '').replace(' ', '')
-        if expect == 'xml':
-            self.assertEqual(result, expected_xml)
-        elif expect == 'json':
-            self.assertEqual(result, expected_json)
-        else:
-            raise "Bad expect value"
-
-    def test_basic(self):
-        self.match('/servers/4.json', None, expect='json')
-        self.match('/servers/4', 'application/json', expect='json')
-        self.match('/servers/4', 'application/xml', expect='xml')
-        self.match('/servers/4.xml', None, expect='xml')
-
-    def test_defaults_to_json(self):
-        self.match('/servers/4', None, expect='json')
-        self.match('/servers/4', 'text/html', expect='json')
-
-    def test_suffix_takes_precedence_over_accept_header(self):
-        self.match('/servers/4.xml', 'application/json', expect='xml')
-        self.match('/servers/4.xml.', 'application/json', expect='json')
-
-    def test_deserialize(self):
+        self.assertEqual(result, expected_json)
+
+    def test_unsupported_content_type(self):
+        serializer = wsgi.Serializer()
+        self.assertRaises(exception.InvalidContentType, serializer.serialize,
+                          {}, "text/null")
+
+    def test_deserialize_json(self):
+        data = """{"a": {
+                "a1": "1",
+                "a2": "2",
+                "bs": ["1", "2", "3", {"c": {"c1": "1"}}],
+                "d": {"e": "1"},
+                "f": "1"}}"""
+        as_dict = dict(a={
+                'a1': '1',
+                'a2': '2',
+                'bs': ['1', '2', '3', {'c': dict(c1='1')}],
+                'd': {'e': '1'},
+                'f': '1'})
+        metadata = {}
+        serializer = wsgi.Serializer(metadata)
+        self.assertEqual(serializer.deserialize(data, "application/json"),
+                         as_dict)
+
+    def test_deserialize_xml(self):
         xml = """
             <a a1="1" a2="2">
               <bs><b>1</b><b>2</b><b>3</b><b><c c1="1"/></b></bs>
@@ -137,11 +240,13 @@ class SerializerTest(unittest.TestCase):
                 'd': {'e': '1'},
                 'f': '1'})
         metadata = {'application/xml': dict(plurals={'bs': 'b', 'ts': 't'})}
-        serializer = wsgi.Serializer({}, metadata)
-        self.assertEqual(serializer.deserialize(xml), as_dict)
+        serializer = wsgi.Serializer(metadata)
+        self.assertEqual(serializer.deserialize(xml, "application/xml"),
+                         as_dict)
 
     def test_deserialize_empty_xml(self):
         xml = """<a></a>"""
         as_dict = {"a": {}}
-        serializer = wsgi.Serializer({})
-        self.assertEqual(serializer.deserialize(xml), as_dict)
+        serializer = wsgi.Serializer()
+        self.assertEqual(serializer.deserialize(xml, "application/xml"),
+                         as_dict)
diff --git a/nova/tests/db/fakes.py b/nova/tests/db/fakes.py
index 05bdd172e..142f6b1c6 100644
--- a/nova/tests/db/fakes.py
+++ b/nova/tests/db/fakes.py
@@ -20,13 +20,22 @@
 import time
 
 from nova import db
+from nova import test
 from nova import utils
-from nova.compute import instance_types
 
 
 def stub_out_db_instance_api(stubs):
     """ Stubs out the db API for creating Instances """
 
+    INSTANCE_TYPES = {
+        'm1.tiny': dict(memory_mb=512, vcpus=1, local_gb=0, flavorid=1),
+        'm1.small': dict(memory_mb=2048, vcpus=1, local_gb=20, flavorid=2),
+        'm1.medium':
+            dict(memory_mb=4096, vcpus=2, local_gb=40, flavorid=3),
+        'm1.large': dict(memory_mb=8192, vcpus=4, local_gb=80, flavorid=4),
+        'm1.xlarge':
+            dict(memory_mb=16384, vcpus=8, local_gb=160, flavorid=5)}
+
     class FakeModel(object):
         """ Stubs out for model """
         def __init__(self, values):
@@ -41,10 +50,16 @@ def stub_out_db_instance_api(stubs):
             else:
                 raise NotImplementedError()
 
+    def fake_instance_type_get_all(context, inactive=0):
+        return INSTANCE_TYPES
+
+    def fake_instance_type_get_by_name(context, name):
+        return INSTANCE_TYPES[name]
+
     def fake_instance_create(values):
         """ Stubs out the db.instance_create method """
 
-        type_data = instance_types.INSTANCE_TYPES[values['instance_type']]
+        type_data = INSTANCE_TYPES[values['instance_type']]
 
         base_options = {
             'name': values['name'],
@@ -62,6 +77,7 @@ def stub_out_db_instance_api(stubs):
             'mac_address': values['mac_address'],
             'vcpus': type_data['vcpus'],
             'local_gb': type_data['local_gb'],
+            'os_type': values['os_type']
             }
         return FakeModel(base_options)
 
@@ -73,3 +89,5 @@ def stub_out_db_instance_api(stubs):
 
     stubs.Set(db, 'instance_create', fake_instance_create)
     stubs.Set(db, 'network_get_by_instance', fake_network_get_by_instance)
+    stubs.Set(db, 'instance_type_get_all', fake_instance_type_get_all)
+    stubs.Set(db, 'instance_type_get_by_name', fake_instance_type_get_by_name)
diff --git a/nova/tests/fake_flags.py b/nova/tests/fake_flags.py
index 1097488ec..5d7ca98b5 100644
--- a/nova/tests/fake_flags.py
+++ b/nova/tests/fake_flags.py
@@ -29,9 +29,10 @@ FLAGS.auth_driver = 'nova.auth.dbdriver.DbDriver'
 flags.DECLARE('network_size', 'nova.network.manager')
 flags.DECLARE('num_networks', 'nova.network.manager')
 flags.DECLARE('fake_network', 'nova.network.manager')
-FLAGS.network_size = 16
-FLAGS.num_networks = 5
+FLAGS.network_size = 8
+FLAGS.num_networks = 2
 FLAGS.fake_network = True
+FLAGS.image_service = 'nova.image.local.LocalImageService'
 flags.DECLARE('num_shelves', 'nova.volume.driver')
 flags.DECLARE('blades_per_shelf', 'nova.volume.driver')
 flags.DECLARE('iscsi_num_targets', 'nova.volume.driver')
@@ -39,5 +40,5 @@ FLAGS.num_shelves = 2
 FLAGS.blades_per_shelf = 4
 FLAGS.iscsi_num_targets = 8
 FLAGS.verbose = True
-FLAGS.sql_connection = 'sqlite:///nova.sqlite'
+FLAGS.sqlite_db = "tests.sqlite"
 FLAGS.use_ipv6 = True
diff --git a/nova/tests/glance/stubs.py b/nova/tests/glance/stubs.py
index f182b857a..5872552ec 100644
--- a/nova/tests/glance/stubs.py
+++ b/nova/tests/glance/stubs.py
@@ -26,12 +26,45 @@ def stubout_glance_client(stubs, cls):
 
 
 class FakeGlance(object):
+    IMAGE_MACHINE = 1
+    IMAGE_KERNEL = 2
+    IMAGE_RAMDISK = 3
+    IMAGE_RAW = 4
+    IMAGE_VHD = 5
+
+    IMAGE_FIXTURES = {
+        IMAGE_MACHINE: {
+            'image_meta': {'name': 'fakemachine', 'size': 0,
+                           'disk_format': 'ami',
+                           'container_format': 'ami'},
+            'image_data': StringIO.StringIO('')},
+        IMAGE_KERNEL: {
+            'image_meta': {'name': 'fakekernel', 'size': 0,
+                           'disk_format': 'aki',
+                           'container_format': 'aki'},
+            'image_data': StringIO.StringIO('')},
+        IMAGE_RAMDISK: {
+            'image_meta': {'name': 'fakeramdisk', 'size': 0,
+                           'disk_format': 'ari',
+                           'container_format': 'ari'},
+            'image_data': StringIO.StringIO('')},
+        IMAGE_RAW: {
+            'image_meta': {'name': 'fakeraw', 'size': 0,
+                           'disk_format': 'raw',
+                           'container_format': 'bare'},
+            'image_data': StringIO.StringIO('')},
+        IMAGE_VHD: {
+            'image_meta': {'name': 'fakevhd', 'size': 0,
+                           'disk_format': 'vhd',
+                           'container_format': 'ovf'},
+            'image_data': StringIO.StringIO('')}}
+
     def __init__(self, host, port=None, use_ssl=False):
         pass
 
-    def get_image(self, image):
-        meta = {
-            'size': 0,
-            }
-        image_file = StringIO.StringIO('')
-        return meta, image_file
+    def get_image_meta(self, image_id):
+        return self.IMAGE_FIXTURES[image_id]['image_meta']
+
+    def get_image(self, image_id):
+        image = self.IMAGE_FIXTURES[image_id]
+        return image['image_meta'], image['image_data']
diff --git a/nova/tests/integrated/__init__.py b/nova/tests/integrated/__init__.py
new file mode 100644
index 000000000..10e0a91d7
--- /dev/null
+++ b/nova/tests/integrated/__init__.py
@@ -0,0 +1,20 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+#    Copyright (c) 2011 Justin Santa Barbara
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+:mod:`integrated` -- Tests whole systems, using mock services where needed
+=================================
+"""
diff --git a/nova/tests/integrated/api/__init__.py b/nova/tests/integrated/api/__init__.py
new file mode 100644
index 000000000..5798ab3d1
--- /dev/null
+++ b/nova/tests/integrated/api/__init__.py
@@ -0,0 +1,20 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+#    Copyright (c) 2011 Justin Santa Barbara
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+:mod:`api` -- OpenStack API client, for testing rather than production
+=================================
+"""
diff --git a/nova/tests/integrated/api/client.py b/nova/tests/integrated/api/client.py
new file mode 100644
index 000000000..245eb8c69
--- /dev/null
+++ b/nova/tests/integrated/api/client.py
@@ -0,0 +1,212 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+#    Copyright (c) 2011 Justin Santa Barbara
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import json
+import httplib
+import urlparse
+
+from nova import log as logging
+
+
+LOG = logging.getLogger('nova.tests.api')
+
+
+class OpenStackApiException(Exception):
+    def __init__(self, message=None, response=None):
+        self.response = response
+        if not message:
+            message = 'Unspecified error'
+
+        if response:
+            _status = response.status
+            _body = response.read()
+
+            message = _('%(message)s\nStatus Code: %(_status)s\n'
+                        'Body: %(_body)s') % locals()
+
+        super(OpenStackApiException, self).__init__(message)
+
+
+class OpenStackApiAuthenticationException(OpenStackApiException):
+    def __init__(self, response=None, message=None):
+        if not message:
+            message = _("Authentication error")
+        super(OpenStackApiAuthenticationException, self).__init__(message,
+                                                                  response)
+
+
+class OpenStackApiNotFoundException(OpenStackApiException):
+    def __init__(self, response=None, message=None):
+        if not message:
+            message = _("Item not found")
+        super(OpenStackApiNotFoundException, self).__init__(message, response)
+
+
+class TestOpenStackClient(object):
+    """ A really basic OpenStack API client that is under our control,
+    so we can make changes / insert hooks for testing"""
+
+    def __init__(self, auth_user, auth_key, auth_uri):
+        super(TestOpenStackClient, self).__init__()
+        self.auth_result = None
+        self.auth_user = auth_user
+        self.auth_key = auth_key
+        self.auth_uri = auth_uri
+
+    def request(self, url, method='GET', body=None, headers=None):
+        if headers is None:
+            headers = {}
+
+        parsed_url = urlparse.urlparse(url)
+        port = parsed_url.port
+        hostname = parsed_url.hostname
+        scheme = parsed_url.scheme
+
+        if scheme == 'http':
+            conn = httplib.HTTPConnection(hostname,
+                                          port=port)
+        elif scheme == 'https':
+            conn = httplib.HTTPSConnection(hostname,
+                                           port=port)
+        else:
+            raise OpenStackApiException("Unknown scheme: %s" % url)
+
+        relative_url = parsed_url.path
+        if parsed_url.query:
+            relative_url = relative_url + parsed_url.query
+        LOG.info(_("Doing %(method)s on %(relative_url)s") % locals())
+        if body:
+            LOG.info(_("Body: %s") % body)
+
+        conn.request(method, relative_url, body, headers)
+        response = conn.getresponse()
+        return response
+
+    def _authenticate(self):
+        if self.auth_result:
+            return self.auth_result
+
+        auth_uri = self.auth_uri
+        headers = {'X-Auth-User': self.auth_user,
+                   'X-Auth-Key': self.auth_key}
+        response = self.request(auth_uri,
+                                headers=headers)
+
+        http_status = response.status
+        LOG.debug(_("%(auth_uri)s => code %(http_status)s") % locals())
+
+        # Until bug732866 is fixed, we can't check this properly...
+        #if http_status == 401:
+        if http_status != 204:
+            raise OpenStackApiAuthenticationException(response=response)
+
+        auth_headers = {}
+        for k, v in response.getheaders():
+            auth_headers[k] = v
+
+        self.auth_result = auth_headers
+        return self.auth_result
+
+    def api_request(self, relative_uri, check_response_status=None, **kwargs):
+        auth_result = self._authenticate()
+
+        #NOTE(justinsb): httplib 'helpfully' converts headers to lower case
+        base_uri = auth_result['x-server-management-url']
+        full_uri = base_uri + relative_uri
+
+        headers = kwargs.setdefault('headers', {})
+        headers['X-Auth-Token'] = auth_result['x-auth-token']
+
+        response = self.request(full_uri, **kwargs)
+
+        http_status = response.status
+        LOG.debug(_("%(relative_uri)s => code %(http_status)s") % locals())
+
+        if check_response_status:
+            if not http_status in check_response_status:
+                if http_status == 404:
+                    raise OpenStackApiNotFoundException(response=response)
+                else:
+                    raise OpenStackApiException(
+                                        message=_("Unexpected status code"),
+                                        response=response)
+
+        return response
+
+    def _decode_json(self, response):
+        body = response.read()
+        LOG.debug(_("Decoding JSON: %s") % (body))
+        return json.loads(body)
+
+    def api_get(self, relative_uri, **kwargs):
+        kwargs.setdefault('check_response_status', [200])
+        response = self.api_request(relative_uri, **kwargs)
+        return self._decode_json(response)
+
+    def api_post(self, relative_uri, body, **kwargs):
+        kwargs['method'] = 'POST'
+        if body:
+            headers = kwargs.setdefault('headers', {})
+            headers['Content-Type'] = 'application/json'
+            kwargs['body'] = json.dumps(body)
+
+        kwargs.setdefault('check_response_status', [200])
+        response = self.api_request(relative_uri, **kwargs)
+        return self._decode_json(response)
+
+    def api_delete(self, relative_uri, **kwargs):
+        kwargs['method'] = 'DELETE'
+        kwargs.setdefault('check_response_status', [200, 202])
+        return self.api_request(relative_uri, **kwargs)
+
+    def get_server(self, server_id):
+        return self.api_get('/servers/%s' % server_id)['server']
+
+    def get_servers(self, detail=True):
+        rel_url = '/servers/detail' if detail else '/servers'
+        return self.api_get(rel_url)['servers']
+
+    def post_server(self, server):
+        return self.api_post('/servers', server)['server']
+
+    def delete_server(self, server_id):
+        return self.api_delete('/servers/%s' % server_id)
+
+    def get_image(self, image_id):
+        return self.api_get('/images/%s' % image_id)['image']
+
+    def get_images(self, detail=True):
+        rel_url = '/images/detail' if detail else '/images'
+        return self.api_get(rel_url)['images']
+
+    def post_image(self, image):
+        return self.api_post('/images', image)['image']
+
+    def delete_image(self, image_id):
+        return self.api_delete('/images/%s' % image_id)
+
+    def get_flavor(self, flavor_id):
+        return self.api_get('/flavors/%s' % flavor_id)['flavor']
+
+    def get_flavors(self, detail=True):
+        rel_url = '/flavors/detail' if detail else '/flavors'
+        return self.api_get(rel_url)['flavors']
+
+    def post_flavor(self, flavor):
+        return self.api_post('/flavors', flavor)['flavor']
+
+    def delete_flavor(self, flavor_id):
+        return self.api_delete('/flavors/%s' % flavor_id)
diff --git a/nova/tests/objectstore_unittest.py b/nova/tests/objectstore_unittest.py
index da86e6e11..5a1be08eb 100644
--- a/nova/tests/objectstore_unittest.py
+++ b/nova/tests/objectstore_unittest.py
@@ -311,4 +311,5 @@ class S3APITestCase(test.TestCase):
         self.auth_manager.delete_user('admin')
         self.auth_manager.delete_project('admin')
         stop_listening = defer.maybeDeferred(self.listening_port.stopListening)
+        super(S3APITestCase, self).tearDown()
         return defer.DeferredList([stop_listening])
diff --git a/nova/tests/test_api.py b/nova/tests/test_api.py
index fa27825cd..d5c54a1c3 100644
--- a/nova/tests/test_api.py
+++ b/nova/tests/test_api.py
@@ -20,6 +20,7 @@
 
 import boto
 from boto.ec2 import regioninfo
+import datetime
 import httplib
 import random
 import StringIO
@@ -127,6 +128,28 @@ class ApiEc2TestCase(test.TestCase):
         self.ec2.new_http_connection(host, is_secure).AndReturn(self.http)
         return self.http
 
+    def test_return_valid_isoformat(self):
+        """
+            Ensure that the ec2 api returns datetime in xs:dateTime
+            (which apparently isn't datetime.isoformat())
+            NOTE(ken-pepple): https://bugs.launchpad.net/nova/+bug/721297
+        """
+        conv = apirequest._database_to_isoformat
+        # sqlite database representation with microseconds
+        time_to_convert = datetime.datetime.strptime(
+                            "2011-02-21 20:14:10.634276",
+                            "%Y-%m-%d %H:%M:%S.%f")
+        self.assertEqual(
+                        conv(time_to_convert),
+                        '2011-02-21T20:14:10Z')
+        # mysqlite database representation
+        time_to_convert = datetime.datetime.strptime(
+                            "2011-02-21 19:56:18",
+                            "%Y-%m-%d %H:%M:%S")
+        self.assertEqual(
+                        conv(time_to_convert),
+                        '2011-02-21T19:56:18Z')
+
     def test_xmlns_version_matches_request_version(self):
         self.expect_http(api_version='2010-10-30')
         self.mox.ReplayAll()
diff --git a/nova/tests/test_auth.py b/nova/tests/test_auth.py
index 35ffffb67..2a7817032 100644
--- a/nova/tests/test_auth.py
+++ b/nova/tests/test_auth.py
@@ -327,15 +327,6 @@ class AuthManagerTestCase(object):
 class AuthManagerLdapTestCase(AuthManagerTestCase, test.TestCase):
     auth_driver = 'nova.auth.ldapdriver.FakeLdapDriver'
 
-    def __init__(self, *args, **kwargs):
-        AuthManagerTestCase.__init__(self)
-        test.TestCase.__init__(self, *args, **kwargs)
-        import nova.auth.fakeldap as fakeldap
-        if FLAGS.flush_db:
-            LOG.info("Flushing datastore")
-            r = fakeldap.Store.instance()
-            r.flushdb()
-
 
 class AuthManagerDbTestCase(AuthManagerTestCase, test.TestCase):
     auth_driver = 'nova.auth.dbdriver.DbDriver'
diff --git a/nova/tests/test_cloud.py b/nova/tests/test_cloud.py
index 445cc6e8b..cf8ee7eff 100644
--- a/nova/tests/test_cloud.py
+++ b/nova/tests/test_cloud.py
@@ -38,6 +38,8 @@ from nova import test
 from nova.auth import manager
 from nova.compute import power_state
 from nova.api.ec2 import cloud
+from nova.api.ec2 import ec2utils
+from nova.image import local
 from nova.objectstore import image
 
 
@@ -65,18 +67,27 @@ class CloudTestCase(test.TestCase):
         self.cloud = cloud.CloudController()
 
         # set up services
-        self.compute = service.Service.create(binary='nova-compute')
-        self.compute.start()
-        self.network = service.Service.create(binary='nova-network')
-        self.network.start()
+        self.compute = self.start_service('compute')
+        self.scheduter = self.start_service('scheduler')
+        self.network = self.start_service('network')
 
         self.manager = manager.AuthManager()
         self.user = self.manager.create_user('admin', 'admin', 'admin', True)
         self.project = self.manager.create_project('proj', 'admin', 'proj')
         self.context = context.RequestContext(user=self.user,
                                               project=self.project)
+        host = self.network.get_network_host(self.context.elevated())
+
+        def fake_show(meh, context, id):
+            return {'id': 1, 'properties': {'kernel_id': 1, 'ramdisk_id': 1}}
+
+        self.stubs.Set(local.LocalImageService, 'show', fake_show)
+        self.stubs.Set(local.LocalImageService, 'show_by_name', fake_show)
 
     def tearDown(self):
+        network_ref = db.project_get_network(self.context,
+                                             self.project.id)
+        db.network_disassociate(self.context, network_ref['id'])
         self.manager.delete_project(self.project)
         self.manager.delete_user(self.user)
         self.compute.kill()
@@ -102,7 +113,7 @@ class CloudTestCase(test.TestCase):
         address = "10.10.10.10"
         db.floating_ip_create(self.context,
                               {'address': address,
-                               'host': FLAGS.host})
+                               'host': self.network.host})
         self.cloud.allocate_address(self.context)
         self.cloud.describe_addresses(self.context)
         self.cloud.release_address(self.context,
@@ -115,11 +126,11 @@ class CloudTestCase(test.TestCase):
         address = "10.10.10.10"
         db.floating_ip_create(self.context,
                               {'address': address,
-                               'host': FLAGS.host})
+                               'host': self.network.host})
         self.cloud.allocate_address(self.context)
-        inst = db.instance_create(self.context, {'host': FLAGS.host})
+        inst = db.instance_create(self.context, {'host': self.compute.host})
         fixed = self.network.allocate_fixed_ip(self.context, inst['id'])
-        ec2_id = cloud.id_to_ec2_id(inst['id'])
+        ec2_id = ec2utils.id_to_ec2_id(inst['id'])
         self.cloud.associate_address(self.context,
                                      instance_id=ec2_id,
                                      public_ip=address)
@@ -133,18 +144,34 @@ class CloudTestCase(test.TestCase):
         db.instance_destroy(self.context, inst['id'])
         db.floating_ip_destroy(self.context, address)
 
+    def test_describe_security_groups(self):
+        """Makes sure describe_security_groups works and filters results."""
+        sec = db.security_group_create(self.context,
+                                       {'project_id': self.context.project_id,
+                                        'name': 'test'})
+        result = self.cloud.describe_security_groups(self.context)
+        # NOTE(vish): should have the default group as well
+        self.assertEqual(len(result['securityGroupInfo']), 2)
+        result = self.cloud.describe_security_groups(self.context,
+                      group_name=[sec['name']])
+        self.assertEqual(len(result['securityGroupInfo']), 1)
+        self.assertEqual(
+                result['securityGroupInfo'][0]['groupName'],
+                sec['name'])
+        db.security_group_destroy(self.context, sec['id'])
+
     def test_describe_volumes(self):
         """Makes sure describe_volumes works and filters results."""
         vol1 = db.volume_create(self.context, {})
         vol2 = db.volume_create(self.context, {})
         result = self.cloud.describe_volumes(self.context)
         self.assertEqual(len(result['volumeSet']), 2)
-        volume_id = cloud.id_to_ec2_id(vol2['id'], 'vol-%08x')
+        volume_id = ec2utils.id_to_ec2_id(vol2['id'], 'vol-%08x')
         result = self.cloud.describe_volumes(self.context,
                                              volume_id=[volume_id])
         self.assertEqual(len(result['volumeSet']), 1)
         self.assertEqual(
-                cloud.ec2_id_to_id(result['volumeSet'][0]['volumeId']),
+                ec2utils.ec2_id_to_id(result['volumeSet'][0]['volumeId']),
                 vol2['id'])
         db.volume_destroy(self.context, vol1['id'])
         db.volume_destroy(self.context, vol2['id'])
@@ -169,8 +196,10 @@ class CloudTestCase(test.TestCase):
     def test_describe_instances(self):
         """Makes sure describe_instances works and filters results."""
         inst1 = db.instance_create(self.context, {'reservation_id': 'a',
+                                                  'image_id': 1,
                                                   'host': 'host1'})
         inst2 = db.instance_create(self.context, {'reservation_id': 'a',
+                                                  'image_id': 1,
                                                   'host': 'host2'})
         comp1 = db.service_create(self.context, {'host': 'host1',
                                                  'availability_zone': 'zone1',
@@ -181,7 +210,7 @@ class CloudTestCase(test.TestCase):
         result = self.cloud.describe_instances(self.context)
         result = result['reservationSet'][0]
         self.assertEqual(len(result['instancesSet']), 2)
-        instance_id = cloud.id_to_ec2_id(inst2['id'])
+        instance_id = ec2utils.id_to_ec2_id(inst2['id'])
         result = self.cloud.describe_instances(self.context,
                                              instance_id=[instance_id])
         result = result['reservationSet'][0]
@@ -196,34 +225,37 @@ class CloudTestCase(test.TestCase):
         db.service_destroy(self.context, comp2['id'])
 
     def test_console_output(self):
-        image_id = FLAGS.default_image
         instance_type = FLAGS.default_instance_type
         max_count = 1
-        kwargs = {'image_id': image_id,
+        kwargs = {'image_id': 'ami-1',
                   'instance_type': instance_type,
                   'max_count': max_count}
         rv = self.cloud.run_instances(self.context, **kwargs)
+        greenthread.sleep(0.3)
         instance_id = rv['instancesSet'][0]['instanceId']
         output = self.cloud.get_console_output(context=self.context,
-                                                     instance_id=[instance_id])
+                                               instance_id=[instance_id])
         self.assertEquals(b64decode(output['output']), 'FAKE CONSOLE OUTPUT')
         # TODO(soren): We need this until we can stop polling in the rpc code
         #              for unit tests.
         greenthread.sleep(0.3)
         rv = self.cloud.terminate_instances(self.context, [instance_id])
+        greenthread.sleep(0.3)
 
     def test_ajax_console(self):
-        kwargs = {'image_id': image_id}
-        rv = yield self.cloud.run_instances(self.context, **kwargs)
+        kwargs = {'image_id': 'ami-1'}
+        rv = self.cloud.run_instances(self.context, **kwargs)
         instance_id = rv['instancesSet'][0]['instanceId']
-        output = yield self.cloud.get_console_output(context=self.context,
-                                                     instance_id=[instance_id])
-        self.assertEquals(b64decode(output['output']),
-                          'http://fakeajaxconsole.com/?token=FAKETOKEN')
+        greenthread.sleep(0.3)
+        output = self.cloud.get_ajax_console(context=self.context,
+                                             instance_id=[instance_id])
+        self.assertEquals(output['url'],
+                          '%s/?token=FAKETOKEN' % FLAGS.ajax_console_proxy_url)
         # TODO(soren): We need this until we can stop polling in the rpc code
         #              for unit tests.
         greenthread.sleep(0.3)
-        rv = yield self.cloud.terminate_instances(self.context, [instance_id])
+        rv = self.cloud.terminate_instances(self.context, [instance_id])
+        greenthread.sleep(0.3)
 
     def test_key_generation(self):
         result = self._create_key('test')
@@ -243,7 +275,7 @@ class CloudTestCase(test.TestCase):
         self._create_key('test1')
         self._create_key('test2')
         result = self.cloud.describe_key_pairs(self.context)
-        keys = result["keypairsSet"]
+        keys = result["keySet"]
         self.assertTrue(filter(lambda k: k['keyName'] == 'test1', keys))
         self.assertTrue(filter(lambda k: k['keyName'] == 'test2', keys))
 
@@ -286,70 +318,6 @@ class CloudTestCase(test.TestCase):
                 LOG.debug(_("Terminating instance %s"), instance_id)
                 rv = self.compute.terminate_instance(instance_id)
 
-    def test_describe_instances(self):
-        """Makes sure describe_instances works."""
-        instance1 = db.instance_create(self.context, {'host': 'host2'})
-        comp1 = db.service_create(self.context, {'host': 'host2',
-                                                 'availability_zone': 'zone1',
-                                                 'topic': "compute"})
-        result = self.cloud.describe_instances(self.context)
-        self.assertEqual(result['reservationSet'][0]
-                         ['instancesSet'][0]
-                         ['placement']['availabilityZone'], 'zone1')
-        db.instance_destroy(self.context, instance1['id'])
-        db.service_destroy(self.context, comp1['id'])
-
-    def test_instance_update_state(self):
-        # TODO(termie): what is this code even testing?
-        def instance(num):
-            return {
-                'reservation_id': 'r-1',
-                'instance_id': 'i-%s' % num,
-                'image_id': 'ami-%s' % num,
-                'private_dns_name': '10.0.0.%s' % num,
-                'dns_name': '10.0.0%s' % num,
-                'ami_launch_index': str(num),
-                'instance_type': 'fake',
-                'availability_zone': 'fake',
-                'key_name': None,
-                'kernel_id': 'fake',
-                'ramdisk_id': 'fake',
-                'groups': ['default'],
-                'product_codes': None,
-                'state': 0x01,
-                'user_data': ''}
-        rv = self.cloud._format_describe_instances(self.context)
-        logging.error(str(rv))
-        self.assertEqual(len(rv['reservationSet']), 0)
-
-        # simulate launch of 5 instances
-        # self.cloud.instances['pending'] = {}
-        #for i in xrange(5):
-        #    inst = instance(i)
-        #    self.cloud.instances['pending'][inst['instance_id']] = inst
-
-        #rv = self.cloud._format_instances(self.admin)
-        #self.assert_(len(rv['reservationSet']) == 1)
-        #self.assert_(len(rv['reservationSet'][0]['instances_set']) == 5)
-        # report 4 nodes each having 1 of the instances
-        #for i in xrange(4):
-        #    self.cloud.update_state('instances',
-        #                            {('node-%s' % i): {('i-%s' % i):
-        #                                               instance(i)}})
-
-        # one instance should be pending still
-        #self.assert_(len(self.cloud.instances['pending'].keys()) == 1)
-
-        # check that the reservations collapse
-        #rv = self.cloud._format_instances(self.admin)
-        #self.assert_(len(rv['reservationSet']) == 1)
-        #self.assert_(len(rv['reservationSet'][0]['instances_set']) == 5)
-
-        # check that we can get metadata for each instance
-        #for i in xrange(4):
-        #    data = self.cloud.get_metadata(instance(i)['private_dns_name'])
-        #    self.assert_(data['meta-data']['ami-id'] == 'ami-%s' % i)
-
     @staticmethod
     def _fake_set_image_description(ctxt, image_id, description):
         from nova.objectstore import handler
@@ -387,7 +355,7 @@ class CloudTestCase(test.TestCase):
 
     def test_update_of_instance_display_fields(self):
         inst = db.instance_create(self.context, {})
-        ec2_id = cloud.id_to_ec2_id(inst['id'])
+        ec2_id = ec2utils.id_to_ec2_id(inst['id'])
         self.cloud.update_instance(self.context, ec2_id,
                                    display_name='c00l 1m4g3')
         inst = db.instance_get(self.context, inst['id'])
@@ -405,7 +373,7 @@ class CloudTestCase(test.TestCase):
     def test_update_of_volume_display_fields(self):
         vol = db.volume_create(self.context, {})
         self.cloud.update_volume(self.context,
-                                 cloud.id_to_ec2_id(vol['id'], 'vol-%08x'),
+                                 ec2utils.id_to_ec2_id(vol['id'], 'vol-%08x'),
                                  display_name='c00l v0lum3')
         vol = db.volume_get(self.context, vol['id'])
         self.assertEqual('c00l v0lum3', vol['display_name'])
@@ -414,7 +382,7 @@ class CloudTestCase(test.TestCase):
     def test_update_of_volume_wont_update_private_fields(self):
         vol = db.volume_create(self.context, {})
         self.cloud.update_volume(self.context,
-                                 cloud.id_to_ec2_id(vol['id'], 'vol-%08x'),
+                                 ec2utils.id_to_ec2_id(vol['id'], 'vol-%08x'),
                                  mountpoint='/not/here')
         vol = db.volume_get(self.context, vol['id'])
         self.assertEqual(None, vol['mountpoint'])
diff --git a/nova/tests/test_compute.py b/nova/tests/test_compute.py
index b049ac943..e486050be 100644
--- a/nova/tests/test_compute.py
+++ b/nova/tests/test_compute.py
@@ -20,6 +20,7 @@ Tests For Compute
 """
 
 import datetime
+import mox
 
 from nova import compute
 from nova import context
@@ -27,14 +28,20 @@ from nova import db
 from nova import exception
 from nova import flags
 from nova import log as logging
+from nova import rpc
 from nova import test
 from nova import utils
 from nova.auth import manager
-
+from nova.compute import instance_types
+from nova.compute import manager as compute_manager
+from nova.compute import power_state
+from nova.db.sqlalchemy import models
+from nova.image import local
 
 LOG = logging.getLogger('nova.tests.compute')
 FLAGS = flags.FLAGS
 flags.DECLARE('stub_network', 'nova.compute.manager')
+flags.DECLARE('live_migration_retry_count', 'nova.compute.manager')
 
 
 class ComputeTestCase(test.TestCase):
@@ -51,15 +58,20 @@ class ComputeTestCase(test.TestCase):
         self.project = self.manager.create_project('fake', 'fake', 'fake')
         self.context = context.RequestContext('fake', 'fake', False)
 
+        def fake_show(meh, context, id):
+            return {'id': 1, 'properties': {'kernel_id': 1, 'ramdisk_id': 1}}
+
+        self.stubs.Set(local.LocalImageService, 'show', fake_show)
+
     def tearDown(self):
         self.manager.delete_user(self.user)
         self.manager.delete_project(self.project)
         super(ComputeTestCase, self).tearDown()
 
-    def _create_instance(self):
+    def _create_instance(self, params={}):
         """Create a test instance"""
         inst = {}
-        inst['image_id'] = 'ami-test'
+        inst['image_id'] = 1
         inst['reservation_id'] = 'r-fakeres'
         inst['launch_time'] = '10'
         inst['user_id'] = self.user.id
@@ -67,6 +79,7 @@ class ComputeTestCase(test.TestCase):
         inst['instance_type'] = 'm1.tiny'
         inst['mac_address'] = utils.generate_mac()
         inst['ami_launch_index'] = 0
+        inst.update(params)
         return db.instance_create(self.context, inst)['id']
 
     def _create_group(self):
@@ -76,6 +89,41 @@ class ComputeTestCase(test.TestCase):
                   'project_id': self.project.id}
         return db.security_group_create(self.context, values)
 
+    def _get_dummy_instance(self):
+        """Get mock-return-value instance object
+           Use this when any testcase executed later than test_run_terminate
+        """
+        vol1 = models.Volume()
+        vol1['id'] = 1
+        vol2 = models.Volume()
+        vol2['id'] = 2
+        instance_ref = models.Instance()
+        instance_ref['id'] = 1
+        instance_ref['volumes'] = [vol1, vol2]
+        instance_ref['hostname'] = 'i-00000001'
+        instance_ref['host'] = 'dummy'
+        return instance_ref
+
+    def test_create_instance_defaults_display_name(self):
+        """Verify that an instance cannot be created without a display_name."""
+        cases = [dict(), dict(display_name=None)]
+        for instance in cases:
+            ref = self.compute_api.create(self.context,
+                FLAGS.default_instance_type, None, **instance)
+            try:
+                self.assertNotEqual(ref[0]['display_name'], None)
+            finally:
+                db.instance_destroy(self.context, ref[0]['id'])
+
+    def test_create_instance_associates_security_groups(self):
+        """Make sure create associates security groups"""
+        group = self._create_group()
+        instance_ref = models.Instance()
+        instance_ref['id'] = 1
+        instance_ref['volumes'] = [{'id': 1}, {'id': 2}]
+        instance_ref['hostname'] = 'i-00000001'
+        return instance_ref
+
     def test_create_instance_defaults_display_name(self):
         """Verify that an instance cannot be created without a display_name."""
         cases = [dict(), dict(display_name=None)]
@@ -266,3 +314,284 @@ class ComputeTestCase(test.TestCase):
         self.assertEqual(ret_val, None)
 
         self.compute.terminate_instance(self.context, instance_id)
+
+    def test_resize_instance(self):
+        """Ensure instance can be migrated/resized"""
+        instance_id = self._create_instance()
+        context = self.context.elevated()
+        self.compute.run_instance(self.context, instance_id)
+        db.instance_update(self.context, instance_id, {'host': 'foo'})
+        self.compute.prep_resize(context, instance_id)
+        migration_ref = db.migration_get_by_instance_and_status(context,
+                instance_id, 'pre-migrating')
+        self.compute.resize_instance(context, instance_id,
+                migration_ref['id'])
+        self.compute.terminate_instance(context, instance_id)
+
+    def test_get_by_flavor_id(self):
+        type = instance_types.get_by_flavor_id(1)
+        self.assertEqual(type, 'm1.tiny')
+
+    def test_resize_same_source_fails(self):
+        """Ensure instance fails to migrate when source and destination are
+        the same host"""
+        instance_id = self._create_instance()
+        self.compute.run_instance(self.context, instance_id)
+        self.assertRaises(exception.Error, self.compute.prep_resize,
+                self.context, instance_id)
+        self.compute.terminate_instance(self.context, instance_id)
+        type = instance_types.get_by_flavor_id("1")
+        self.assertEqual(type, 'm1.tiny')
+
+    def _setup_other_managers(self):
+        self.volume_manager = utils.import_object(FLAGS.volume_manager)
+        self.network_manager = utils.import_object(FLAGS.network_manager)
+        self.compute_driver = utils.import_object(FLAGS.compute_driver)
+
+    def test_pre_live_migration_instance_has_no_fixed_ip(self):
+        """Confirm raising exception if instance doesn't have fixed_ip."""
+        instance_ref = self._get_dummy_instance()
+        c = context.get_admin_context()
+        i_id = instance_ref['id']
+
+        dbmock = self.mox.CreateMock(db)
+        dbmock.instance_get(c, i_id).AndReturn(instance_ref)
+        dbmock.instance_get_fixed_address(c, i_id).AndReturn(None)
+
+        self.compute.db = dbmock
+        self.mox.ReplayAll()
+        self.assertRaises(exception.NotFound,
+                          self.compute.pre_live_migration,
+                          c, instance_ref['id'])
+
+    def test_pre_live_migration_instance_has_volume(self):
+        """Confirm setup_compute_volume is called when volume is mounted."""
+        i_ref = self._get_dummy_instance()
+        c = context.get_admin_context()
+
+        self._setup_other_managers()
+        dbmock = self.mox.CreateMock(db)
+        volmock = self.mox.CreateMock(self.volume_manager)
+        netmock = self.mox.CreateMock(self.network_manager)
+        drivermock = self.mox.CreateMock(self.compute_driver)
+
+        dbmock.instance_get(c, i_ref['id']).AndReturn(i_ref)
+        dbmock.instance_get_fixed_address(c, i_ref['id']).AndReturn('dummy')
+        for i in range(len(i_ref['volumes'])):
+            vid = i_ref['volumes'][i]['id']
+            volmock.setup_compute_volume(c, vid).InAnyOrder('g1')
+        netmock.setup_compute_network(c, i_ref['id'])
+        drivermock.ensure_filtering_rules_for_instance(i_ref)
+
+        self.compute.db = dbmock
+        self.compute.volume_manager = volmock
+        self.compute.network_manager = netmock
+        self.compute.driver = drivermock
+
+        self.mox.ReplayAll()
+        ret = self.compute.pre_live_migration(c, i_ref['id'])
+        self.assertEqual(ret, None)
+
+    def test_pre_live_migration_instance_has_no_volume(self):
+        """Confirm log meg when instance doesn't mount any volumes."""
+        i_ref = self._get_dummy_instance()
+        i_ref['volumes'] = []
+        c = context.get_admin_context()
+
+        self._setup_other_managers()
+        dbmock = self.mox.CreateMock(db)
+        netmock = self.mox.CreateMock(self.network_manager)
+        drivermock = self.mox.CreateMock(self.compute_driver)
+
+        dbmock.instance_get(c, i_ref['id']).AndReturn(i_ref)
+        dbmock.instance_get_fixed_address(c, i_ref['id']).AndReturn('dummy')
+        self.mox.StubOutWithMock(compute_manager.LOG, 'info')
+        compute_manager.LOG.info(_("%s has no volume."), i_ref['hostname'])
+        netmock.setup_compute_network(c, i_ref['id'])
+        drivermock.ensure_filtering_rules_for_instance(i_ref)
+
+        self.compute.db = dbmock
+        self.compute.network_manager = netmock
+        self.compute.driver = drivermock
+
+        self.mox.ReplayAll()
+        ret = self.compute.pre_live_migration(c, i_ref['id'])
+        self.assertEqual(ret, None)
+
+    def test_pre_live_migration_setup_compute_node_fail(self):
+        """Confirm operation setup_compute_network() fails.
+
+        It retries and raise exception when timeout exceeded.
+
+        """
+
+        i_ref = self._get_dummy_instance()
+        c = context.get_admin_context()
+
+        self._setup_other_managers()
+        dbmock = self.mox.CreateMock(db)
+        netmock = self.mox.CreateMock(self.network_manager)
+        volmock = self.mox.CreateMock(self.volume_manager)
+
+        dbmock.instance_get(c, i_ref['id']).AndReturn(i_ref)
+        dbmock.instance_get_fixed_address(c, i_ref['id']).AndReturn('dummy')
+        for i in range(len(i_ref['volumes'])):
+            volmock.setup_compute_volume(c, i_ref['volumes'][i]['id'])
+        for i in range(FLAGS.live_migration_retry_count):
+            netmock.setup_compute_network(c, i_ref['id']).\
+                AndRaise(exception.ProcessExecutionError())
+
+        self.compute.db = dbmock
+        self.compute.network_manager = netmock
+        self.compute.volume_manager = volmock
+
+        self.mox.ReplayAll()
+        self.assertRaises(exception.ProcessExecutionError,
+                          self.compute.pre_live_migration,
+                          c, i_ref['id'])
+
+    def test_live_migration_works_correctly_with_volume(self):
+        """Confirm check_for_export to confirm volume health check."""
+        i_ref = self._get_dummy_instance()
+        c = context.get_admin_context()
+        topic = db.queue_get_for(c, FLAGS.compute_topic, i_ref['host'])
+
+        dbmock = self.mox.CreateMock(db)
+        dbmock.instance_get(c, i_ref['id']).AndReturn(i_ref)
+        self.mox.StubOutWithMock(rpc, 'call')
+        rpc.call(c, FLAGS.volume_topic, {"method": "check_for_export",
+                                         "args": {'instance_id': i_ref['id']}})
+        dbmock.queue_get_for(c, FLAGS.compute_topic, i_ref['host']).\
+                             AndReturn(topic)
+        rpc.call(c, topic, {"method": "pre_live_migration",
+                            "args": {'instance_id': i_ref['id']}})
+        self.mox.StubOutWithMock(self.compute.driver, 'live_migration')
+        self.compute.driver.live_migration(c, i_ref, i_ref['host'],
+                                  self.compute.post_live_migration,
+                                  self.compute.recover_live_migration)
+
+        self.compute.db = dbmock
+        self.mox.ReplayAll()
+        ret = self.compute.live_migration(c, i_ref['id'], i_ref['host'])
+        self.assertEqual(ret, None)
+
+    def test_live_migration_dest_raises_exception(self):
+        """Confirm exception when pre_live_migration fails."""
+        i_ref = self._get_dummy_instance()
+        c = context.get_admin_context()
+        topic = db.queue_get_for(c, FLAGS.compute_topic, i_ref['host'])
+
+        dbmock = self.mox.CreateMock(db)
+        dbmock.instance_get(c, i_ref['id']).AndReturn(i_ref)
+        self.mox.StubOutWithMock(rpc, 'call')
+        rpc.call(c, FLAGS.volume_topic, {"method": "check_for_export",
+                                         "args": {'instance_id': i_ref['id']}})
+        dbmock.queue_get_for(c, FLAGS.compute_topic, i_ref['host']).\
+                             AndReturn(topic)
+        rpc.call(c, topic, {"method": "pre_live_migration",
+                            "args": {'instance_id': i_ref['id']}}).\
+                            AndRaise(rpc.RemoteError('', '', ''))
+        dbmock.instance_update(c, i_ref['id'], {'state_description': 'running',
+                                                'state': power_state.RUNNING,
+                                                'host': i_ref['host']})
+        for v in i_ref['volumes']:
+            dbmock.volume_update(c, v['id'], {'status': 'in-use'})
+
+        self.compute.db = dbmock
+        self.mox.ReplayAll()
+        self.assertRaises(rpc.RemoteError,
+                          self.compute.live_migration,
+                          c, i_ref['id'], i_ref['host'])
+
+    def test_live_migration_dest_raises_exception_no_volume(self):
+        """Same as above test(input pattern is different) """
+        i_ref = self._get_dummy_instance()
+        i_ref['volumes'] = []
+        c = context.get_admin_context()
+        topic = db.queue_get_for(c, FLAGS.compute_topic, i_ref['host'])
+
+        dbmock = self.mox.CreateMock(db)
+        dbmock.instance_get(c, i_ref['id']).AndReturn(i_ref)
+        dbmock.queue_get_for(c, FLAGS.compute_topic, i_ref['host']).\
+                             AndReturn(topic)
+        self.mox.StubOutWithMock(rpc, 'call')
+        rpc.call(c, topic, {"method": "pre_live_migration",
+                            "args": {'instance_id': i_ref['id']}}).\
+                            AndRaise(rpc.RemoteError('', '', ''))
+        dbmock.instance_update(c, i_ref['id'], {'state_description': 'running',
+                                                'state': power_state.RUNNING,
+                                                'host': i_ref['host']})
+
+        self.compute.db = dbmock
+        self.mox.ReplayAll()
+        self.assertRaises(rpc.RemoteError,
+                          self.compute.live_migration,
+                          c, i_ref['id'], i_ref['host'])
+
+    def test_live_migration_works_correctly_no_volume(self):
+        """Confirm live_migration() works as expected correctly."""
+        i_ref = self._get_dummy_instance()
+        i_ref['volumes'] = []
+        c = context.get_admin_context()
+        topic = db.queue_get_for(c, FLAGS.compute_topic, i_ref['host'])
+
+        dbmock = self.mox.CreateMock(db)
+        dbmock.instance_get(c, i_ref['id']).AndReturn(i_ref)
+        self.mox.StubOutWithMock(rpc, 'call')
+        dbmock.queue_get_for(c, FLAGS.compute_topic, i_ref['host']).\
+                             AndReturn(topic)
+        rpc.call(c, topic, {"method": "pre_live_migration",
+                            "args": {'instance_id': i_ref['id']}})
+        self.mox.StubOutWithMock(self.compute.driver, 'live_migration')
+        self.compute.driver.live_migration(c, i_ref, i_ref['host'],
+                                  self.compute.post_live_migration,
+                                  self.compute.recover_live_migration)
+
+        self.compute.db = dbmock
+        self.mox.ReplayAll()
+        ret = self.compute.live_migration(c, i_ref['id'], i_ref['host'])
+        self.assertEqual(ret, None)
+
+    def test_post_live_migration_working_correctly(self):
+        """Confirm post_live_migration() works as expected correctly."""
+        dest = 'desthost'
+        flo_addr = '1.2.1.2'
+
+        # Preparing datas
+        c = context.get_admin_context()
+        instance_id = self._create_instance()
+        i_ref = db.instance_get(c, instance_id)
+        db.instance_update(c, i_ref['id'], {'state_description': 'migrating',
+                                            'state': power_state.PAUSED})
+        v_ref = db.volume_create(c, {'size': 1, 'instance_id': instance_id})
+        fix_addr = db.fixed_ip_create(c, {'address': '1.1.1.1',
+                                          'instance_id': instance_id})
+        fix_ref = db.fixed_ip_get_by_address(c, fix_addr)
+        flo_ref = db.floating_ip_create(c, {'address': flo_addr,
+                                        'fixed_ip_id': fix_ref['id']})
+        # reload is necessary before setting mocks
+        i_ref = db.instance_get(c, instance_id)
+
+        # Preparing mocks
+        self.mox.StubOutWithMock(self.compute.volume_manager,
+                                 'remove_compute_volume')
+        for v in i_ref['volumes']:
+            self.compute.volume_manager.remove_compute_volume(c, v['id'])
+        self.mox.StubOutWithMock(self.compute.driver, 'unfilter_instance')
+        self.compute.driver.unfilter_instance(i_ref)
+
+        # executing
+        self.mox.ReplayAll()
+        ret = self.compute.post_live_migration(c, i_ref, dest)
+
+        # make sure every data is rewritten to dest
+        i_ref = db.instance_get(c, i_ref['id'])
+        c1 = (i_ref['host'] == dest)
+        flo_refs = db.floating_ip_get_all_by_host(c, dest)
+        c2 = (len(flo_refs) != 0 and flo_refs[0]['address'] == flo_addr)
+
+        # post operaton
+        self.assertTrue(c1 and c2)
+        db.instance_destroy(c, instance_id)
+        db.volume_destroy(c, v_ref['id'])
+        db.floating_ip_destroy(c, flo_addr)
diff --git a/nova/tests/test_console.py b/nova/tests/test_console.py
index 85bf94458..d47c70d88 100644
--- a/nova/tests/test_console.py
+++ b/nova/tests/test_console.py
@@ -21,7 +21,6 @@ Tests For Console proxy.
 """
 
 import datetime
-import logging
 
 from nova import context
 from nova import db
@@ -38,7 +37,6 @@ FLAGS = flags.FLAGS
 class ConsoleTestCase(test.TestCase):
     """Test case for console proxy"""
     def setUp(self):
-        logging.getLogger().setLevel(logging.DEBUG)
         super(ConsoleTestCase, self).setUp()
         self.flags(console_driver='nova.console.fake.FakeConsoleProxy',
                    stub_compute=True)
@@ -59,7 +57,7 @@ class ConsoleTestCase(test.TestCase):
         inst = {}
         #inst['host'] = self.host
         #inst['name'] = 'instance-1234'
-        inst['image_id'] = 'ami-test'
+        inst['image_id'] = 1
         inst['reservation_id'] = 'r-fakeres'
         inst['launch_time'] = '10'
         inst['user_id'] = self.user.id
diff --git a/nova/tests/test_direct.py b/nova/tests/test_direct.py
index 8a74b2296..80e4d2e1f 100644
--- a/nova/tests/test_direct.py
+++ b/nova/tests/test_direct.py
@@ -19,7 +19,6 @@
 """Tests for Direct API."""
 
 import json
-import logging
 
 import webob
 
@@ -53,12 +52,14 @@ class DirectTestCase(test.TestCase):
 
     def tearDown(self):
         direct.ROUTES = {}
+        super(DirectTestCase, self).tearDown()
 
     def test_delegated_auth(self):
         req = webob.Request.blank('/fake/context')
         req.headers['X-OpenStack-User'] = 'user1'
         req.headers['X-OpenStack-Project'] = 'proj1'
         resp = req.get_response(self.auth_router)
+        self.assertEqual(resp.status_int, 200)
         data = json.loads(resp.body)
         self.assertEqual(data['user'], 'user1')
         self.assertEqual(data['project'], 'proj1')
@@ -69,6 +70,7 @@ class DirectTestCase(test.TestCase):
         req.method = 'POST'
         req.body = 'json=%s' % json.dumps({'data': 'foo'})
         resp = req.get_response(self.router)
+        self.assertEqual(resp.status_int, 200)
         resp_parsed = json.loads(resp.body)
         self.assertEqual(resp_parsed['data'], 'foo')
 
@@ -78,6 +80,7 @@ class DirectTestCase(test.TestCase):
         req.method = 'POST'
         req.body = 'data=foo'
         resp = req.get_response(self.router)
+        self.assertEqual(resp.status_int, 200)
         resp_parsed = json.loads(resp.body)
         self.assertEqual(resp_parsed['data'], 'foo')
 
@@ -90,8 +93,7 @@ class DirectTestCase(test.TestCase):
 class DirectCloudTestCase(test_cloud.CloudTestCase):
     def setUp(self):
         super(DirectCloudTestCase, self).setUp()
-        compute_handle = compute.API(image_service=self.cloud.image_service,
-                                     network_api=self.cloud.network_api,
+        compute_handle = compute.API(network_api=self.cloud.network_api,
                                      volume_api=self.cloud.volume_api)
         direct.register_service('compute', compute_handle)
         self.router = direct.JsonParamsMiddleware(direct.Router())
diff --git a/nova/tests/test_instance_types.py b/nova/tests/test_instance_types.py
new file mode 100644
index 000000000..edc538879
--- /dev/null
+++ b/nova/tests/test_instance_types.py
@@ -0,0 +1,86 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2011 Ken Pepple
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+"""
+Unit Tests for instance types code
+"""
+import time
+
+from nova import context
+from nova import db
+from nova import exception
+from nova import flags
+from nova import log as logging
+from nova import test
+from nova import utils
+from nova.compute import instance_types
+from nova.db.sqlalchemy.session import get_session
+from nova.db.sqlalchemy import models
+
+FLAGS = flags.FLAGS
+LOG = logging.getLogger('nova.tests.compute')
+
+
+class InstanceTypeTestCase(test.TestCase):
+    """Test cases for instance type code"""
+    def setUp(self):
+        super(InstanceTypeTestCase, self).setUp()
+        session = get_session()
+        max_flavorid = session.query(models.InstanceTypes).\
+                                     order_by("flavorid desc").\
+                                     first()
+        self.flavorid = max_flavorid["flavorid"] + 1
+        self.name = str(int(time.time()))
+
+    def test_instance_type_create_then_delete(self):
+        """Ensure instance types can be created"""
+        starting_inst_list = instance_types.get_all_types()
+        instance_types.create(self.name, 256, 1, 120, self.flavorid)
+        new = instance_types.get_all_types()
+        self.assertNotEqual(len(starting_inst_list),
+                            len(new),
+                            'instance type was not created')
+        instance_types.destroy(self.name)
+        self.assertEqual(1,
+                    instance_types.get_instance_type(self.name)["deleted"])
+        self.assertEqual(starting_inst_list, instance_types.get_all_types())
+        instance_types.purge(self.name)
+        self.assertEqual(len(starting_inst_list),
+                         len(instance_types.get_all_types()),
+                         'instance type not purged')
+
+    def test_get_all_instance_types(self):
+        """Ensures that all instance types can be retrieved"""
+        session = get_session()
+        total_instance_types = session.query(models.InstanceTypes).\
+                                            count()
+        inst_types = instance_types.get_all_types()
+        self.assertEqual(total_instance_types, len(inst_types))
+
+    def test_invalid_create_args_should_fail(self):
+        """Ensures that instance type creation fails with invalid args"""
+        self.assertRaises(
+                exception.InvalidInputException,
+                instance_types.create, self.name, 0, 1, 120, self.flavorid)
+        self.assertRaises(
+                exception.InvalidInputException,
+                instance_types.create, self.name, 256, -1, 120, self.flavorid)
+        self.assertRaises(
+                exception.InvalidInputException,
+                instance_types.create, self.name, 256, 1, "aa", self.flavorid)
+
+    def test_non_existant_inst_type_shouldnt_delete(self):
+        """Ensures that instance type creation fails with invalid args"""
+        self.assertRaises(exception.ApiError,
+                          instance_types.destroy, "sfsfsdfdfs")
diff --git a/nova/tests/test_localization.py b/nova/tests/test_localization.py
index 6992773f5..393d71038 100644
--- a/nova/tests/test_localization.py
+++ b/nova/tests/test_localization.py
@@ -15,7 +15,6 @@
 #    under the License.
 
 import glob
-import logging
 import os
 import re
 import sys
diff --git a/nova/tests/test_log.py b/nova/tests/test_log.py
index c2c9d7772..122351ff6 100644
--- a/nova/tests/test_log.py
+++ b/nova/tests/test_log.py
@@ -1,9 +1,12 @@
 import cStringIO
 
 from nova import context
+from nova import flags
 from nova import log
 from nova import test
 
+FLAGS = flags.FLAGS
+
 
 def _fake_context():
     return context.RequestContext(1, 1)
@@ -14,15 +17,11 @@ class RootLoggerTestCase(test.TestCase):
         super(RootLoggerTestCase, self).setUp()
         self.log = log.logging.root
 
-    def tearDown(self):
-        super(RootLoggerTestCase, self).tearDown()
-        log.NovaLogger.manager.loggerDict = {}
-
     def test_is_nova_instance(self):
         self.assert_(isinstance(self.log, log.NovaLogger))
 
-    def test_name_is_nova_root(self):
-        self.assertEqual("nova.root", self.log.name)
+    def test_name_is_nova(self):
+        self.assertEqual("nova", self.log.name)
 
     def test_handlers_have_nova_formatter(self):
         formatters = []
@@ -45,25 +44,36 @@ class RootLoggerTestCase(test.TestCase):
         log.audit("foo", context=_fake_context())
         self.assert_(True)  # didn't raise exception
 
+    def test_will_be_verbose_if_verbose_flag_set(self):
+        self.flags(verbose=True)
+        log.reset()
+        self.assertEqual(log.DEBUG, self.log.level)
+
+    def test_will_not_be_verbose_if_verbose_flag_not_set(self):
+        self.flags(verbose=False)
+        log.reset()
+        self.assertEqual(log.INFO, self.log.level)
+
 
 class LogHandlerTestCase(test.TestCase):
     def test_log_path_logdir(self):
-        self.flags(logdir='/some/path')
-        self.assertEquals(log.get_log_file_path(binary='foo-bar'),
+        self.flags(logdir='/some/path', logfile=None)
+        self.assertEquals(log._get_log_file_path(binary='foo-bar'),
                          '/some/path/foo-bar.log')
 
     def test_log_path_logfile(self):
         self.flags(logfile='/some/path/foo-bar.log')
-        self.assertEquals(log.get_log_file_path(binary='foo-bar'),
+        self.assertEquals(log._get_log_file_path(binary='foo-bar'),
                          '/some/path/foo-bar.log')
 
     def test_log_path_none(self):
-        self.assertTrue(log.get_log_file_path(binary='foo-bar') is None)
+        self.flags(logdir=None, logfile=None)
+        self.assertTrue(log._get_log_file_path(binary='foo-bar') is None)
 
     def test_log_path_logfile_overrides_logdir(self):
         self.flags(logdir='/some/other/path',
                    logfile='/some/path/foo-bar.log')
-        self.assertEquals(log.get_log_file_path(binary='foo-bar'),
+        self.assertEquals(log._get_log_file_path(binary='foo-bar'),
                          '/some/path/foo-bar.log')
 
 
@@ -76,13 +86,15 @@ class NovaFormatterTestCase(test.TestCase):
                    logging_debug_format_suffix="--DBG")
         self.log = log.logging.root
         self.stream = cStringIO.StringIO()
-        handler = log.StreamHandler(self.stream)
-        self.log.addHandler(handler)
+        self.handler = log.StreamHandler(self.stream)
+        self.log.addHandler(self.handler)
+        self.level = self.log.level
         self.log.setLevel(log.DEBUG)
 
     def tearDown(self):
+        self.log.setLevel(self.level)
+        self.log.removeHandler(self.handler)
         super(NovaFormatterTestCase, self).tearDown()
-        log.NovaLogger.manager.loggerDict = {}
 
     def test_uncontextualized_log(self):
         self.log.info("foo")
@@ -102,30 +114,15 @@ class NovaFormatterTestCase(test.TestCase):
 class NovaLoggerTestCase(test.TestCase):
     def setUp(self):
         super(NovaLoggerTestCase, self).setUp()
-        self.flags(default_log_levels=["nova-test=AUDIT"], verbose=False)
+        levels = FLAGS.default_log_levels
+        levels.append("nova-test=AUDIT")
+        self.flags(default_log_levels=levels,
+                   verbose=True)
         self.log = log.getLogger('nova-test')
 
-    def tearDown(self):
-        super(NovaLoggerTestCase, self).tearDown()
-        log.NovaLogger.manager.loggerDict = {}
-
     def test_has_level_from_flags(self):
         self.assertEqual(log.AUDIT, self.log.level)
 
     def test_child_log_has_level_of_parent_flag(self):
         l = log.getLogger('nova-test.foo')
         self.assertEqual(log.AUDIT, l.level)
-
-
-class VerboseLoggerTestCase(test.TestCase):
-    def setUp(self):
-        super(VerboseLoggerTestCase, self).setUp()
-        self.flags(default_log_levels=["nova.test=AUDIT"], verbose=True)
-        self.log = log.getLogger('nova.test')
-
-    def tearDown(self):
-        super(VerboseLoggerTestCase, self).tearDown()
-        log.NovaLogger.manager.loggerDict = {}
-
-    def test_will_be_verbose_if_named_nova_and_verbose_flag_set(self):
-        self.assertEqual(log.DEBUG, self.log.level)
diff --git a/nova/tests/test_misc.py b/nova/tests/test_misc.py
index 33c1777d5..a658e4978 100644
--- a/nova/tests/test_misc.py
+++ b/nova/tests/test_misc.py
@@ -14,10 +14,12 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import errno
 import os
+import select
 
 from nova import test
-from nova.utils import parse_mailmap, str_dict_replace
+from nova.utils import parse_mailmap, str_dict_replace, synchronized
 
 
 class ProjectTestCase(test.TestCase):
@@ -46,6 +48,8 @@ class ProjectTestCase(test.TestCase):
 
                 missing = set()
                 for contributor in contributors:
+                    if contributor == 'nova-core':
+                        continue
                     if not contributor in authors_file:
                         missing.add(contributor)
 
@@ -53,3 +57,47 @@ class ProjectTestCase(test.TestCase):
                                 '%r not listed in Authors' % missing)
             finally:
                 tree.unlock()
+
+
+class LockTestCase(test.TestCase):
+    def test_synchronized_wrapped_function_metadata(self):
+        @synchronized('whatever')
+        def foo():
+            """Bar"""
+            pass
+        self.assertEquals(foo.__doc__, 'Bar', "Wrapped function's docstring "
+                                              "got lost")
+        self.assertEquals(foo.__name__, 'foo', "Wrapped function's name "
+                                               "got mangled")
+
+    def test_synchronized(self):
+        rpipe1, wpipe1 = os.pipe()
+        rpipe2, wpipe2 = os.pipe()
+
+        @synchronized('testlock')
+        def f(rpipe, wpipe):
+            try:
+                os.write(wpipe, "foo")
+            except OSError, e:
+                self.assertEquals(e.errno, errno.EPIPE)
+                return
+
+            rfds, _, __ = select.select([rpipe], [], [], 1)
+            self.assertEquals(len(rfds), 0, "The other process, which was"
+                                            " supposed to be locked, "
+                                            "wrote on its end of the "
+                                            "pipe")
+            os.close(rpipe)
+
+        pid = os.fork()
+        if pid > 0:
+            os.close(wpipe1)
+            os.close(rpipe2)
+
+            f(rpipe1, wpipe2)
+        else:
+            os.close(rpipe1)
+            os.close(wpipe2)
+
+            f(rpipe2, wpipe1)
+            os._exit(0)
diff --git a/nova/tests/test_network.py b/nova/tests/test_network.py
index 00f9323f3..1e634b388 100644
--- a/nova/tests/test_network.py
+++ b/nova/tests/test_network.py
@@ -20,6 +20,7 @@ Unit Tests for network code
 """
 import IPy
 import os
+import time
 
 from nova import context
 from nova import db
@@ -29,11 +30,153 @@ from nova import log as logging
 from nova import test
 from nova import utils
 from nova.auth import manager
+from nova.network import linux_net
 
 FLAGS = flags.FLAGS
 LOG = logging.getLogger('nova.tests.network')
 
 
+class IptablesManagerTestCase(test.TestCase):
+    sample_filter = ['#Generated by iptables-save on Fri Feb 18 15:17:05 2011',
+                     '*filter',
+                     ':INPUT ACCEPT [2223527:305688874]',
+                     ':FORWARD ACCEPT [0:0]',
+                     ':OUTPUT ACCEPT [2172501:140856656]',
+                     ':nova-compute-FORWARD - [0:0]',
+                     ':nova-compute-INPUT - [0:0]',
+                     ':nova-compute-local - [0:0]',
+                     ':nova-compute-OUTPUT - [0:0]',
+                     ':nova-filter-top - [0:0]',
+                     '-A FORWARD -j nova-filter-top ',
+                     '-A OUTPUT -j nova-filter-top ',
+                     '-A nova-filter-top -j nova-compute-local ',
+                     '-A INPUT -j nova-compute-INPUT ',
+                     '-A OUTPUT -j nova-compute-OUTPUT ',
+                     '-A FORWARD -j nova-compute-FORWARD ',
+                     '-A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT ',
+                     '-A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT ',
+                     '-A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT ',
+                     '-A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT ',
+                     '-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT ',
+                     '-A FORWARD -i virbr0 -o virbr0 -j ACCEPT ',
+                     '-A FORWARD -o virbr0 -j REJECT --reject-with '
+                     'icmp-port-unreachable ',
+                     '-A FORWARD -i virbr0 -j REJECT --reject-with '
+                     'icmp-port-unreachable ',
+                     'COMMIT',
+                     '# Completed on Fri Feb 18 15:17:05 2011']
+
+    sample_nat = ['# Generated by iptables-save on Fri Feb 18 15:17:05 2011',
+                  '*nat',
+                  ':PREROUTING ACCEPT [3936:762355]',
+                  ':INPUT ACCEPT [2447:225266]',
+                  ':OUTPUT ACCEPT [63491:4191863]',
+                  ':POSTROUTING ACCEPT [63112:4108641]',
+                  ':nova-compute-OUTPUT - [0:0]',
+                  ':nova-compute-floating-ip-snat - [0:0]',
+                  ':nova-compute-SNATTING - [0:0]',
+                  ':nova-compute-PREROUTING - [0:0]',
+                  ':nova-compute-POSTROUTING - [0:0]',
+                  ':nova-postrouting-bottom - [0:0]',
+                  '-A PREROUTING -j nova-compute-PREROUTING ',
+                  '-A OUTPUT -j nova-compute-OUTPUT ',
+                  '-A POSTROUTING -j nova-compute-POSTROUTING ',
+                  '-A POSTROUTING -j nova-postrouting-bottom ',
+                  '-A nova-postrouting-bottom -j nova-compute-SNATTING ',
+                  '-A nova-compute-SNATTING -j nova-compute-floating-ip-snat ',
+                  'COMMIT',
+                  '# Completed on Fri Feb 18 15:17:05 2011']
+
+    def setUp(self):
+        super(IptablesManagerTestCase, self).setUp()
+        self.manager = linux_net.IptablesManager()
+
+    def test_filter_rules_are_wrapped(self):
+        current_lines = self.sample_filter
+
+        table = self.manager.ipv4['filter']
+        table.add_rule('FORWARD', '-s 1.2.3.4/5 -j DROP')
+        new_lines = self.manager._modify_rules(current_lines, table)
+        self.assertTrue('-A run_tests.py-FORWARD '
+                        '-s 1.2.3.4/5 -j DROP' in new_lines)
+
+        table.remove_rule('FORWARD', '-s 1.2.3.4/5 -j DROP')
+        new_lines = self.manager._modify_rules(current_lines, table)
+        self.assertTrue('-A run_tests.py-FORWARD '
+                        '-s 1.2.3.4/5 -j DROP' not in new_lines)
+
+    def test_nat_rules(self):
+        current_lines = self.sample_nat
+        new_lines = self.manager._modify_rules(current_lines,
+                                               self.manager.ipv4['nat'])
+
+        for line in [':nova-compute-OUTPUT - [0:0]',
+                     ':nova-compute-floating-ip-snat - [0:0]',
+                     ':nova-compute-SNATTING - [0:0]',
+                     ':nova-compute-PREROUTING - [0:0]',
+                     ':nova-compute-POSTROUTING - [0:0]']:
+            self.assertTrue(line in new_lines, "One of nova-compute's chains "
+                                               "went missing.")
+
+        seen_lines = set()
+        for line in new_lines:
+            line = line.strip()
+            self.assertTrue(line not in seen_lines,
+                            "Duplicate line: %s" % line)
+            seen_lines.add(line)
+
+        last_postrouting_line = ''
+
+        for line in new_lines:
+            if line.startswith('-A POSTROUTING'):
+                last_postrouting_line = line
+
+        self.assertTrue('-j nova-postrouting-bottom' in last_postrouting_line,
+                        "Last POSTROUTING rule does not jump to "
+                        "nova-postouting-bottom: %s" % last_postrouting_line)
+
+        for chain in ['POSTROUTING', 'PREROUTING', 'OUTPUT']:
+            self.assertTrue('-A %s -j run_tests.py-%s' \
+                            % (chain, chain) in new_lines,
+                            "Built-in chain %s not wrapped" % (chain,))
+
+    def test_filter_rules(self):
+        current_lines = self.sample_filter
+        new_lines = self.manager._modify_rules(current_lines,
+                                               self.manager.ipv4['filter'])
+
+        for line in [':nova-compute-FORWARD - [0:0]',
+                     ':nova-compute-INPUT - [0:0]',
+                     ':nova-compute-local - [0:0]',
+                     ':nova-compute-OUTPUT - [0:0]']:
+            self.assertTrue(line in new_lines, "One of nova-compute's chains"
+                                               " went missing.")
+
+        seen_lines = set()
+        for line in new_lines:
+            line = line.strip()
+            self.assertTrue(line not in seen_lines,
+                            "Duplicate line: %s" % line)
+            seen_lines.add(line)
+
+        for chain in ['FORWARD', 'OUTPUT']:
+            for line in new_lines:
+                if line.startswith('-A %s' % chain):
+                    self.assertTrue('-j nova-filter-top' in line,
+                                    "First %s rule does not "
+                                    "jump to nova-filter-top" % chain)
+                    break
+
+        self.assertTrue('-A nova-filter-top '
+                        '-j run_tests.py-local' in new_lines,
+                        "nova-filter-top does not jump to wrapped local chain")
+
+        for chain in ['INPUT', 'OUTPUT', 'FORWARD']:
+            self.assertTrue('-A %s -j run_tests.py-%s' \
+                            % (chain, chain) in new_lines,
+                            "Built-in chain %s not wrapped" % (chain,))
+
+
 class NetworkTestCase(test.TestCase):
     """Test cases for network code"""
     def setUp(self):
@@ -42,15 +185,13 @@ class NetworkTestCase(test.TestCase):
         #             flags in the corresponding section in nova-dhcpbridge
         self.flags(connection_type='fake',
                    fake_call=True,
-                   fake_network=True,
-                   network_size=16,
-                   num_networks=5)
+                   fake_network=True)
         self.manager = manager.AuthManager()
         self.user = self.manager.create_user('netuser', 'netuser', 'netuser')
         self.projects = []
         self.network = utils.import_object(FLAGS.network_manager)
         self.context = context.RequestContext(project=None, user=self.user)
-        for i in range(5):
+        for i in range(FLAGS.num_networks):
             name = 'project%s' % i
             project = self.manager.create_project(name, 'netuser', name)
             self.projects.append(project)
@@ -117,6 +258,9 @@ class NetworkTestCase(test.TestCase):
                              utils.to_global_ipv6(
                                                  network_ref['cidr_v6'],
                                                  instance_ref['mac_address']))
+            self._deallocate_address(0, address)
+            db.instance_destroy(context.get_admin_context(),
+                                instance_ref['id'])
 
     def test_public_network_association(self):
         """Makes sure that we can allocaate a public ip"""
@@ -192,7 +336,7 @@ class NetworkTestCase(test.TestCase):
         first = self._create_address(0)
         lease_ip(first)
         instance_ids = []
-        for i in range(1, 5):
+        for i in range(1, FLAGS.num_networks):
             instance_ref = self._create_instance(i, mac=utils.generate_mac())
             instance_ids.append(instance_ref['id'])
             address = self._create_address(i, instance_ref['id'])
@@ -320,6 +464,31 @@ class NetworkTestCase(test.TestCase):
                                                   network['id'])
         self.assertEqual(ip_count, num_available_ips)
 
+    def test_dhcp_lease_output(self):
+        admin_ctxt = context.get_admin_context()
+        address = self._create_address(0, self.instance_id)
+        lease_ip(address)
+        network_ref = db.network_get_by_instance(admin_ctxt, self.instance_id)
+        leases = linux_net.get_dhcp_leases(context.get_admin_context(),
+                                           network_ref['id'])
+        for line in leases.split('\n'):
+            seconds, mac, ip, hostname, client_id = line.split(' ')
+            self.assertTrue(int(seconds) > time.time(), 'Lease expires in '
+                                                        'the past')
+            octets = mac.split(':')
+            self.assertEqual(len(octets), 6, "Wrong number of octets "
+                                             "in %s" % (max,))
+            for octet in octets:
+                self.assertEqual(len(octet), 2, "Oddly sized octet: %s"
+                                                                    % (octet,))
+                # This will throw an exception if the octet is invalid
+                int(octet, 16)
+
+            # And this will raise an exception in case of an invalid IP
+            IPy.IP(ip)
+
+        release_ip(address)
+
 
 def is_allocated_in_project(address, project_id):
     """Returns true if address is in specified project"""
@@ -342,13 +511,13 @@ def lease_ip(private_ip):
                                           private_ip)
     instance_ref = db.fixed_ip_get_instance(context.get_admin_context(),
                                             private_ip)
-    cmd = "%s add %s %s fake" % (binpath('nova-dhcpbridge'),
-                                 instance_ref['mac_address'],
-                                 private_ip)
+    cmd = (binpath('nova-dhcpbridge'), 'add',
+           instance_ref['mac_address'],
+           private_ip, 'fake')
     env = {'DNSMASQ_INTERFACE': network_ref['bridge'],
            'TESTING': '1',
            'FLAGFILE': FLAGS.dhcpbridge_flagfile}
-    (out, err) = utils.execute(cmd, addl_env=env)
+    (out, err) = utils.execute(*cmd, addl_env=env)
     LOG.debug("ISSUE_IP: %s, %s ", out, err)
 
 
@@ -358,11 +527,11 @@ def release_ip(private_ip):
                                           private_ip)
     instance_ref = db.fixed_ip_get_instance(context.get_admin_context(),
                                             private_ip)
-    cmd = "%s del %s %s fake" % (binpath('nova-dhcpbridge'),
-                                 instance_ref['mac_address'],
-                                 private_ip)
+    cmd = (binpath('nova-dhcpbridge'), 'del',
+           instance_ref['mac_address'],
+           private_ip, 'fake')
     env = {'DNSMASQ_INTERFACE': network_ref['bridge'],
            'TESTING': '1',
            'FLAGFILE': FLAGS.dhcpbridge_flagfile}
-    (out, err) = utils.execute(cmd, addl_env=env)
+    (out, err) = utils.execute(*cmd, addl_env=env)
     LOG.debug("RELEASE_IP: %s, %s ", out, err)
diff --git a/nova/tests/test_quota.py b/nova/tests/test_quota.py
index 9548a8c13..45b544753 100644
--- a/nova/tests/test_quota.py
+++ b/nova/tests/test_quota.py
@@ -16,14 +16,16 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+from nova import compute
 from nova import context
 from nova import db
 from nova import flags
+from nova import network
 from nova import quota
 from nova import test
 from nova import utils
+from nova import volume
 from nova.auth import manager
-from nova.api.ec2 import cloud
 from nova.compute import instance_types
 
 
@@ -40,7 +42,6 @@ class QuotaTestCase(test.TestCase):
                    quota_gigabytes=20,
                    quota_floating_ips=1)
 
-        self.cloud = cloud.CloudController()
         self.manager = manager.AuthManager()
         self.user = self.manager.create_user('admin', 'admin', 'admin', True)
         self.project = self.manager.create_project('admin', 'admin', 'admin')
@@ -56,7 +57,7 @@ class QuotaTestCase(test.TestCase):
     def _create_instance(self, cores=2):
         """Create a test instance"""
         inst = {}
-        inst['image_id'] = 'ami-test'
+        inst['image_id'] = 1
         inst['reservation_id'] = 'r-fakeres'
         inst['user_id'] = self.user.id
         inst['project_id'] = self.project.id
@@ -73,20 +74,43 @@ class QuotaTestCase(test.TestCase):
         vol['size'] = size
         return db.volume_create(self.context, vol)['id']
 
+    def _get_instance_type(self, name):
+        instance_types = {
+            'm1.tiny': dict(memory_mb=512, vcpus=1, local_gb=0, flavorid=1),
+            'm1.small': dict(memory_mb=2048, vcpus=1, local_gb=20, flavorid=2),
+            'm1.medium':
+                dict(memory_mb=4096, vcpus=2, local_gb=40, flavorid=3),
+            'm1.large': dict(memory_mb=8192, vcpus=4, local_gb=80, flavorid=4),
+            'm1.xlarge':
+                dict(memory_mb=16384, vcpus=8, local_gb=160, flavorid=5)}
+        return instance_types[name]
+
     def test_quota_overrides(self):
         """Make sure overriding a projects quotas works"""
         num_instances = quota.allowed_instances(self.context, 100,
-            instance_types.INSTANCE_TYPES['m1.small'])
+            self._get_instance_type('m1.small'))
         self.assertEqual(num_instances, 2)
         db.quota_create(self.context, {'project_id': self.project.id,
                                        'instances': 10})
         num_instances = quota.allowed_instances(self.context, 100,
-            instance_types.INSTANCE_TYPES['m1.small'])
+            self._get_instance_type('m1.small'))
         self.assertEqual(num_instances, 4)
         db.quota_update(self.context, self.project.id, {'cores': 100})
         num_instances = quota.allowed_instances(self.context, 100,
-            instance_types.INSTANCE_TYPES['m1.small'])
+            self._get_instance_type('m1.small'))
         self.assertEqual(num_instances, 10)
+
+        # metadata_items
+        too_many_items = FLAGS.quota_metadata_items + 1000
+        num_metadata_items = quota.allowed_metadata_items(self.context,
+                                                          too_many_items)
+        self.assertEqual(num_metadata_items, FLAGS.quota_metadata_items)
+        db.quota_update(self.context, self.project.id, {'metadata_items': 5})
+        num_metadata_items = quota.allowed_metadata_items(self.context,
+                                                          too_many_items)
+        self.assertEqual(num_metadata_items, 5)
+
+        # Cleanup
         db.quota_destroy(self.context, self.project.id)
 
     def test_too_many_instances(self):
@@ -94,12 +118,12 @@ class QuotaTestCase(test.TestCase):
         for i in range(FLAGS.quota_instances):
             instance_id = self._create_instance()
             instance_ids.append(instance_id)
-        self.assertRaises(quota.QuotaError, self.cloud.run_instances,
+        self.assertRaises(quota.QuotaError, compute.API().create,
                                             self.context,
                                             min_count=1,
                                             max_count=1,
                                             instance_type='m1.small',
-                                            image_id='fake')
+                                            image_id=1)
         for instance_id in instance_ids:
             db.instance_destroy(self.context, instance_id)
 
@@ -107,12 +131,12 @@ class QuotaTestCase(test.TestCase):
         instance_ids = []
         instance_id = self._create_instance(cores=4)
         instance_ids.append(instance_id)
-        self.assertRaises(quota.QuotaError, self.cloud.run_instances,
+        self.assertRaises(quota.QuotaError, compute.API().create,
                                             self.context,
                                             min_count=1,
                                             max_count=1,
                                             instance_type='m1.small',
-                                            image_id='fake')
+                                            image_id=1)
         for instance_id in instance_ids:
             db.instance_destroy(self.context, instance_id)
 
@@ -121,9 +145,12 @@ class QuotaTestCase(test.TestCase):
         for i in range(FLAGS.quota_volumes):
             volume_id = self._create_volume()
             volume_ids.append(volume_id)
-        self.assertRaises(quota.QuotaError, self.cloud.create_volume,
-                                            self.context,
-                                            size=10)
+        self.assertRaises(quota.QuotaError,
+                          volume.API().create,
+                          self.context,
+                          size=10,
+                          name='',
+                          description='')
         for volume_id in volume_ids:
             db.volume_destroy(self.context, volume_id)
 
@@ -132,9 +159,11 @@ class QuotaTestCase(test.TestCase):
         volume_id = self._create_volume(size=20)
         volume_ids.append(volume_id)
         self.assertRaises(quota.QuotaError,
-                          self.cloud.create_volume,
+                          volume.API().create,
                           self.context,
-                          size=10)
+                          size=10,
+                          name='',
+                          description='')
         for volume_id in volume_ids:
             db.volume_destroy(self.context, volume_id)
 
@@ -148,6 +177,19 @@ class QuotaTestCase(test.TestCase):
         #             make an rpc.call, the test just finishes with OK. It
         #             appears to be something in the magic inline callbacks
         #             that is breaking.
-        self.assertRaises(quota.QuotaError, self.cloud.allocate_address,
+        self.assertRaises(quota.QuotaError,
+                          network.API().allocate_floating_ip,
                           self.context)
         db.floating_ip_destroy(context.get_admin_context(), address)
+
+    def test_too_many_metadata_items(self):
+        metadata = {}
+        for i in range(FLAGS.quota_metadata_items + 1):
+            metadata['key%s' % i] = 'value%s' % i
+        self.assertRaises(quota.QuotaError, compute.API().create,
+                                            self.context,
+                                            min_count=1,
+                                            max_count=1,
+                                            instance_type='m1.small',
+                                            image_id='fake',
+                                            metadata=metadata)
diff --git a/nova/tests/test_scheduler.py b/nova/tests/test_scheduler.py
index 9d458244b..244e43bd9 100644
--- a/nova/tests/test_scheduler.py
+++ b/nova/tests/test_scheduler.py
@@ -20,10 +20,12 @@ Tests For Scheduler
 """
 
 import datetime
+import mox
 
 from mox import IgnoreArg
 from nova import context
 from nova import db
+from nova import exception
 from nova import flags
 from nova import service
 from nova import test
@@ -32,11 +34,14 @@ from nova import utils
 from nova.auth import manager as auth_manager
 from nova.scheduler import manager
 from nova.scheduler import driver
+from nova.compute import power_state
+from nova.db.sqlalchemy import models
 
 
 FLAGS = flags.FLAGS
 flags.DECLARE('max_cores', 'nova.scheduler.simple')
 flags.DECLARE('stub_network', 'nova.compute.manager')
+flags.DECLARE('instances_path', 'nova.compute.manager')
 
 
 class TestDriver(driver.Scheduler):
@@ -54,6 +59,34 @@ class SchedulerTestCase(test.TestCase):
         super(SchedulerTestCase, self).setUp()
         self.flags(scheduler_driver='nova.tests.test_scheduler.TestDriver')
 
+    def _create_compute_service(self):
+        """Create compute-manager(ComputeNode and Service record)."""
+        ctxt = context.get_admin_context()
+        dic = {'host': 'dummy', 'binary': 'nova-compute', 'topic': 'compute',
+               'report_count': 0, 'availability_zone': 'dummyzone'}
+        s_ref = db.service_create(ctxt, dic)
+
+        dic = {'service_id': s_ref['id'],
+               'vcpus': 16, 'memory_mb': 32, 'local_gb': 100,
+               'vcpus_used': 16, 'memory_mb_used': 32, 'local_gb_used': 10,
+               'hypervisor_type': 'qemu', 'hypervisor_version': 12003,
+               'cpu_info': ''}
+        db.compute_node_create(ctxt, dic)
+
+        return db.service_get(ctxt, s_ref['id'])
+
+    def _create_instance(self, **kwargs):
+        """Create a test instance"""
+        ctxt = context.get_admin_context()
+        inst = {}
+        inst['user_id'] = 'admin'
+        inst['project_id'] = kwargs.get('project_id', 'fake')
+        inst['host'] = kwargs.get('host', 'dummy')
+        inst['vcpus'] = kwargs.get('vcpus', 1)
+        inst['memory_mb'] = kwargs.get('memory_mb', 10)
+        inst['local_gb'] = kwargs.get('local_gb', 20)
+        return db.instance_create(ctxt, inst)
+
     def test_fallback(self):
         scheduler = manager.SchedulerManager()
         self.mox.StubOutWithMock(rpc, 'cast', use_mock_anything=True)
@@ -76,6 +109,73 @@ class SchedulerTestCase(test.TestCase):
         self.mox.ReplayAll()
         scheduler.named_method(ctxt, 'topic', num=7)
 
+    def test_show_host_resources_host_not_exit(self):
+        """A host given as an argument does not exists."""
+
+        scheduler = manager.SchedulerManager()
+        dest = 'dummydest'
+        ctxt = context.get_admin_context()
+
+        try:
+            scheduler.show_host_resources(ctxt, dest)
+        except exception.NotFound, e:
+            c1 = (e.message.find(_("does not exist or is not a "
+                                   "compute node.")) >= 0)
+        self.assertTrue(c1)
+
+    def _dic_is_equal(self, dic1, dic2, keys=None):
+        """Compares 2 dictionary contents(Helper method)"""
+        if not keys:
+            keys = ['vcpus', 'memory_mb', 'local_gb',
+                    'vcpus_used', 'memory_mb_used', 'local_gb_used']
+
+        for key in keys:
+            if not (dic1[key] == dic2[key]):
+                return False
+        return True
+
+    def test_show_host_resources_no_project(self):
+        """No instance are running on the given host."""
+
+        scheduler = manager.SchedulerManager()
+        ctxt = context.get_admin_context()
+        s_ref = self._create_compute_service()
+
+        result = scheduler.show_host_resources(ctxt, s_ref['host'])
+
+        # result checking
+        c1 = ('resource' in result and 'usage' in result)
+        compute_node = s_ref['compute_node'][0]
+        c2 = self._dic_is_equal(result['resource'], compute_node)
+        c3 = result['usage'] == {}
+        self.assertTrue(c1 and c2 and c3)
+        db.service_destroy(ctxt, s_ref['id'])
+
+    def test_show_host_resources_works_correctly(self):
+        """Show_host_resources() works correctly as expected."""
+
+        scheduler = manager.SchedulerManager()
+        ctxt = context.get_admin_context()
+        s_ref = self._create_compute_service()
+        i_ref1 = self._create_instance(project_id='p-01', host=s_ref['host'])
+        i_ref2 = self._create_instance(project_id='p-02', vcpus=3,
+                                       host=s_ref['host'])
+
+        result = scheduler.show_host_resources(ctxt, s_ref['host'])
+
+        c1 = ('resource' in result and 'usage' in result)
+        compute_node = s_ref['compute_node'][0]
+        c2 = self._dic_is_equal(result['resource'], compute_node)
+        c3 = result['usage'].keys() == ['p-01', 'p-02']
+        keys = ['vcpus', 'memory_mb', 'local_gb']
+        c4 = self._dic_is_equal(result['usage']['p-01'], i_ref1, keys)
+        c5 = self._dic_is_equal(result['usage']['p-02'], i_ref2, keys)
+        self.assertTrue(c1 and c2 and c3 and c4 and c5)
+
+        db.service_destroy(ctxt, s_ref['id'])
+        db.instance_destroy(ctxt, i_ref1['id'])
+        db.instance_destroy(ctxt, i_ref2['id'])
+
 
 class ZoneSchedulerTestCase(test.TestCase):
     """Test case for zone scheduler"""
@@ -150,30 +250,59 @@ class SimpleDriverTestCase(test.TestCase):
     def tearDown(self):
         self.manager.delete_user(self.user)
         self.manager.delete_project(self.project)
+        super(SimpleDriverTestCase, self).tearDown()
 
     def _create_instance(self, **kwargs):
         """Create a test instance"""
         inst = {}
-        inst['image_id'] = 'ami-test'
+        inst['image_id'] = 1
         inst['reservation_id'] = 'r-fakeres'
         inst['user_id'] = self.user.id
         inst['project_id'] = self.project.id
         inst['instance_type'] = 'm1.tiny'
         inst['mac_address'] = utils.generate_mac()
+        inst['vcpus'] = kwargs.get('vcpus', 1)
         inst['ami_launch_index'] = 0
-        inst['vcpus'] = 1
         inst['availability_zone'] = kwargs.get('availability_zone', None)
+        inst['host'] = kwargs.get('host', 'dummy')
+        inst['memory_mb'] = kwargs.get('memory_mb', 20)
+        inst['local_gb'] = kwargs.get('local_gb', 30)
+        inst['launched_on'] = kwargs.get('launghed_on', 'dummy')
+        inst['state_description'] = kwargs.get('state_description', 'running')
+        inst['state'] = kwargs.get('state', power_state.RUNNING)
         return db.instance_create(self.context, inst)['id']
 
     def _create_volume(self):
         """Create a test volume"""
         vol = {}
-        vol['image_id'] = 'ami-test'
-        vol['reservation_id'] = 'r-fakeres'
         vol['size'] = 1
         vol['availability_zone'] = 'test'
         return db.volume_create(self.context, vol)['id']
 
+    def _create_compute_service(self, **kwargs):
+        """Create a compute service."""
+
+        dic = {'binary': 'nova-compute', 'topic': 'compute',
+               'report_count': 0, 'availability_zone': 'dummyzone'}
+        dic['host'] = kwargs.get('host', 'dummy')
+        s_ref = db.service_create(self.context, dic)
+        if 'created_at' in kwargs.keys() or 'updated_at' in kwargs.keys():
+            t = datetime.datetime.utcnow() - datetime.timedelta(0)
+            dic['created_at'] = kwargs.get('created_at', t)
+            dic['updated_at'] = kwargs.get('updated_at', t)
+            db.service_update(self.context, s_ref['id'], dic)
+
+        dic = {'service_id': s_ref['id'],
+               'vcpus': 16, 'memory_mb': 32, 'local_gb': 100,
+               'vcpus_used': 16, 'local_gb_used': 10,
+               'hypervisor_type': 'qemu', 'hypervisor_version': 12003,
+               'cpu_info': ''}
+        dic['memory_mb_used'] = kwargs.get('memory_mb_used', 32)
+        dic['hypervisor_type'] = kwargs.get('hypervisor_type', 'qemu')
+        dic['hypervisor_version'] = kwargs.get('hypervisor_version', 12003)
+        db.compute_node_create(self.context, dic)
+        return db.service_get(self.context, s_ref['id'])
+
     def test_doesnt_report_disabled_hosts_as_up(self):
         """Ensures driver doesn't find hosts before they are enabled"""
         # NOTE(vish): constructing service without create method
@@ -349,21 +478,135 @@ class SimpleDriverTestCase(test.TestCase):
         self.assertEqual(host, 'host2')
         volume1.delete_volume(self.context, volume_id1)
         db.volume_destroy(self.context, volume_id2)
+        dic = {'service_id': s_ref['id'],
+               'vcpus': 16, 'memory_mb': 32, 'local_gb': 100,
+               'vcpus_used': 16, 'memory_mb_used': 12, 'local_gb_used': 10,
+               'hypervisor_type': 'qemu', 'hypervisor_version': 12003,
+               'cpu_info': ''}
+
+    def test_doesnt_report_disabled_hosts_as_up(self):
+        """Ensures driver doesn't find hosts before they are enabled"""
+        compute1 = self.start_service('compute', host='host1')
+        compute2 = self.start_service('compute', host='host2')
+        s1 = db.service_get_by_args(self.context, 'host1', 'nova-compute')
+        s2 = db.service_get_by_args(self.context, 'host2', 'nova-compute')
+        db.service_update(self.context, s1['id'], {'disabled': True})
+        db.service_update(self.context, s2['id'], {'disabled': True})
+        hosts = self.scheduler.driver.hosts_up(self.context, 'compute')
+        self.assertEqual(0, len(hosts))
+        compute1.kill()
+        compute2.kill()
+
+    def test_reports_enabled_hosts_as_up(self):
+        """Ensures driver can find the hosts that are up"""
+        compute1 = self.start_service('compute', host='host1')
+        compute2 = self.start_service('compute', host='host2')
+        hosts = self.scheduler.driver.hosts_up(self.context, 'compute')
+        self.assertEqual(2, len(hosts))
+        compute1.kill()
+        compute2.kill()
+
+    def test_least_busy_host_gets_instance(self):
+        """Ensures the host with less cores gets the next one"""
+        compute1 = self.start_service('compute', host='host1')
+        compute2 = self.start_service('compute', host='host2')
+        instance_id1 = self._create_instance()
+        compute1.run_instance(self.context, instance_id1)
+        instance_id2 = self._create_instance()
+        host = self.scheduler.driver.schedule_run_instance(self.context,
+                                                           instance_id2)
+        self.assertEqual(host, 'host2')
+        compute1.terminate_instance(self.context, instance_id1)
+        db.instance_destroy(self.context, instance_id2)
+        compute1.kill()
+        compute2.kill()
+
+    def test_specific_host_gets_instance(self):
+        """Ensures if you set availability_zone it launches on that zone"""
+        compute1 = self.start_service('compute', host='host1')
+        compute2 = self.start_service('compute', host='host2')
+        instance_id1 = self._create_instance()
+        compute1.run_instance(self.context, instance_id1)
+        instance_id2 = self._create_instance(availability_zone='nova:host1')
+        host = self.scheduler.driver.schedule_run_instance(self.context,
+                                                           instance_id2)
+        self.assertEqual('host1', host)
+        compute1.terminate_instance(self.context, instance_id1)
+        db.instance_destroy(self.context, instance_id2)
+        compute1.kill()
+        compute2.kill()
+
+    def test_wont_sechedule_if_specified_host_is_down(self):
+        compute1 = self.start_service('compute', host='host1')
+        s1 = db.service_get_by_args(self.context, 'host1', 'nova-compute')
+        now = datetime.datetime.utcnow()
+        delta = datetime.timedelta(seconds=FLAGS.service_down_time * 2)
+        past = now - delta
+        db.service_update(self.context, s1['id'], {'updated_at': past})
+        instance_id2 = self._create_instance(availability_zone='nova:host1')
+        self.assertRaises(driver.WillNotSchedule,
+                          self.scheduler.driver.schedule_run_instance,
+                          self.context,
+                          instance_id2)
+        db.instance_destroy(self.context, instance_id2)
+        compute1.kill()
+
+    def test_will_schedule_on_disabled_host_if_specified(self):
+        compute1 = self.start_service('compute', host='host1')
+        s1 = db.service_get_by_args(self.context, 'host1', 'nova-compute')
+        db.service_update(self.context, s1['id'], {'disabled': True})
+        instance_id2 = self._create_instance(availability_zone='nova:host1')
+        host = self.scheduler.driver.schedule_run_instance(self.context,
+                                                           instance_id2)
+        self.assertEqual('host1', host)
+        db.instance_destroy(self.context, instance_id2)
+        compute1.kill()
+
+    def test_too_many_cores(self):
+        """Ensures we don't go over max cores"""
+        compute1 = self.start_service('compute', host='host1')
+        compute2 = self.start_service('compute', host='host2')
+        instance_ids1 = []
+        instance_ids2 = []
+        for index in xrange(FLAGS.max_cores):
+            instance_id = self._create_instance()
+            compute1.run_instance(self.context, instance_id)
+            instance_ids1.append(instance_id)
+            instance_id = self._create_instance()
+            compute2.run_instance(self.context, instance_id)
+            instance_ids2.append(instance_id)
+        instance_id = self._create_instance()
+        self.assertRaises(driver.NoValidHost,
+                          self.scheduler.driver.schedule_run_instance,
+                          self.context,
+                          instance_id)
+        db.instance_destroy(self.context, instance_id)
+        for instance_id in instance_ids1:
+            compute1.terminate_instance(self.context, instance_id)
+        for instance_id in instance_ids2:
+            compute2.terminate_instance(self.context, instance_id)
+        compute1.kill()
+        compute2.kill()
+
+    def test_least_busy_host_gets_volume(self):
+        """Ensures the host with less gigabytes gets the next one"""
+        volume1 = self.start_service('volume', host='host1')
+        volume2 = self.start_service('volume', host='host2')
+        volume_id1 = self._create_volume()
+        volume1.create_volume(self.context, volume_id1)
+        volume_id2 = self._create_volume()
+        host = self.scheduler.driver.schedule_create_volume(self.context,
+                                                            volume_id2)
+        self.assertEqual(host, 'host2')
+        volume1.delete_volume(self.context, volume_id1)
+        db.volume_destroy(self.context, volume_id2)
         volume1.kill()
         volume2.kill()
 
     def test_too_many_gigabytes(self):
         """Ensures we don't go over max gigabytes"""
-        volume1 = service.Service('host1',
-                                   'nova-volume',
-                                   'volume',
-                                   FLAGS.volume_manager)
-        volume1.start()
-        volume2 = service.Service('host2',
-                                   'nova-volume',
-                                   'volume',
-                                   FLAGS.volume_manager)
-        volume2.start()
+        volume1 = self.start_service('volume', host='host1')
+        volume2 = self.start_service('volume', host='host2')
         volume_ids1 = []
         volume_ids2 = []
         for index in xrange(FLAGS.max_gigabytes):
@@ -384,3 +627,313 @@ class SimpleDriverTestCase(test.TestCase):
             volume2.delete_volume(self.context, volume_id)
         volume1.kill()
         volume2.kill()
+
+    def test_scheduler_live_migration_with_volume(self):
+        """scheduler_live_migration() works correctly as expected.
+
+        Also, checks instance state is changed from 'running' -> 'migrating'.
+
+        """
+
+        instance_id = self._create_instance()
+        i_ref = db.instance_get(self.context, instance_id)
+        dic = {'instance_id': instance_id, 'size': 1}
+        v_ref = db.volume_create(self.context, dic)
+
+        # cannot check 2nd argument b/c the addresses of instance object
+        # is different.
+        driver_i = self.scheduler.driver
+        nocare = mox.IgnoreArg()
+        self.mox.StubOutWithMock(driver_i, '_live_migration_src_check')
+        self.mox.StubOutWithMock(driver_i, '_live_migration_dest_check')
+        self.mox.StubOutWithMock(driver_i, '_live_migration_common_check')
+        driver_i._live_migration_src_check(nocare, nocare)
+        driver_i._live_migration_dest_check(nocare, nocare, i_ref['host'])
+        driver_i._live_migration_common_check(nocare, nocare, i_ref['host'])
+        self.mox.StubOutWithMock(rpc, 'cast', use_mock_anything=True)
+        kwargs = {'instance_id': instance_id, 'dest': i_ref['host']}
+        rpc.cast(self.context,
+                 db.queue_get_for(nocare, FLAGS.compute_topic, i_ref['host']),
+                 {"method": 'live_migration', "args": kwargs})
+
+        self.mox.ReplayAll()
+        self.scheduler.live_migration(self.context, FLAGS.compute_topic,
+                                      instance_id=instance_id,
+                                      dest=i_ref['host'])
+
+        i_ref = db.instance_get(self.context, instance_id)
+        self.assertTrue(i_ref['state_description'] == 'migrating')
+        db.instance_destroy(self.context, instance_id)
+        db.volume_destroy(self.context, v_ref['id'])
+
+    def test_live_migration_src_check_instance_not_running(self):
+        """The instance given by instance_id is not running."""
+
+        instance_id = self._create_instance(state_description='migrating')
+        i_ref = db.instance_get(self.context, instance_id)
+
+        try:
+            self.scheduler.driver._live_migration_src_check(self.context,
+                                                            i_ref)
+        except exception.Invalid, e:
+            c = (e.message.find('is not running') > 0)
+
+        self.assertTrue(c)
+        db.instance_destroy(self.context, instance_id)
+
+    def test_live_migration_src_check_volume_node_not_alive(self):
+        """Raise exception when volume node is not alive."""
+
+        instance_id = self._create_instance()
+        i_ref = db.instance_get(self.context, instance_id)
+        dic = {'instance_id': instance_id, 'size': 1}
+        v_ref = db.volume_create(self.context, {'instance_id': instance_id,
+                                                'size': 1})
+        t1 = datetime.datetime.utcnow() - datetime.timedelta(1)
+        dic = {'created_at': t1, 'updated_at': t1, 'binary': 'nova-volume',
+               'topic': 'volume', 'report_count': 0}
+        s_ref = db.service_create(self.context, dic)
+
+        try:
+            self.scheduler.driver.schedule_live_migration(self.context,
+                                                          instance_id,
+                                                          i_ref['host'])
+        except exception.Invalid, e:
+            c = (e.message.find('volume node is not alive') >= 0)
+
+        self.assertTrue(c)
+        db.instance_destroy(self.context, instance_id)
+        db.service_destroy(self.context, s_ref['id'])
+        db.volume_destroy(self.context, v_ref['id'])
+
+    def test_live_migration_src_check_compute_node_not_alive(self):
+        """Confirms src-compute node is alive."""
+        instance_id = self._create_instance()
+        i_ref = db.instance_get(self.context, instance_id)
+        t = datetime.datetime.utcnow() - datetime.timedelta(10)
+        s_ref = self._create_compute_service(created_at=t, updated_at=t,
+                                             host=i_ref['host'])
+
+        try:
+            self.scheduler.driver._live_migration_src_check(self.context,
+                                                            i_ref)
+        except exception.Invalid, e:
+            c = (e.message.find('is not alive') >= 0)
+
+        self.assertTrue(c)
+        db.instance_destroy(self.context, instance_id)
+        db.service_destroy(self.context, s_ref['id'])
+
+    def test_live_migration_src_check_works_correctly(self):
+        """Confirms this method finishes with no error."""
+        instance_id = self._create_instance()
+        i_ref = db.instance_get(self.context, instance_id)
+        s_ref = self._create_compute_service(host=i_ref['host'])
+
+        ret = self.scheduler.driver._live_migration_src_check(self.context,
+                                                              i_ref)
+
+        self.assertTrue(ret == None)
+        db.instance_destroy(self.context, instance_id)
+        db.service_destroy(self.context, s_ref['id'])
+
+    def test_live_migration_dest_check_not_alive(self):
+        """Confirms exception raises in case dest host does not exist."""
+        instance_id = self._create_instance()
+        i_ref = db.instance_get(self.context, instance_id)
+        t = datetime.datetime.utcnow() - datetime.timedelta(10)
+        s_ref = self._create_compute_service(created_at=t, updated_at=t,
+                                             host=i_ref['host'])
+
+        try:
+            self.scheduler.driver._live_migration_dest_check(self.context,
+                                                             i_ref,
+                                                             i_ref['host'])
+        except exception.Invalid, e:
+            c = (e.message.find('is not alive') >= 0)
+
+        self.assertTrue(c)
+        db.instance_destroy(self.context, instance_id)
+        db.service_destroy(self.context, s_ref['id'])
+
+    def test_live_migration_dest_check_service_same_host(self):
+        """Confirms exceptioin raises in case dest and src is same host."""
+        instance_id = self._create_instance()
+        i_ref = db.instance_get(self.context, instance_id)
+        s_ref = self._create_compute_service(host=i_ref['host'])
+
+        try:
+            self.scheduler.driver._live_migration_dest_check(self.context,
+                                                             i_ref,
+                                                             i_ref['host'])
+        except exception.Invalid, e:
+            c = (e.message.find('choose other host') >= 0)
+
+        self.assertTrue(c)
+        db.instance_destroy(self.context, instance_id)
+        db.service_destroy(self.context, s_ref['id'])
+
+    def test_live_migration_dest_check_service_lack_memory(self):
+        """Confirms exception raises when dest doesn't have enough memory."""
+        instance_id = self._create_instance()
+        i_ref = db.instance_get(self.context, instance_id)
+        s_ref = self._create_compute_service(host='somewhere',
+                                             memory_mb_used=12)
+
+        try:
+            self.scheduler.driver._live_migration_dest_check(self.context,
+                                                             i_ref,
+                                                             'somewhere')
+        except exception.NotEmpty, e:
+            c = (e.message.find('Unable to migrate') >= 0)
+
+        self.assertTrue(c)
+        db.instance_destroy(self.context, instance_id)
+        db.service_destroy(self.context, s_ref['id'])
+
+    def test_live_migration_dest_check_service_works_correctly(self):
+        """Confirms method finishes with no error."""
+        instance_id = self._create_instance()
+        i_ref = db.instance_get(self.context, instance_id)
+        s_ref = self._create_compute_service(host='somewhere',
+                                             memory_mb_used=5)
+
+        ret = self.scheduler.driver._live_migration_dest_check(self.context,
+                                                             i_ref,
+                                                             'somewhere')
+        self.assertTrue(ret == None)
+        db.instance_destroy(self.context, instance_id)
+        db.service_destroy(self.context, s_ref['id'])
+
+    def test_live_migration_common_check_service_orig_not_exists(self):
+        """Destination host does not exist."""
+
+        dest = 'dummydest'
+        # mocks for live_migration_common_check()
+        instance_id = self._create_instance()
+        i_ref = db.instance_get(self.context, instance_id)
+        t1 = datetime.datetime.utcnow() - datetime.timedelta(10)
+        s_ref = self._create_compute_service(created_at=t1, updated_at=t1,
+                                             host=dest)
+
+        # mocks for mounted_on_same_shared_storage()
+        fpath = '/test/20110127120000'
+        self.mox.StubOutWithMock(driver, 'rpc', use_mock_anything=True)
+        topic = FLAGS.compute_topic
+        driver.rpc.call(mox.IgnoreArg(),
+            db.queue_get_for(self.context, topic, dest),
+            {"method": 'create_shared_storage_test_file'}).AndReturn(fpath)
+        driver.rpc.call(mox.IgnoreArg(),
+            db.queue_get_for(mox.IgnoreArg(), topic, i_ref['host']),
+            {"method": 'check_shared_storage_test_file',
+             "args": {'filename': fpath}})
+        driver.rpc.call(mox.IgnoreArg(),
+            db.queue_get_for(mox.IgnoreArg(), topic, dest),
+            {"method": 'cleanup_shared_storage_test_file',
+             "args": {'filename': fpath}})
+
+        self.mox.ReplayAll()
+        try:
+            self.scheduler.driver._live_migration_common_check(self.context,
+                                                               i_ref,
+                                                               dest)
+        except exception.Invalid, e:
+            c = (e.message.find('does not exist') >= 0)
+
+        self.assertTrue(c)
+        db.instance_destroy(self.context, instance_id)
+        db.service_destroy(self.context, s_ref['id'])
+
+    def test_live_migration_common_check_service_different_hypervisor(self):
+        """Original host and dest host has different hypervisor type."""
+        dest = 'dummydest'
+        instance_id = self._create_instance()
+        i_ref = db.instance_get(self.context, instance_id)
+
+        # compute service for destination
+        s_ref = self._create_compute_service(host=i_ref['host'])
+        # compute service for original host
+        s_ref2 = self._create_compute_service(host=dest, hypervisor_type='xen')
+
+        # mocks
+        driver = self.scheduler.driver
+        self.mox.StubOutWithMock(driver, 'mounted_on_same_shared_storage')
+        driver.mounted_on_same_shared_storage(mox.IgnoreArg(), i_ref, dest)
+
+        self.mox.ReplayAll()
+        try:
+            self.scheduler.driver._live_migration_common_check(self.context,
+                                                               i_ref,
+                                                               dest)
+        except exception.Invalid, e:
+            c = (e.message.find(_('Different hypervisor type')) >= 0)
+
+        self.assertTrue(c)
+        db.instance_destroy(self.context, instance_id)
+        db.service_destroy(self.context, s_ref['id'])
+        db.service_destroy(self.context, s_ref2['id'])
+
+    def test_live_migration_common_check_service_different_version(self):
+        """Original host and dest host has different hypervisor version."""
+        dest = 'dummydest'
+        instance_id = self._create_instance()
+        i_ref = db.instance_get(self.context, instance_id)
+
+        # compute service for destination
+        s_ref = self._create_compute_service(host=i_ref['host'])
+        # compute service for original host
+        s_ref2 = self._create_compute_service(host=dest,
+                                              hypervisor_version=12002)
+
+        # mocks
+        driver = self.scheduler.driver
+        self.mox.StubOutWithMock(driver, 'mounted_on_same_shared_storage')
+        driver.mounted_on_same_shared_storage(mox.IgnoreArg(), i_ref, dest)
+
+        self.mox.ReplayAll()
+        try:
+            self.scheduler.driver._live_migration_common_check(self.context,
+                                                               i_ref,
+                                                               dest)
+        except exception.Invalid, e:
+            c = (e.message.find(_('Older hypervisor version')) >= 0)
+
+        self.assertTrue(c)
+        db.instance_destroy(self.context, instance_id)
+        db.service_destroy(self.context, s_ref['id'])
+        db.service_destroy(self.context, s_ref2['id'])
+
+    def test_live_migration_common_check_checking_cpuinfo_fail(self):
+        """Raise excetion when original host doen't have compatible cpu."""
+
+        dest = 'dummydest'
+        instance_id = self._create_instance()
+        i_ref = db.instance_get(self.context, instance_id)
+
+        # compute service for destination
+        s_ref = self._create_compute_service(host=i_ref['host'])
+        # compute service for original host
+        s_ref2 = self._create_compute_service(host=dest)
+
+        # mocks
+        driver = self.scheduler.driver
+        self.mox.StubOutWithMock(driver, 'mounted_on_same_shared_storage')
+        driver.mounted_on_same_shared_storage(mox.IgnoreArg(), i_ref, dest)
+        self.mox.StubOutWithMock(rpc, 'call', use_mock_anything=True)
+        rpc.call(mox.IgnoreArg(), mox.IgnoreArg(),
+            {"method": 'compare_cpu',
+            "args": {'cpu_info': s_ref2['compute_node'][0]['cpu_info']}}).\
+             AndRaise(rpc.RemoteError("doesn't have compatibility to", "", ""))
+
+        self.mox.ReplayAll()
+        try:
+            self.scheduler.driver._live_migration_common_check(self.context,
+                                                               i_ref,
+                                                               dest)
+        except rpc.RemoteError, e:
+            c = (e.message.find(_("doesn't have compatibility to")) >= 0)
+
+        self.assertTrue(c)
+        db.instance_destroy(self.context, instance_id)
+        db.service_destroy(self.context, s_ref['id'])
+        db.service_destroy(self.context, s_ref2['id'])
diff --git a/nova/tests/test_service.py b/nova/tests/test_service.py
index a67c8d1e8..393f9d20b 100644
--- a/nova/tests/test_service.py
+++ b/nova/tests/test_service.py
@@ -30,6 +30,7 @@ from nova import rpc
 from nova import test
 from nova import service
 from nova import manager
+from nova.compute import manager as compute_manager
 
 FLAGS = flags.FLAGS
 flags.DEFINE_string("fake_manager", "nova.tests.test_service.FakeManager",
@@ -50,13 +51,6 @@ class ExtendedService(service.Service):
 class ServiceManagerTestCase(test.TestCase):
     """Test cases for Services"""
 
-    def test_attribute_error_for_no_manager(self):
-        serv = service.Service('test',
-                               'test',
-                               'test',
-                               'nova.tests.test_service.FakeManager')
-        self.assertRaises(AttributeError, getattr, serv, 'test_method')
-
     def test_message_gets_to_manager(self):
         serv = service.Service('test',
                                'test',
@@ -258,3 +252,43 @@ class ServiceTestCase(test.TestCase):
         serv.report_state()
 
         self.assert_(not serv.model_disconnected)
+
+    def test_compute_can_update_available_resource(self):
+        """Confirm compute updates their record of compute-service table."""
+        host = 'foo'
+        binary = 'nova-compute'
+        topic = 'compute'
+
+        # Any mocks are not working without UnsetStubs() here.
+        self.mox.UnsetStubs()
+        ctxt = context.get_admin_context()
+        service_ref = db.service_create(ctxt, {'host': host,
+                                               'binary': binary,
+                                               'topic': topic})
+        serv = service.Service(host,
+                               binary,
+                               topic,
+                               'nova.compute.manager.ComputeManager')
+
+        # This testcase want to test calling update_available_resource.
+        # No need to call periodic call, then below variable must be set 0.
+        serv.report_interval = 0
+        serv.periodic_interval = 0
+
+        # Creating mocks
+        self.mox.StubOutWithMock(service.rpc.Connection, 'instance')
+        service.rpc.Connection.instance(new=mox.IgnoreArg())
+        service.rpc.Connection.instance(new=mox.IgnoreArg())
+        self.mox.StubOutWithMock(serv.manager.driver,
+                                 'update_available_resource')
+        serv.manager.driver.update_available_resource(mox.IgnoreArg(), host)
+
+        # Just doing start()-stop(), not confirm new db record is created,
+        # because update_available_resource() works only in
+        # libvirt environment. This testcase confirms
+        # update_available_resource() is called. Otherwise, mox complains.
+        self.mox.ReplayAll()
+        serv.start()
+        serv.stop()
+
+        db.service_destroy(ctxt, service_ref['id'])
diff --git a/nova/tests/test_test.py b/nova/tests/test_test.py
new file mode 100644
index 000000000..e237674e6
--- /dev/null
+++ b/nova/tests/test_test.py
@@ -0,0 +1,40 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""Tests for the testing base code."""
+
+from nova import rpc
+from nova import test
+
+
+class IsolationTestCase(test.TestCase):
+    """Ensure that things are cleaned up after failed tests.
+
+    These tests don't really do much here, but if isolation fails a bunch
+    of other tests should fail.
+
+    """
+    def test_service_isolation(self):
+        self.start_service('compute')
+
+    def test_rpc_consumer_isolation(self):
+        connection = rpc.Connection.instance(new=True)
+        consumer = rpc.TopicConsumer(connection, topic='compute')
+        consumer.register_callback(
+                lambda x, y: self.fail('I should never be called'))
+        consumer.attach_to_eventlet()
diff --git a/nova/tests/test_utils.py b/nova/tests/test_utils.py
new file mode 100644
index 000000000..34a407f1a
--- /dev/null
+++ b/nova/tests/test_utils.py
@@ -0,0 +1,174 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+#    Copyright 2011 Justin Santa Barbara
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from nova import test
+from nova import utils
+from nova import exception
+
+
+class GetFromPathTestCase(test.TestCase):
+    def test_tolerates_nones(self):
+        f = utils.get_from_path
+
+        input = []
+        self.assertEquals([], f(input, "a"))
+        self.assertEquals([], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = [None]
+        self.assertEquals([], f(input, "a"))
+        self.assertEquals([], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = [{'a': None}]
+        self.assertEquals([], f(input, "a"))
+        self.assertEquals([], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = [{'a': {'b': None}}]
+        self.assertEquals([{'b': None}], f(input, "a"))
+        self.assertEquals([], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = [{'a': {'b': {'c': None}}}]
+        self.assertEquals([{'b': {'c': None}}], f(input, "a"))
+        self.assertEquals([{'c': None}], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = [{'a': {'b': {'c': None}}}, {'a': None}]
+        self.assertEquals([{'b': {'c': None}}], f(input, "a"))
+        self.assertEquals([{'c': None}], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = [{'a': {'b': {'c': None}}}, {'a': {'b': None}}]
+        self.assertEquals([{'b': {'c': None}}, {'b': None}], f(input, "a"))
+        self.assertEquals([{'c': None}], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+    def test_does_select(self):
+        f = utils.get_from_path
+
+        input = [{'a': 'a_1'}]
+        self.assertEquals(['a_1'], f(input, "a"))
+        self.assertEquals([], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = [{'a': {'b': 'b_1'}}]
+        self.assertEquals([{'b': 'b_1'}], f(input, "a"))
+        self.assertEquals(['b_1'], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = [{'a': {'b': {'c': 'c_1'}}}]
+        self.assertEquals([{'b': {'c': 'c_1'}}], f(input, "a"))
+        self.assertEquals([{'c': 'c_1'}], f(input, "a/b"))
+        self.assertEquals(['c_1'], f(input, "a/b/c"))
+
+        input = [{'a': {'b': {'c': 'c_1'}}}, {'a': None}]
+        self.assertEquals([{'b': {'c': 'c_1'}}], f(input, "a"))
+        self.assertEquals([{'c': 'c_1'}], f(input, "a/b"))
+        self.assertEquals(['c_1'], f(input, "a/b/c"))
+
+        input = [{'a': {'b': {'c': 'c_1'}}},
+                 {'a': {'b': None}}]
+        self.assertEquals([{'b': {'c': 'c_1'}}, {'b': None}], f(input, "a"))
+        self.assertEquals([{'c': 'c_1'}], f(input, "a/b"))
+        self.assertEquals(['c_1'], f(input, "a/b/c"))
+
+        input = [{'a': {'b': {'c': 'c_1'}}},
+                 {'a': {'b': {'c': 'c_2'}}}]
+        self.assertEquals([{'b': {'c': 'c_1'}}, {'b': {'c': 'c_2'}}],
+                          f(input, "a"))
+        self.assertEquals([{'c': 'c_1'}, {'c': 'c_2'}], f(input, "a/b"))
+        self.assertEquals(['c_1', 'c_2'], f(input, "a/b/c"))
+
+        self.assertEquals([], f(input, "a/b/c/d"))
+        self.assertEquals([], f(input, "c/a/b/d"))
+        self.assertEquals([], f(input, "i/r/t"))
+
+    def test_flattens_lists(self):
+        f = utils.get_from_path
+
+        input = [{'a': [1, 2, 3]}]
+        self.assertEquals([1, 2, 3], f(input, "a"))
+        self.assertEquals([], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = [{'a': {'b': [1, 2, 3]}}]
+        self.assertEquals([{'b': [1, 2, 3]}], f(input, "a"))
+        self.assertEquals([1, 2, 3], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = [{'a': {'b': [1, 2, 3]}}, {'a': {'b': [4, 5, 6]}}]
+        self.assertEquals([1, 2, 3, 4, 5, 6], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = [{'a': [{'b': [1, 2, 3]}, {'b': [4, 5, 6]}]}]
+        self.assertEquals([1, 2, 3, 4, 5, 6], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = [{'a': [1, 2, {'b': 'b_1'}]}]
+        self.assertEquals([1, 2, {'b': 'b_1'}], f(input, "a"))
+        self.assertEquals(['b_1'], f(input, "a/b"))
+
+    def test_bad_xpath(self):
+        f = utils.get_from_path
+
+        self.assertRaises(exception.Error, f, [], None)
+        self.assertRaises(exception.Error, f, [], "")
+        self.assertRaises(exception.Error, f, [], "/")
+        self.assertRaises(exception.Error, f, [], "/a")
+        self.assertRaises(exception.Error, f, [], "/a/")
+        self.assertRaises(exception.Error, f, [], "//")
+        self.assertRaises(exception.Error, f, [], "//a")
+        self.assertRaises(exception.Error, f, [], "a//a")
+        self.assertRaises(exception.Error, f, [], "a//a/")
+        self.assertRaises(exception.Error, f, [], "a/a/")
+
+    def test_real_failure1(self):
+        # Real world failure case...
+        #  We weren't coping when the input was a Dictionary instead of a List
+        # This led to test_accepts_dictionaries
+        f = utils.get_from_path
+
+        inst = {'fixed_ip': {'floating_ips': [{'address': '1.2.3.4'}],
+                             'address': '192.168.0.3'},
+                'hostname': ''}
+
+        private_ips = f(inst, 'fixed_ip/address')
+        public_ips = f(inst, 'fixed_ip/floating_ips/address')
+        self.assertEquals(['192.168.0.3'], private_ips)
+        self.assertEquals(['1.2.3.4'], public_ips)
+
+    def test_accepts_dictionaries(self):
+        f = utils.get_from_path
+
+        input = {'a': [1, 2, 3]}
+        self.assertEquals([1, 2, 3], f(input, "a"))
+        self.assertEquals([], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = {'a': {'b': [1, 2, 3]}}
+        self.assertEquals([{'b': [1, 2, 3]}], f(input, "a"))
+        self.assertEquals([1, 2, 3], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = {'a': [{'b': [1, 2, 3]}, {'b': [4, 5, 6]}]}
+        self.assertEquals([1, 2, 3, 4, 5, 6], f(input, "a/b"))
+        self.assertEquals([], f(input, "a/b/c"))
+
+        input = {'a': [1, 2, {'b': 'b_1'}]}
+        self.assertEquals([1, 2, {'b': 'b_1'}], f(input, "a"))
+        self.assertEquals(['b_1'], f(input, "a/b"))
diff --git a/nova/tests/test_virt.py b/nova/tests/test_virt.py
index 6e5a0114b..b214f5ce7 100644
--- a/nova/tests/test_virt.py
+++ b/nova/tests/test_virt.py
@@ -14,33 +14,125 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import eventlet
+import mox
+import os
+import re
+import sys
+
 from xml.etree.ElementTree import fromstring as xml_to_tree
 from xml.dom.minidom import parseString as xml_to_dom
 
 from nova import context
 from nova import db
+from nova import exception
 from nova import flags
 from nova import test
 from nova import utils
 from nova.api.ec2 import cloud
 from nova.auth import manager
+from nova.compute import manager as compute_manager
+from nova.compute import power_state
+from nova.db.sqlalchemy import models
 from nova.virt import libvirt_conn
 
+libvirt = None
 FLAGS = flags.FLAGS
 flags.DECLARE('instances_path', 'nova.compute.manager')
 
 
+def _concurrency(wait, done, target):
+    wait.wait()
+    done.send()
+
+
+class CacheConcurrencyTestCase(test.TestCase):
+    def setUp(self):
+        super(CacheConcurrencyTestCase, self).setUp()
+
+        def fake_exists(fname):
+            basedir = os.path.join(FLAGS.instances_path, '_base')
+            if fname == basedir:
+                return True
+            return False
+
+        def fake_execute(*args, **kwargs):
+            pass
+
+        self.stubs.Set(os.path, 'exists', fake_exists)
+        self.stubs.Set(utils, 'execute', fake_execute)
+
+    def test_same_fname_concurrency(self):
+        """Ensures that the same fname cache runs at a sequentially"""
+        conn = libvirt_conn.LibvirtConnection
+        wait1 = eventlet.event.Event()
+        done1 = eventlet.event.Event()
+        eventlet.spawn(conn._cache_image, _concurrency,
+                       'target', 'fname', False, wait1, done1)
+        wait2 = eventlet.event.Event()
+        done2 = eventlet.event.Event()
+        eventlet.spawn(conn._cache_image, _concurrency,
+                       'target', 'fname', False, wait2, done2)
+        wait2.send()
+        eventlet.sleep(0)
+        try:
+            self.assertFalse(done2.ready())
+            self.assertTrue('fname' in conn._image_sems)
+        finally:
+            wait1.send()
+        done1.wait()
+        eventlet.sleep(0)
+        self.assertTrue(done2.ready())
+        self.assertFalse('fname' in conn._image_sems)
+
+    def test_different_fname_concurrency(self):
+        """Ensures that two different fname caches are concurrent"""
+        conn = libvirt_conn.LibvirtConnection
+        wait1 = eventlet.event.Event()
+        done1 = eventlet.event.Event()
+        eventlet.spawn(conn._cache_image, _concurrency,
+                       'target', 'fname2', False, wait1, done1)
+        wait2 = eventlet.event.Event()
+        done2 = eventlet.event.Event()
+        eventlet.spawn(conn._cache_image, _concurrency,
+                       'target', 'fname1', False, wait2, done2)
+        wait2.send()
+        eventlet.sleep(0)
+        try:
+            self.assertTrue(done2.ready())
+        finally:
+            wait1.send()
+            eventlet.sleep(0)
+
+
 class LibvirtConnTestCase(test.TestCase):
     def setUp(self):
         super(LibvirtConnTestCase, self).setUp()
         libvirt_conn._late_load_cheetah()
         self.flags(fake_call=True)
         self.manager = manager.AuthManager()
+
+        try:
+            pjs = self.manager.get_projects()
+            pjs = [p for p in pjs if p.name == 'fake']
+            if 0 != len(pjs):
+                self.manager.delete_project(pjs[0])
+
+            users = self.manager.get_users()
+            users = [u for u in users if u.name == 'fake']
+            if 0 != len(users):
+                self.manager.delete_user(users[0])
+        except Exception, e:
+            pass
+
+        users = self.manager.get_users()
         self.user = self.manager.create_user('fake', 'fake', 'fake',
                                              admin=True)
         self.project = self.manager.create_project('fake', 'fake', 'fake')
         self.network = utils.import_object(FLAGS.network_manager)
+        self.context = context.get_admin_context()
         FLAGS.instances_path = ''
+        self.call_libvirt_dependant_setup = False
 
     test_ip = '10.11.12.13'
     test_instance = {'memory_kb':     '1024000',
@@ -52,6 +144,58 @@ class LibvirtConnTestCase(test.TestCase):
                      'bridge':        'br101',
                      'instance_type': 'm1.small'}
 
+    def lazy_load_library_exists(self):
+        """check if libvirt is available."""
+        # try to connect libvirt. if fail, skip test.
+        try:
+            import libvirt
+            import libxml2
+        except ImportError:
+            return False
+        global libvirt
+        libvirt = __import__('libvirt')
+        libvirt_conn.libvirt = __import__('libvirt')
+        libvirt_conn.libxml2 = __import__('libxml2')
+        return True
+
+    def create_fake_libvirt_mock(self, **kwargs):
+        """Defining mocks for LibvirtConnection(libvirt is not used)."""
+
+        # A fake libvirt.virConnect
+        class FakeLibvirtConnection(object):
+            pass
+
+        # A fake libvirt_conn.IptablesFirewallDriver
+        class FakeIptablesFirewallDriver(object):
+
+            def __init__(self, **kwargs):
+                pass
+
+            def setattr(self, key, val):
+                self.__setattr__(key, val)
+
+        # Creating mocks
+        fake = FakeLibvirtConnection()
+        fakeip = FakeIptablesFirewallDriver
+        # Customizing above fake if necessary
+        for key, val in kwargs.items():
+            fake.__setattr__(key, val)
+
+        # Inevitable mocks for libvirt_conn.LibvirtConnection
+        self.mox.StubOutWithMock(libvirt_conn.utils, 'import_class')
+        libvirt_conn.utils.import_class(mox.IgnoreArg()).AndReturn(fakeip)
+        self.mox.StubOutWithMock(libvirt_conn.LibvirtConnection, '_conn')
+        libvirt_conn.LibvirtConnection._conn = fake
+
+    def create_service(self, **kwargs):
+        service_ref = {'host': kwargs.get('host', 'dummy'),
+                       'binary': 'nova-compute',
+                       'topic': 'compute',
+                       'report_count': 0,
+                       'availability_zone': 'zone'}
+
+        return db.service_create(context.get_admin_context(), service_ref)
+
     def test_xml_and_uri_no_ramdisk_no_kernel(self):
         instance_data = dict(self.test_instance)
         self._check_xml_and_uri(instance_data,
@@ -191,8 +335,8 @@ class LibvirtConnTestCase(test.TestCase):
                                  expected_result,
                                  '%s failed common check %d' % (xml, i))
 
-        # This test is supposed to make sure we don't override a specifically
-        # set uri
+        # This test is supposed to make sure we don't
+        # override a specifically set uri
         #
         # Deliberately not just assigning this string to FLAGS.libvirt_uri and
         # checking against that later on. This way we make sure the
@@ -204,11 +348,156 @@ class LibvirtConnTestCase(test.TestCase):
             conn = libvirt_conn.LibvirtConnection(True)
             uri = conn.get_uri()
             self.assertEquals(uri, testuri)
+        db.instance_destroy(user_context, instance_ref['id'])
+
+    def test_update_available_resource_works_correctly(self):
+        """Confirm compute_node table is updated successfully."""
+        org_path = FLAGS.instances_path = ''
+        FLAGS.instances_path = '.'
+
+        # Prepare mocks
+        def getVersion():
+            return 12003
+
+        def getType():
+            return 'qemu'
+
+        def listDomainsID():
+            return []
+
+        service_ref = self.create_service(host='dummy')
+        self.create_fake_libvirt_mock(getVersion=getVersion,
+                                      getType=getType,
+                                      listDomainsID=listDomainsID)
+        self.mox.StubOutWithMock(libvirt_conn.LibvirtConnection,
+                                 'get_cpu_info')
+        libvirt_conn.LibvirtConnection.get_cpu_info().AndReturn('cpuinfo')
+
+        # Start test
+        self.mox.ReplayAll()
+        conn = libvirt_conn.LibvirtConnection(False)
+        conn.update_available_resource(self.context, 'dummy')
+        service_ref = db.service_get(self.context, service_ref['id'])
+        compute_node = service_ref['compute_node'][0]
+
+        if sys.platform.upper() == 'LINUX2':
+            self.assertTrue(compute_node['vcpus'] >= 0)
+            self.assertTrue(compute_node['memory_mb'] > 0)
+            self.assertTrue(compute_node['local_gb'] > 0)
+            self.assertTrue(compute_node['vcpus_used'] == 0)
+            self.assertTrue(compute_node['memory_mb_used'] > 0)
+            self.assertTrue(compute_node['local_gb_used'] > 0)
+            self.assertTrue(len(compute_node['hypervisor_type']) > 0)
+            self.assertTrue(compute_node['hypervisor_version'] > 0)
+        else:
+            self.assertTrue(compute_node['vcpus'] >= 0)
+            self.assertTrue(compute_node['memory_mb'] == 0)
+            self.assertTrue(compute_node['local_gb'] > 0)
+            self.assertTrue(compute_node['vcpus_used'] == 0)
+            self.assertTrue(compute_node['memory_mb_used'] == 0)
+            self.assertTrue(compute_node['local_gb_used'] > 0)
+            self.assertTrue(len(compute_node['hypervisor_type']) > 0)
+            self.assertTrue(compute_node['hypervisor_version'] > 0)
+
+        db.service_destroy(self.context, service_ref['id'])
+        FLAGS.instances_path = org_path
+
+    def test_update_resource_info_no_compute_record_found(self):
+        """Raise exception if no recorde found on services table."""
+        org_path = FLAGS.instances_path = ''
+        FLAGS.instances_path = '.'
+        self.create_fake_libvirt_mock()
+
+        self.mox.ReplayAll()
+        conn = libvirt_conn.LibvirtConnection(False)
+        self.assertRaises(exception.Invalid,
+                          conn.update_available_resource,
+                          self.context, 'dummy')
+
+        FLAGS.instances_path = org_path
+
+    def test_ensure_filtering_rules_for_instance_timeout(self):
+        """ensure_filtering_fules_for_instance() finishes with timeout."""
+        # Skip if non-libvirt environment
+        if not self.lazy_load_library_exists():
+            return
+
+        # Preparing mocks
+        def fake_none(self):
+            return
+
+        def fake_raise(self):
+            raise libvirt.libvirtError('ERR')
+
+        self.create_fake_libvirt_mock(nwfilterLookupByName=fake_raise)
+        instance_ref = db.instance_create(self.context, self.test_instance)
+
+        # Start test
+        self.mox.ReplayAll()
+        try:
+            conn = libvirt_conn.LibvirtConnection(False)
+            conn.firewall_driver.setattr('setup_basic_filtering', fake_none)
+            conn.firewall_driver.setattr('prepare_instance_filter', fake_none)
+            conn.ensure_filtering_rules_for_instance(instance_ref)
+        except exception.Error, e:
+            c1 = (0 <= e.message.find('Timeout migrating for'))
+        self.assertTrue(c1)
+
+        db.instance_destroy(self.context, instance_ref['id'])
+
+    def test_live_migration_raises_exception(self):
+        """Confirms recover method is called when exceptions are raised."""
+        # Skip if non-libvirt environment
+        if not self.lazy_load_library_exists():
+            return
+
+        # Preparing data
+        self.compute = utils.import_object(FLAGS.compute_manager)
+        instance_dict = {'host': 'fake', 'state': power_state.RUNNING,
+                         'state_description': 'running'}
+        instance_ref = db.instance_create(self.context, self.test_instance)
+        instance_ref = db.instance_update(self.context, instance_ref['id'],
+                                          instance_dict)
+        vol_dict = {'status': 'migrating', 'size': 1}
+        volume_ref = db.volume_create(self.context, vol_dict)
+        db.volume_attached(self.context, volume_ref['id'], instance_ref['id'],
+                           '/dev/fake')
+
+        # Preparing mocks
+        vdmock = self.mox.CreateMock(libvirt.virDomain)
+        self.mox.StubOutWithMock(vdmock, "migrateToURI")
+        vdmock.migrateToURI(FLAGS.live_migration_uri % 'dest',
+                            mox.IgnoreArg(),
+                            None, FLAGS.live_migration_bandwidth).\
+                            AndRaise(libvirt.libvirtError('ERR'))
+
+        def fake_lookup(instance_name):
+            if instance_name == instance_ref.name:
+                return vdmock
+
+        self.create_fake_libvirt_mock(lookupByName=fake_lookup)
+
+        # Start test
+        self.mox.ReplayAll()
+        conn = libvirt_conn.LibvirtConnection(False)
+        self.assertRaises(libvirt.libvirtError,
+                      conn._live_migration,
+                      self.context, instance_ref, 'dest', '',
+                      self.compute.recover_live_migration)
+
+        instance_ref = db.instance_get(self.context, instance_ref['id'])
+        self.assertTrue(instance_ref['state_description'] == 'running')
+        self.assertTrue(instance_ref['state'] == power_state.RUNNING)
+        volume_ref = db.volume_get(self.context, volume_ref['id'])
+        self.assertTrue(volume_ref['status'] == 'in-use')
+
+        db.volume_destroy(self.context, volume_ref['id'])
+        db.instance_destroy(self.context, instance_ref['id'])
 
     def tearDown(self):
-        super(LibvirtConnTestCase, self).tearDown()
         self.manager.delete_project(self.project)
         self.manager.delete_user(self.user)
+        super(LibvirtConnTestCase, self).tearDown()
 
 
 class IptablesFirewallTestCase(test.TestCase):
@@ -233,16 +522,22 @@ class IptablesFirewallTestCase(test.TestCase):
         self.manager.delete_user(self.user)
         super(IptablesFirewallTestCase, self).tearDown()
 
-    in_rules = [
+    in_nat_rules = [
+      '# Generated by iptables-save v1.4.10 on Sat Feb 19 00:03:19 2011',
+      '*nat',
+      ':PREROUTING ACCEPT [1170:189210]',
+      ':INPUT ACCEPT [844:71028]',
+      ':OUTPUT ACCEPT [5149:405186]',
+      ':POSTROUTING ACCEPT [5063:386098]',
+    ]
+
+    in_filter_rules = [
       '# Generated by iptables-save v1.4.4 on Mon Dec  6 11:54:13 2010',
       '*filter',
       ':INPUT ACCEPT [969615:281627771]',
       ':FORWARD ACCEPT [0:0]',
       ':OUTPUT ACCEPT [915599:63811649]',
       ':nova-block-ipv4 - [0:0]',
-      '-A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT ',
-      '-A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT ',
-      '-A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT ',
       '-A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT ',
       '-A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED'
       ',ESTABLISHED -j ACCEPT ',
@@ -254,7 +549,7 @@ class IptablesFirewallTestCase(test.TestCase):
       '# Completed on Mon Dec  6 11:54:13 2010',
     ]
 
-    in6_rules = [
+    in6_filter_rules = [
       '# Generated by ip6tables-save v1.4.4 on Tue Jan 18 23:47:56 2011',
       '*filter',
       ':INPUT ACCEPT [349155:75810423]',
@@ -314,23 +609,34 @@ class IptablesFirewallTestCase(test.TestCase):
         instance_ref = db.instance_get(admin_ctxt, instance_ref['id'])
 
 #        self.fw.add_instance(instance_ref)
-        def fake_iptables_execute(cmd, process_input=None):
-            if cmd == 'sudo ip6tables-save -t filter':
-                return '\n'.join(self.in6_rules), None
-            if cmd == 'sudo iptables-save -t filter':
-                return '\n'.join(self.in_rules), None
-            if cmd == 'sudo iptables-restore':
-                self.out_rules = process_input.split('\n')
+        def fake_iptables_execute(*cmd, **kwargs):
+            process_input = kwargs.get('process_input', None)
+            if cmd == ('sudo', 'ip6tables-save', '-t', 'filter'):
+                return '\n'.join(self.in6_filter_rules), None
+            if cmd == ('sudo', 'iptables-save', '-t', 'filter'):
+                return '\n'.join(self.in_filter_rules), None
+            if cmd == ('sudo', 'iptables-save', '-t', 'nat'):
+                return '\n'.join(self.in_nat_rules), None
+            if cmd == ('sudo', 'iptables-restore'):
+                lines = process_input.split('\n')
+                if '*filter' in lines:
+                    self.out_rules = lines
                 return '', ''
-            if cmd == 'sudo ip6tables-restore':
-                self.out6_rules = process_input.split('\n')
+            if cmd == ('sudo', 'ip6tables-restore'):
+                lines = process_input.split('\n')
+                if '*filter' in lines:
+                    self.out6_rules = lines
                 return '', ''
-        self.fw.execute = fake_iptables_execute
+            print cmd, kwargs
+
+        from nova.network import linux_net
+        linux_net.iptables_manager.execute = fake_iptables_execute
 
         self.fw.prepare_instance_filter(instance_ref)
         self.fw.apply_instance_filter(instance_ref)
 
-        in_rules = filter(lambda l: not l.startswith('#'), self.in_rules)
+        in_rules = filter(lambda l: not l.startswith('#'),
+                          self.in_filter_rules)
         for rule in in_rules:
             if not 'nova' in rule:
                 self.assertTrue(rule in self.out_rules,
@@ -353,18 +659,20 @@ class IptablesFirewallTestCase(test.TestCase):
         self.assertTrue(security_group_chain,
                         "The security group chain wasn't added")
 
-        self.assertTrue('-A %s -p icmp -s 192.168.11.0/24 -j ACCEPT' % \
-                               security_group_chain in self.out_rules,
+        regex = re.compile('-A .* -p icmp -s 192.168.11.0/24 -j ACCEPT')
+        self.assertTrue(len(filter(regex.match, self.out_rules)) > 0,
                         "ICMP acceptance rule wasn't added")
 
-        self.assertTrue('-A %s -p icmp -s 192.168.11.0/24 -m icmp --icmp-type '
-                        '8 -j ACCEPT' % security_group_chain in self.out_rules,
+        regex = re.compile('-A .* -p icmp -s 192.168.11.0/24 -m icmp '
+                           '--icmp-type 8 -j ACCEPT')
+        self.assertTrue(len(filter(regex.match, self.out_rules)) > 0,
                         "ICMP Echo Request acceptance rule wasn't added")
 
-        self.assertTrue('-A %s -p tcp -s 192.168.10.0/24 -m multiport '
-                        '--dports 80:81 -j ACCEPT' % security_group_chain \
-                            in self.out_rules,
+        regex = re.compile('-A .* -p tcp -s 192.168.10.0/24 -m multiport '
+                           '--dports 80:81 -j ACCEPT')
+        self.assertTrue(len(filter(regex.match, self.out_rules)) > 0,
                         "TCP port 80/81 acceptance rule wasn't added")
+        db.instance_destroy(admin_ctxt, instance_ref['id'])
 
 
 class NWFilterTestCase(test.TestCase):
@@ -388,6 +696,7 @@ class NWFilterTestCase(test.TestCase):
     def tearDown(self):
         self.manager.delete_project(self.project)
         self.manager.delete_user(self.user)
+        super(NWFilterTestCase, self).tearDown()
 
     def test_cidr_rule_nwfilter_xml(self):
         cloud_controller = cloud.CloudController()
@@ -514,3 +823,4 @@ class NWFilterTestCase(test.TestCase):
         self.fw.apply_instance_filter(instance)
         _ensure_all_called()
         self.teardown_security_group()
+        db.instance_destroy(admin_ctxt, instance_ref['id'])
diff --git a/nova/tests/test_volume.py b/nova/tests/test_volume.py
index b40ca004b..1b1d72092 100644
--- a/nova/tests/test_volume.py
+++ b/nova/tests/test_volume.py
@@ -20,6 +20,8 @@ Tests for Volume Code.
 
 """
 
+import cStringIO
+
 from nova import context
 from nova import exception
 from nova import db
@@ -99,7 +101,7 @@ class VolumeTestCase(test.TestCase):
     def test_run_attach_detach_volume(self):
         """Make sure volume can be attached and detached from instance."""
         inst = {}
-        inst['image_id'] = 'ami-test'
+        inst['image_id'] = 1
         inst['reservation_id'] = 'r-fakeres'
         inst['launch_time'] = '10'
         inst['user_id'] = 'fake'
@@ -173,3 +175,196 @@ class VolumeTestCase(test.TestCase):
         # each of them having a different FLAG for storage_node
         # This will allow us to test cross-node interactions
         pass
+
+
+class DriverTestCase(test.TestCase):
+    """Base Test class for Drivers."""
+    driver_name = "nova.volume.driver.FakeAOEDriver"
+
+    def setUp(self):
+        super(DriverTestCase, self).setUp()
+        self.flags(volume_driver=self.driver_name,
+                   logging_default_format_string="%(message)s")
+        self.volume = utils.import_object(FLAGS.volume_manager)
+        self.context = context.get_admin_context()
+        self.output = ""
+
+        def _fake_execute(_command, *_args, **_kwargs):
+            """Fake _execute."""
+            return self.output, None
+        self.volume.driver._execute = _fake_execute
+        self.volume.driver._sync_execute = _fake_execute
+
+        log = logging.getLogger()
+        self.stream = cStringIO.StringIO()
+        log.addHandler(logging.StreamHandler(self.stream))
+
+        inst = {}
+        self.instance_id = db.instance_create(self.context, inst)['id']
+
+    def tearDown(self):
+        super(DriverTestCase, self).tearDown()
+
+    def _attach_volume(self):
+        """Attach volumes to an instance. This function also sets
+           a fake log message."""
+        return []
+
+    def _detach_volume(self, volume_id_list):
+        """Detach volumes from an instance."""
+        for volume_id in volume_id_list:
+            db.volume_detached(self.context, volume_id)
+            self.volume.delete_volume(self.context, volume_id)
+
+
+class AOETestCase(DriverTestCase):
+    """Test Case for AOEDriver"""
+    driver_name = "nova.volume.driver.AOEDriver"
+
+    def setUp(self):
+        super(AOETestCase, self).setUp()
+
+    def tearDown(self):
+        super(AOETestCase, self).tearDown()
+
+    def _attach_volume(self):
+        """Attach volumes to an instance. This function also sets
+           a fake log message."""
+        volume_id_list = []
+        for index in xrange(3):
+            vol = {}
+            vol['size'] = 0
+            volume_id = db.volume_create(self.context,
+                                         vol)['id']
+            self.volume.create_volume(self.context, volume_id)
+
+            # each volume has a different mountpoint
+            mountpoint = "/dev/sd" + chr((ord('b') + index))
+            db.volume_attached(self.context, volume_id, self.instance_id,
+                               mountpoint)
+
+            (shelf_id, blade_id) = db.volume_get_shelf_and_blade(self.context,
+                                                                 volume_id)
+            self.output += "%s %s eth0 /dev/nova-volumes/vol-foo auto run\n" \
+                      % (shelf_id, blade_id)
+
+            volume_id_list.append(volume_id)
+
+        return volume_id_list
+
+    def test_check_for_export_with_no_volume(self):
+        """No log message when no volume is attached to an instance."""
+        self.stream.truncate(0)
+        self.volume.check_for_export(self.context, self.instance_id)
+        self.assertEqual(self.stream.getvalue(), '')
+
+    def test_check_for_export_with_all_vblade_processes(self):
+        """No log message when all the vblade processes are running."""
+        volume_id_list = self._attach_volume()
+
+        self.stream.truncate(0)
+        self.volume.check_for_export(self.context, self.instance_id)
+        self.assertEqual(self.stream.getvalue(), '')
+
+        self._detach_volume(volume_id_list)
+
+    def test_check_for_export_with_vblade_process_missing(self):
+        """Output a warning message when some vblade processes aren't
+           running."""
+        volume_id_list = self._attach_volume()
+
+        # the first vblade process isn't running
+        self.output = self.output.replace("run", "down", 1)
+        (shelf_id, blade_id) = db.volume_get_shelf_and_blade(self.context,
+                                                             volume_id_list[0])
+
+        msg_is_match = False
+        self.stream.truncate(0)
+        try:
+            self.volume.check_for_export(self.context, self.instance_id)
+        except exception.ProcessExecutionError, e:
+            volume_id = volume_id_list[0]
+            msg = _("Cannot confirm exported volume id:%(volume_id)s. "
+                    "vblade process for e%(shelf_id)s.%(blade_id)s "
+                    "isn't running.") % locals()
+
+            msg_is_match = (0 <= e.message.find(msg))
+
+        self.assertTrue(msg_is_match)
+        self._detach_volume(volume_id_list)
+
+
+class ISCSITestCase(DriverTestCase):
+    """Test Case for ISCSIDriver"""
+    driver_name = "nova.volume.driver.ISCSIDriver"
+
+    def setUp(self):
+        super(ISCSITestCase, self).setUp()
+
+    def tearDown(self):
+        super(ISCSITestCase, self).tearDown()
+
+    def _attach_volume(self):
+        """Attach volumes to an instance. This function also sets
+           a fake log message."""
+        volume_id_list = []
+        for index in xrange(3):
+            vol = {}
+            vol['size'] = 0
+            vol_ref = db.volume_create(self.context, vol)
+            self.volume.create_volume(self.context, vol_ref['id'])
+            vol_ref = db.volume_get(self.context, vol_ref['id'])
+
+            # each volume has a different mountpoint
+            mountpoint = "/dev/sd" + chr((ord('b') + index))
+            db.volume_attached(self.context, vol_ref['id'], self.instance_id,
+                               mountpoint)
+            volume_id_list.append(vol_ref['id'])
+
+        return volume_id_list
+
+    def test_check_for_export_with_no_volume(self):
+        """No log message when no volume is attached to an instance."""
+        self.stream.truncate(0)
+        self.volume.check_for_export(self.context, self.instance_id)
+        self.assertEqual(self.stream.getvalue(), '')
+
+    def test_check_for_export_with_all_volume_exported(self):
+        """No log message when all the vblade processes are running."""
+        volume_id_list = self._attach_volume()
+
+        self.mox.StubOutWithMock(self.volume.driver, '_execute')
+        for i in volume_id_list:
+            tid = db.volume_get_iscsi_target_num(self.context, i)
+            self.volume.driver._execute("sudo ietadm --op show --tid=%(tid)d"
+                                        % locals())
+
+        self.stream.truncate(0)
+        self.mox.ReplayAll()
+        self.volume.check_for_export(self.context, self.instance_id)
+        self.assertEqual(self.stream.getvalue(), '')
+        self.mox.UnsetStubs()
+
+        self._detach_volume(volume_id_list)
+
+    def test_check_for_export_with_some_volume_missing(self):
+        """Output a warning message when some volumes are not recognied
+           by ietd."""
+        volume_id_list = self._attach_volume()
+
+        # the first vblade process isn't running
+        tid = db.volume_get_iscsi_target_num(self.context, volume_id_list[0])
+        self.mox.StubOutWithMock(self.volume.driver, '_execute')
+        self.volume.driver._execute("sudo ietadm --op show --tid=%(tid)d"
+            % locals()).AndRaise(exception.ProcessExecutionError())
+
+        self.mox.ReplayAll()
+        self.assertRaises(exception.ProcessExecutionError,
+                          self.volume.check_for_export,
+                          self.context,
+                          self.instance_id)
+        msg = _("Cannot confirm exported volume id:%s.") % volume_id_list[0]
+        self.assertTrue(0 <= self.stream.getvalue().find(msg))
+        self.mox.UnsetStubs()
+
+        self._detach_volume(volume_id_list)
diff --git a/nova/tests/test_xenapi.py b/nova/tests/test_xenapi.py
index 6b8efc9d8..cd125a301 100644
--- a/nova/tests/test_xenapi.py
+++ b/nova/tests/test_xenapi.py
@@ -18,6 +18,7 @@
 Test suite for XenAPI
 """
 
+import functools
 import stubout
 
 from nova import db
@@ -31,6 +32,7 @@ from nova.compute import power_state
 from nova.virt import xenapi_conn
 from nova.virt.xenapi import fake as xenapi_fake
 from nova.virt.xenapi import volume_utils
+from nova.virt.xenapi import vm_utils
 from nova.virt.xenapi.vmops import SimpleDH
 from nova.virt.xenapi.vmops import VMOps
 from nova.tests.db import fakes as db_fakes
@@ -40,6 +42,21 @@ from nova.tests.glance import stubs as glance_stubs
 FLAGS = flags.FLAGS
 
 
+def stub_vm_utils_with_vdi_attached_here(function, should_return=True):
+    """
+    vm_utils.with_vdi_attached_here needs to be stubbed out because it
+    calls down to the filesystem to attach a vdi. This provides a
+    decorator to handle that.
+    """
+    @functools.wraps(function)
+    def decorated_function(self, *args, **kwargs):
+        orig_with_vdi_attached_here = vm_utils.with_vdi_attached_here
+        vm_utils.with_vdi_attached_here = lambda *x: should_return
+        function(self, *args, **kwargs)
+        vm_utils.with_vdi_attached_here = orig_with_vdi_attached_here
+    return decorated_function
+
+
 class XenAPIVolumeTestCase(test.TestCase):
     """
     Unit tests for Volume operations
@@ -61,6 +78,7 @@ class XenAPIVolumeTestCase(test.TestCase):
                   'ramdisk_id': 3,
                   'instance_type': 'm1.large',
                   'mac_address': 'aa:bb:cc:dd:ee:ff',
+                  'os_type': 'linux'
                   }
 
     def _create_volume(self, size='0'):
@@ -167,6 +185,7 @@ class XenAPIVMTestCase(test.TestCase):
         stubs.stubout_session(self.stubs, stubs.FakeSessionForVMTests)
         stubs.stubout_get_this_vm_uuid(self.stubs)
         stubs.stubout_stream_disk(self.stubs)
+        stubs.stubout_is_vdi_pv(self.stubs)
         self.stubs.Set(VMOps, 'reset_network', reset_network)
         glance_stubs.stubout_glance_client(self.stubs,
                                            glance_stubs.FakeGlance)
@@ -217,7 +236,7 @@ class XenAPIVMTestCase(test.TestCase):
 
         check()
 
-    def check_vm_record(self, conn):
+    def create_vm_record(self, conn, os_type):
         instances = conn.list_instances()
         self.assertEquals(instances, [1])
 
@@ -229,28 +248,63 @@ class XenAPIVMTestCase(test.TestCase):
                in xenapi_fake.get_all_records('VM').iteritems()
                if not rec['is_control_domain']]
         vm = vms[0]
+        self.vm_info = vm_info
+        self.vm = vm
 
+    def check_vm_record(self, conn):
         # Check that m1.large above turned into the right thing.
-        instance_type = instance_types.INSTANCE_TYPES['m1.large']
+        instance_type = db.instance_type_get_by_name(conn, 'm1.large')
         mem_kib = long(instance_type['memory_mb']) << 10
         mem_bytes = str(mem_kib << 10)
         vcpus = instance_type['vcpus']
-        self.assertEquals(vm_info['max_mem'], mem_kib)
-        self.assertEquals(vm_info['mem'], mem_kib)
-        self.assertEquals(vm['memory_static_max'], mem_bytes)
-        self.assertEquals(vm['memory_dynamic_max'], mem_bytes)
-        self.assertEquals(vm['memory_dynamic_min'], mem_bytes)
-        self.assertEquals(vm['VCPUs_max'], str(vcpus))
-        self.assertEquals(vm['VCPUs_at_startup'], str(vcpus))
+        self.assertEquals(self.vm_info['max_mem'], mem_kib)
+        self.assertEquals(self.vm_info['mem'], mem_kib)
+        self.assertEquals(self.vm['memory_static_max'], mem_bytes)
+        self.assertEquals(self.vm['memory_dynamic_max'], mem_bytes)
+        self.assertEquals(self.vm['memory_dynamic_min'], mem_bytes)
+        self.assertEquals(self.vm['VCPUs_max'], str(vcpus))
+        self.assertEquals(self.vm['VCPUs_at_startup'], str(vcpus))
 
         # Check that the VM is running according to Nova
-        self.assertEquals(vm_info['state'], power_state.RUNNING)
+        self.assertEquals(self.vm_info['state'], power_state.RUNNING)
 
         # Check that the VM is running according to XenAPI.
-        self.assertEquals(vm['power_state'], 'Running')
+        self.assertEquals(self.vm['power_state'], 'Running')
+
+    def check_vm_params_for_windows(self):
+        self.assertEquals(self.vm['platform']['nx'], 'true')
+        self.assertEquals(self.vm['HVM_boot_params'], {'order': 'dc'})
+        self.assertEquals(self.vm['HVM_boot_policy'], 'BIOS order')
+
+        # check that these are not set
+        self.assertEquals(self.vm['PV_args'], '')
+        self.assertEquals(self.vm['PV_bootloader'], '')
+        self.assertEquals(self.vm['PV_kernel'], '')
+        self.assertEquals(self.vm['PV_ramdisk'], '')
+
+    def check_vm_params_for_linux(self):
+        self.assertEquals(self.vm['platform']['nx'], 'false')
+        self.assertEquals(self.vm['PV_args'], 'clocksource=jiffies')
+        self.assertEquals(self.vm['PV_bootloader'], 'pygrub')
+
+        # check that these are not set
+        self.assertEquals(self.vm['PV_kernel'], '')
+        self.assertEquals(self.vm['PV_ramdisk'], '')
+        self.assertEquals(self.vm['HVM_boot_params'], {})
+        self.assertEquals(self.vm['HVM_boot_policy'], '')
+
+    def check_vm_params_for_linux_with_external_kernel(self):
+        self.assertEquals(self.vm['platform']['nx'], 'false')
+        self.assertEquals(self.vm['PV_args'], 'root=/dev/xvda1')
+        self.assertNotEquals(self.vm['PV_kernel'], '')
+        self.assertNotEquals(self.vm['PV_ramdisk'], '')
+
+        # check that these are not set
+        self.assertEquals(self.vm['HVM_boot_params'], {})
+        self.assertEquals(self.vm['HVM_boot_policy'], '')
 
     def _test_spawn(self, image_id, kernel_id, ramdisk_id,
-                    instance_type="m1.large"):
+                    instance_type="m1.large", os_type="linux"):
         stubs.stubout_session(self.stubs, stubs.FakeSessionForVMTests)
         values = {'name': 1,
                   'id': 1,
@@ -261,10 +315,12 @@ class XenAPIVMTestCase(test.TestCase):
                   'ramdisk_id': ramdisk_id,
                   'instance_type': instance_type,
                   'mac_address': 'aa:bb:cc:dd:ee:ff',
+                  'os_type': os_type
                   }
         conn = xenapi_conn.get_connection(False)
         instance = db.instance_create(values)
         conn.spawn(instance)
+        self.create_vm_record(conn, os_type)
         self.check_vm_record(conn)
 
     def test_spawn_not_enough_memory(self):
@@ -281,18 +337,37 @@ class XenAPIVMTestCase(test.TestCase):
         FLAGS.xenapi_image_service = 'objectstore'
         self._test_spawn(1, 2, 3)
 
+    @stub_vm_utils_with_vdi_attached_here
     def test_spawn_raw_glance(self):
         FLAGS.xenapi_image_service = 'glance'
-        self._test_spawn(1, None, None)
+        self._test_spawn(glance_stubs.FakeGlance.IMAGE_RAW, None, None)
+        self.check_vm_params_for_linux()
+
+    def test_spawn_vhd_glance_linux(self):
+        FLAGS.xenapi_image_service = 'glance'
+        self._test_spawn(glance_stubs.FakeGlance.IMAGE_VHD, None, None,
+                         os_type="linux")
+        self.check_vm_params_for_linux()
+
+    def test_spawn_vhd_glance_windows(self):
+        FLAGS.xenapi_image_service = 'glance'
+        self._test_spawn(glance_stubs.FakeGlance.IMAGE_VHD, None, None,
+                         os_type="windows")
+        self.check_vm_params_for_windows()
 
     def test_spawn_glance(self):
         FLAGS.xenapi_image_service = 'glance'
-        self._test_spawn(1, 2, 3)
+        self._test_spawn(glance_stubs.FakeGlance.IMAGE_MACHINE,
+                         glance_stubs.FakeGlance.IMAGE_KERNEL,
+                         glance_stubs.FakeGlance.IMAGE_RAMDISK)
+        self.check_vm_params_for_linux_with_external_kernel()
 
     def tearDown(self):
         super(XenAPIVMTestCase, self).tearDown()
         self.manager.delete_project(self.project)
         self.manager.delete_user(self.user)
+        self.vm_info = None
+        self.vm = None
         self.stubs.UnsetAll()
 
     def _create_instance(self):
@@ -306,7 +381,8 @@ class XenAPIVMTestCase(test.TestCase):
             'kernel_id': 2,
             'ramdisk_id': 3,
             'instance_type': 'm1.large',
-            'mac_address': 'aa:bb:cc:dd:ee:ff'}
+            'mac_address': 'aa:bb:cc:dd:ee:ff',
+            'os_type': 'linux'}
         instance = db.instance_create(values)
         self.conn.spawn(instance)
         return instance
@@ -336,3 +412,115 @@ class XenAPIDiffieHellmanTestCase(test.TestCase):
 
     def tearDown(self):
         super(XenAPIDiffieHellmanTestCase, self).tearDown()
+
+
+class XenAPIMigrateInstance(test.TestCase):
+    """
+    Unit test for verifying migration-related actions
+    """
+
+    def setUp(self):
+        super(XenAPIMigrateInstance, self).setUp()
+        self.stubs = stubout.StubOutForTesting()
+        FLAGS.target_host = '127.0.0.1'
+        FLAGS.xenapi_connection_url = 'test_url'
+        FLAGS.xenapi_connection_password = 'test_pass'
+        db_fakes.stub_out_db_instance_api(self.stubs)
+        stubs.stub_out_get_target(self.stubs)
+        xenapi_fake.reset()
+        self.manager = manager.AuthManager()
+        self.user = self.manager.create_user('fake', 'fake', 'fake',
+                                             admin=True)
+        self.project = self.manager.create_project('fake', 'fake', 'fake')
+        self.values = {'name': 1, 'id': 1,
+                  'project_id': self.project.id,
+                  'user_id': self.user.id,
+                  'image_id': 1,
+                  'kernel_id': None,
+                  'ramdisk_id': None,
+                  'instance_type': 'm1.large',
+                  'mac_address': 'aa:bb:cc:dd:ee:ff',
+                  'os_type': 'linux'
+                  }
+        stubs.stub_out_migration_methods(self.stubs)
+        glance_stubs.stubout_glance_client(self.stubs,
+                                           glance_stubs.FakeGlance)
+
+    def tearDown(self):
+        super(XenAPIMigrateInstance, self).tearDown()
+        self.manager.delete_project(self.project)
+        self.manager.delete_user(self.user)
+        self.stubs.UnsetAll()
+
+    def test_migrate_disk_and_power_off(self):
+        instance = db.instance_create(self.values)
+        stubs.stubout_session(self.stubs, stubs.FakeSessionForMigrationTests)
+        conn = xenapi_conn.get_connection(False)
+        conn.migrate_disk_and_power_off(instance, '127.0.0.1')
+
+    def test_finish_resize(self):
+        instance = db.instance_create(self.values)
+        stubs.stubout_session(self.stubs, stubs.FakeSessionForMigrationTests)
+        conn = xenapi_conn.get_connection(False)
+        conn.finish_resize(instance, dict(base_copy='hurr', cow='durr'))
+
+
+class XenAPIDetermineDiskImageTestCase(test.TestCase):
+    """
+    Unit tests for code that detects the ImageType
+    """
+    def setUp(self):
+        super(XenAPIDetermineDiskImageTestCase, self).setUp()
+        glance_stubs.stubout_glance_client(self.stubs,
+                                           glance_stubs.FakeGlance)
+
+        class FakeInstance(object):
+            pass
+
+        self.fake_instance = FakeInstance()
+        self.fake_instance.id = 42
+        self.fake_instance.os_type = 'linux'
+
+    def assert_disk_type(self, disk_type):
+        dt = vm_utils.VMHelper.determine_disk_image_type(
+            self.fake_instance)
+        self.assertEqual(disk_type, dt)
+
+    def test_instance_disk(self):
+        """
+        If a kernel is specified then the image type is DISK (aka machine)
+        """
+        FLAGS.xenapi_image_service = 'objectstore'
+        self.fake_instance.image_id = glance_stubs.FakeGlance.IMAGE_MACHINE
+        self.fake_instance.kernel_id = glance_stubs.FakeGlance.IMAGE_KERNEL
+        self.assert_disk_type(vm_utils.ImageType.DISK)
+
+    def test_instance_disk_raw(self):
+        """
+        If the kernel isn't specified, and we're not using Glance, then
+        DISK_RAW is assumed.
+        """
+        FLAGS.xenapi_image_service = 'objectstore'
+        self.fake_instance.image_id = glance_stubs.FakeGlance.IMAGE_RAW
+        self.fake_instance.kernel_id = None
+        self.assert_disk_type(vm_utils.ImageType.DISK_RAW)
+
+    def test_glance_disk_raw(self):
+        """
+        If we're using Glance, then defer to the image_type field, which in
+        this case will be 'raw'.
+        """
+        FLAGS.xenapi_image_service = 'glance'
+        self.fake_instance.image_id = glance_stubs.FakeGlance.IMAGE_RAW
+        self.fake_instance.kernel_id = None
+        self.assert_disk_type(vm_utils.ImageType.DISK_RAW)
+
+    def test_glance_disk_vhd(self):
+        """
+        If we're using Glance, then defer to the image_type field, which in
+        this case will be 'vhd'.
+        """
+        FLAGS.xenapi_image_service = 'glance'
+        self.fake_instance.image_id = glance_stubs.FakeGlance.IMAGE_VHD
+        self.fake_instance.kernel_id = None
+        self.assert_disk_type(vm_utils.ImageType.DISK_VHD)
diff --git a/nova/tests/test_zones.py b/nova/tests/test_zones.py
new file mode 100644
index 000000000..5a52a0506
--- /dev/null
+++ b/nova/tests/test_zones.py
@@ -0,0 +1,172 @@
+# Copyright 2010 United States Government as represented by the
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+"""
+Tests For ZoneManager
+"""
+
+import datetime
+import mox
+import novaclient
+
+from nova import context
+from nova import db
+from nova import flags
+from nova import service
+from nova import test
+from nova import rpc
+from nova import utils
+from nova.auth import manager as auth_manager
+from nova.scheduler import zone_manager
+
+FLAGS = flags.FLAGS
+
+
+class FakeZone:
+    """Represents a fake zone from the db"""
+    def __init__(self, *args, **kwargs):
+        for k, v in kwargs.iteritems():
+            setattr(self, k, v)
+
+
+def exploding_novaclient(zone):
+    """Used when we want to simulate a novaclient call failing."""
+    raise Exception("kaboom")
+
+
+class ZoneManagerTestCase(test.TestCase):
+    """Test case for zone manager"""
+    def test_ping(self):
+        zm = zone_manager.ZoneManager()
+        self.mox.StubOutWithMock(zm, '_refresh_from_db')
+        self.mox.StubOutWithMock(zm, '_poll_zones')
+        zm._refresh_from_db(mox.IgnoreArg())
+        zm._poll_zones(mox.IgnoreArg())
+
+        self.mox.ReplayAll()
+        zm.ping(None)
+        self.mox.VerifyAll()
+
+    def test_refresh_from_db_new(self):
+        zm = zone_manager.ZoneManager()
+
+        self.mox.StubOutWithMock(db, 'zone_get_all')
+        db.zone_get_all(mox.IgnoreArg()).AndReturn([
+               FakeZone(id=1, api_url='http://foo.com', username='user1',
+                    password='pass1'),
+            ])
+
+        self.assertEquals(len(zm.zone_states), 0)
+
+        self.mox.ReplayAll()
+        zm._refresh_from_db(None)
+        self.mox.VerifyAll()
+
+        self.assertEquals(len(zm.zone_states), 1)
+        self.assertEquals(zm.zone_states[1].username, 'user1')
+
+    def test_refresh_from_db_replace_existing(self):
+        zm = zone_manager.ZoneManager()
+        zone_state = zone_manager.ZoneState()
+        zone_state.update_credentials(FakeZone(id=1, api_url='http://foo.com',
+                        username='user1', password='pass1'))
+        zm.zone_states[1] = zone_state
+
+        self.mox.StubOutWithMock(db, 'zone_get_all')
+        db.zone_get_all(mox.IgnoreArg()).AndReturn([
+               FakeZone(id=1, api_url='http://foo.com', username='user2',
+                    password='pass2'),
+            ])
+
+        self.assertEquals(len(zm.zone_states), 1)
+
+        self.mox.ReplayAll()
+        zm._refresh_from_db(None)
+        self.mox.VerifyAll()
+
+        self.assertEquals(len(zm.zone_states), 1)
+        self.assertEquals(zm.zone_states[1].username, 'user2')
+
+    def test_refresh_from_db_missing(self):
+        zm = zone_manager.ZoneManager()
+        zone_state = zone_manager.ZoneState()
+        zone_state.update_credentials(FakeZone(id=1, api_url='http://foo.com',
+                        username='user1', password='pass1'))
+        zm.zone_states[1] = zone_state
+
+        self.mox.StubOutWithMock(db, 'zone_get_all')
+        db.zone_get_all(mox.IgnoreArg()).AndReturn([])
+
+        self.assertEquals(len(zm.zone_states), 1)
+
+        self.mox.ReplayAll()
+        zm._refresh_from_db(None)
+        self.mox.VerifyAll()
+
+        self.assertEquals(len(zm.zone_states), 0)
+
+    def test_refresh_from_db_add_and_delete(self):
+        zm = zone_manager.ZoneManager()
+        zone_state = zone_manager.ZoneState()
+        zone_state.update_credentials(FakeZone(id=1, api_url='http://foo.com',
+                        username='user1', password='pass1'))
+        zm.zone_states[1] = zone_state
+
+        self.mox.StubOutWithMock(db, 'zone_get_all')
+
+        db.zone_get_all(mox.IgnoreArg()).AndReturn([
+               FakeZone(id=2, api_url='http://foo.com', username='user2',
+                    password='pass2'),
+            ])
+        self.assertEquals(len(zm.zone_states), 1)
+
+        self.mox.ReplayAll()
+        zm._refresh_from_db(None)
+        self.mox.VerifyAll()
+
+        self.assertEquals(len(zm.zone_states), 1)
+        self.assertEquals(zm.zone_states[2].username, 'user2')
+
+    def test_poll_zone(self):
+        self.mox.StubOutWithMock(zone_manager, '_call_novaclient')
+        zone_manager._call_novaclient(mox.IgnoreArg()).AndReturn(
+                        dict(name='zohan', capabilities='hairdresser'))
+
+        zone_state = zone_manager.ZoneState()
+        zone_state.update_credentials(FakeZone(id=2,
+                       api_url='http://foo.com', username='user2',
+                       password='pass2'))
+        zone_state.attempt = 1
+
+        self.mox.ReplayAll()
+        zone_manager._poll_zone(zone_state)
+        self.mox.VerifyAll()
+        self.assertEquals(zone_state.attempt, 0)
+        self.assertEquals(zone_state.name, 'zohan')
+
+    def test_poll_zone_fails(self):
+        self.stubs.Set(zone_manager, "_call_novaclient", exploding_novaclient)
+
+        zone_state = zone_manager.ZoneState()
+        zone_state.update_credentials(FakeZone(id=2,
+                       api_url='http://foo.com', username='user2',
+                       password='pass2'))
+        zone_state.attempt = FLAGS.zone_failures_to_offline - 1
+
+        self.mox.ReplayAll()
+        zone_manager._poll_zone(zone_state)
+        self.mox.VerifyAll()
+        self.assertEquals(zone_state.attempt, 3)
+        self.assertFalse(zone_state.is_active)
+        self.assertEquals(zone_state.name, None)
diff --git a/nova/tests/xenapi/stubs.py b/nova/tests/xenapi/stubs.py
index 624995ada..70d46a1fb 100644
--- a/nova/tests/xenapi/stubs.py
+++ b/nova/tests/xenapi/stubs.py
@@ -20,6 +20,7 @@ from nova.virt import xenapi_conn
 from nova.virt.xenapi import fake
 from nova.virt.xenapi import volume_utils
 from nova.virt.xenapi import vm_utils
+from nova.virt.xenapi import vmops
 
 
 def stubout_instance_snapshot(stubs):
@@ -27,7 +28,7 @@ def stubout_instance_snapshot(stubs):
     def fake_fetch_image(cls, session, instance_id, image, user, project,
                          type):
         # Stubout wait_for_task
-        def fake_wait_for_task(self, id, task):
+        def fake_wait_for_task(self, task, id):
             class FakeEvent:
 
                 def send(self, value):
@@ -130,6 +131,12 @@ def stubout_stream_disk(stubs):
     stubs.Set(vm_utils, '_stream_disk', f)
 
 
+def stubout_is_vdi_pv(stubs):
+    def f(_1):
+        return False
+    stubs.Set(vm_utils, '_is_vdi_pv', f)
+
+
 class FakeSessionForVMTests(fake.SessionBase):
     """ Stubs out a XenAPISession for VM tests """
     def __init__(self, uri):
@@ -171,6 +178,12 @@ class FakeSessionForVMTests(fake.SessionBase):
     def VM_destroy(self, session_ref, vm_ref):
         fake.destroy_vm(vm_ref)
 
+    def SR_scan(self, session_ref, sr_ref):
+        pass
+
+    def VDI_set_name_label(self, session_ref, vdi_ref, name_label):
+        pass
+
 
 class FakeSessionForVolumeTests(fake.SessionBase):
     """ Stubs out a XenAPISession for Volume tests """
@@ -205,3 +218,60 @@ class FakeSessionForVolumeFailedTests(FakeSessionForVolumeTests):
 
     def SR_forget(self, _1, ref):
         pass
+
+
+class FakeSessionForMigrationTests(fake.SessionBase):
+    """Stubs out a XenAPISession for Migration tests"""
+    def __init__(self, uri):
+        super(FakeSessionForMigrationTests, self).__init__(uri)
+
+    def VDI_get_by_uuid(*args):
+        return 'hurr'
+
+    def VM_start(self, _1, ref, _2, _3):
+        vm = fake.get_record('VM', ref)
+        if vm['power_state'] != 'Halted':
+            raise fake.Failure(['VM_BAD_POWER_STATE', ref, 'Halted',
+                                  vm['power_state']])
+        vm['power_state'] = 'Running'
+        vm['is_a_template'] = False
+        vm['is_control_domain'] = False
+
+
+def stub_out_migration_methods(stubs):
+    def fake_get_snapshot(self, instance):
+        return 'foo', 'bar'
+
+    @classmethod
+    def fake_get_vdi(cls, session, vm_ref):
+        vdi_ref = fake.create_vdi(name_label='derp', read_only=False,
+                             sr_ref='herp', sharable=False)
+        vdi_rec = session.get_xenapi().VDI.get_record(vdi_ref)
+        return vdi_ref, {'uuid': vdi_rec['uuid'], }
+
+    def fake_shutdown(self, inst, vm, method='clean'):
+        pass
+
+    @classmethod
+    def fake_sr(cls, session, *args):
+        pass
+
+    @classmethod
+    def fake_get_sr_path(cls, *args):
+        return "fake"
+
+    def fake_destroy(*args, **kwargs):
+        pass
+
+    def fake_reset_network(*args, **kwargs):
+        pass
+
+    stubs.Set(vmops.VMOps, '_destroy', fake_destroy)
+    stubs.Set(vm_utils.VMHelper, 'scan_default_sr', fake_sr)
+    stubs.Set(vm_utils.VMHelper, 'scan_sr', fake_sr)
+    stubs.Set(vmops.VMOps, '_get_snapshot', fake_get_snapshot)
+    stubs.Set(vm_utils.VMHelper, 'get_vdi_for_vm_safely', fake_get_vdi)
+    stubs.Set(xenapi_conn.XenAPISession, 'wait_for_task', lambda x, y, z: None)
+    stubs.Set(vm_utils.VMHelper, 'get_sr_path', fake_get_sr_path)
+    stubs.Set(vmops.VMOps, 'reset_network', fake_reset_network)
+    stubs.Set(vmops.VMOps, '_shutdown', fake_shutdown)
diff --git a/nova/twistd.py b/nova/twistd.py
index 60ff7879a..c07ed991f 100644
--- a/nova/twistd.py
+++ b/nova/twistd.py
@@ -148,6 +148,7 @@ def WrapTwistedOptions(wrapped):
                 options.insert(0, '')
 
             args = FLAGS(options)
+            logging.setup()
             argv = args[1:]
             # ignore subcommands
 
@@ -258,7 +259,6 @@ def serve(filename):
         print 'usage: %s [options] [start|stop|restart]' % argv[0]
         sys.exit(1)
 
-    logging.basicConfig()
     logging.debug(_("Full set of FLAGS:"))
     for flag in FLAGS:
         logging.debug("%s : %s" % (flag, FLAGS.get(flag, None)))
diff --git a/nova/utils.py b/nova/utils.py
index 42efa0008..87e726394 100644
--- a/nova/utils.py
+++ b/nova/utils.py
@@ -2,6 +2,7 @@
 
 # Copyright 2010 United States Government as represented by the
 # Administrator of the National Aeronautics and Space Administration.
+# Copyright 2011 Justin Santa Barbara
 # All Rights Reserved.
 #
 #    Licensed under the Apache License, Version 2.0 (the "License"); you may
@@ -22,30 +23,35 @@ System-level utilities and helper functions.
 
 import base64
 import datetime
+import functools
 import inspect
 import json
+import lockfile
+import netaddr
 import os
 import random
+import re
 import socket
 import string
 import struct
 import sys
 import time
+import types
 from xml.sax import saxutils
-import re
-import netaddr
 
 from eventlet import event
 from eventlet import greenthread
 from eventlet.green import subprocess
-
+None
 from nova import exception
 from nova.exception import ProcessExecutionError
+from nova import flags
 from nova import log as logging
 
 
 LOG = logging.getLogger("nova.utils")
 TIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ"
+FLAGS = flags.FLAGS
 
 
 def import_class(import_str):
@@ -55,7 +61,7 @@ def import_class(import_str):
         __import__(mod_str)
         return getattr(sys.modules[mod_str], class_str)
     except (ImportError, ValueError, AttributeError), exc:
-        logging.debug(_('Inner Exception: %s'), exc)
+        LOG.debug(_('Inner Exception: %s'), exc)
         raise exception.NotFound(_('Class %s cannot be found') % class_str)
 
 
@@ -123,40 +129,59 @@ def fetchfile(url, target):
 #    c.perform()
 #    c.close()
 #    fp.close()
-    execute("curl --fail %s -o %s" % (url, target))
-
-
-def execute(cmd, process_input=None, addl_env=None, check_exit_code=True):
-    LOG.debug(_("Running cmd (subprocess): %s"), cmd)
-    env = os.environ.copy()
-    if addl_env:
-        env.update(addl_env)
-    obj = subprocess.Popen(cmd, shell=True, stdin=subprocess.PIPE,
-        stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=env)
-    result = None
-    if process_input != None:
-        result = obj.communicate(process_input)
-    else:
-        result = obj.communicate()
-    obj.stdin.close()
-    if obj.returncode:
-        LOG.debug(_("Result was %s") % obj.returncode)
-        if check_exit_code and obj.returncode != 0:
-            (stdout, stderr) = result
-            raise ProcessExecutionError(exit_code=obj.returncode,
-                                        stdout=stdout,
-                                        stderr=stderr,
-                                        cmd=cmd)
-    # NOTE(termie): this appears to be necessary to let the subprocess call
-    #               clean something up in between calls, without it two
-    #               execute calls in a row hangs the second one
-    greenthread.sleep(0)
-    return result
+    execute("curl", "--fail", url, "-o", target)
+
+
+def execute(*cmd, **kwargs):
+    process_input = kwargs.get('process_input', None)
+    addl_env = kwargs.get('addl_env', None)
+    check_exit_code = kwargs.get('check_exit_code', 0)
+    stdin = kwargs.get('stdin', subprocess.PIPE)
+    stdout = kwargs.get('stdout', subprocess.PIPE)
+    stderr = kwargs.get('stderr', subprocess.PIPE)
+    attempts = kwargs.get('attempts', 1)
+    cmd = map(str, cmd)
+
+    while attempts > 0:
+        attempts -= 1
+        try:
+            LOG.debug(_("Running cmd (subprocess): %s"), ' '.join(cmd))
+            env = os.environ.copy()
+            if addl_env:
+                env.update(addl_env)
+            obj = subprocess.Popen(cmd, stdin=stdin,
+                    stdout=stdout, stderr=stderr, env=env)
+            result = None
+            if process_input != None:
+                result = obj.communicate(process_input)
+            else:
+                result = obj.communicate()
+            obj.stdin.close()
+            if obj.returncode:
+                LOG.debug(_("Result was %s") % obj.returncode)
+                if type(check_exit_code) == types.IntType \
+                        and obj.returncode != check_exit_code:
+                    (stdout, stderr) = result
+                    raise ProcessExecutionError(exit_code=obj.returncode,
+                                                stdout=stdout,
+                                                stderr=stderr,
+                                                cmd=' '.join(cmd))
+            # NOTE(termie): this appears to be necessary to let the subprocess
+            #               call clean something up in between calls, without
+            #               it two execute calls in a row hangs the second one
+            greenthread.sleep(0)
+            return result
+        except ProcessExecutionError:
+            if not attempts:
+                raise
+            else:
+                LOG.debug(_("%r failed. Retrying."), cmd)
+                greenthread.sleep(random.randint(20, 200) / 100.0)
 
 
 def ssh_execute(ssh, cmd, process_input=None,
                 addl_env=None, check_exit_code=True):
-    LOG.debug(_("Running cmd (SSH): %s"), cmd)
+    LOG.debug(_("Running cmd (SSH): %s"), ' '.join(cmd))
     if addl_env:
         raise exception.Error("Environment not supported over SSH")
 
@@ -185,7 +210,7 @@ def ssh_execute(ssh, cmd, process_input=None,
             raise exception.ProcessExecutionError(exit_code=exit_status,
                                                   stdout=stdout,
                                                   stderr=stderr,
-                                                  cmd=cmd)
+                                                  cmd=' '.join(cmd))
 
     return (stdout, stderr)
 
@@ -218,9 +243,9 @@ def debug(arg):
     return arg
 
 
-def runthis(prompt, cmd, check_exit_code=True):
-    LOG.debug(_("Running %s"), (cmd))
-    rv, err = execute(cmd, check_exit_code=check_exit_code)
+def runthis(prompt, *cmd, **kwargs):
+    LOG.debug(_("Running %s"), (" ".join(cmd)))
+    rv, err = execute(*cmd, **kwargs)
 
 
 def generate_uid(topic, size=8):
@@ -252,7 +277,7 @@ def last_octet(address):
 
 def  get_my_linklocal(interface):
     try:
-        if_str = execute("ip -f inet6 -o addr show %s" % interface)
+        if_str = execute("ip", "-f", "inet6", "-o", "addr", "show", interface)
         condition = "\s+inet6\s+([0-9a-f:]+)/\d+\s+scope\s+link"
         links = [re.search(condition, x) for x in if_str[0].split('\n')]
         address = [w.group(1) for w in links if w is not None]
@@ -489,6 +514,18 @@ def loads(s):
     return json.loads(s)
 
 
+def synchronized(name):
+    def wrap(f):
+        @functools.wraps(f)
+        def inner(*args, **kwargs):
+            lock = lockfile.FileLock(os.path.join(FLAGS.lock_path,
+                                                  'nova-%s.lock' % name))
+            with lock:
+                return f(*args, **kwargs)
+        return inner
+    return wrap
+
+
 def ensure_b64_encoding(val):
     """Safety method to ensure that values expected to be base64-encoded
     actually are. If they are, the value is returned unchanged. Otherwise,
@@ -499,3 +536,52 @@ def ensure_b64_encoding(val):
         return val
     except TypeError:
         return base64.b64encode(val)
+
+
+def get_from_path(items, path):
+    """ Returns a list of items matching the specified path.  Takes an
+    XPath-like expression e.g. prop1/prop2/prop3, and for each item in items,
+    looks up items[prop1][prop2][prop3].  Like XPath, if any of the
+    intermediate results are lists it will treat each list item individually.
+    A 'None' in items or any child expressions will be ignored, this function
+    will not throw because of None (anywhere) in items.  The returned list
+    will contain no None values."""
+
+    if path is None:
+        raise exception.Error("Invalid mini_xpath")
+
+    (first_token, sep, remainder) = path.partition("/")
+
+    if first_token == "":
+        raise exception.Error("Invalid mini_xpath")
+
+    results = []
+
+    if items is None:
+        return results
+
+    if not isinstance(items, types.ListType):
+        # Wrap single objects in a list
+        items = [items]
+
+    for item in items:
+        if item is None:
+            continue
+        get_method = getattr(item, "get", None)
+        if get_method is None:
+            continue
+        child = get_method(first_token)
+        if child is None:
+            continue
+        if isinstance(child, types.ListType):
+            # Flatten intermediate lists
+            for x in child:
+                results.append(x)
+        else:
+            results.append(child)
+
+    if not sep:
+        # No more tokens
+        return results
+    else:
+        return get_from_path(results, remainder)
diff --git a/nova/virt/cpuinfo.xml.template b/nova/virt/cpuinfo.xml.template
new file mode 100644
index 000000000..48842b29d
--- /dev/null
+++ b/nova/virt/cpuinfo.xml.template
@@ -0,0 +1,9 @@
+<cpu>
+    <arch>$arch</arch>
+    <model>$model</model>
+    <vendor>$vendor</vendor>
+    <topology sockets="$topology.sockets" cores="$topology.cores" threads="$topology.threads"/>
+#for $var in $features
+    <features name="$var" />
+#end for
+</cpu>
diff --git a/nova/virt/disk.py b/nova/virt/disk.py
index c5565abfa..9abe44cc3 100644
--- a/nova/virt/disk.py
+++ b/nova/virt/disk.py
@@ -38,6 +38,10 @@ flags.DEFINE_integer('minimum_root_size', 1024 * 1024 * 1024 * 10,
                      'minimum size in bytes of root partition')
 flags.DEFINE_integer('block_size', 1024 * 1024 * 256,
                      'block_size to use for dd')
+flags.DEFINE_integer('timeout_nbd', 10,
+                     'time to wait for a NBD device coming up')
+flags.DEFINE_integer('max_nbd_devices', 16,
+                     'maximum number of possible nbd devices')
 
 
 def extend(image, size):
@@ -45,10 +49,10 @@ def extend(image, size):
     file_size = os.path.getsize(image)
     if file_size >= size:
         return
-    utils.execute('truncate -s %s %s' % (size, image))
+    utils.execute('truncate', '-s', size, image)
     # NOTE(vish): attempts to resize filesystem
-    utils.execute('e2fsck -fp %s' % image, check_exit_code=False)
-    utils.execute('resize2fs %s' % image, check_exit_code=False)
+    utils.execute('e2fsck', '-fp', image, check_exit_code=False)
+    utils.execute('resize2fs', image, check_exit_code=False)
 
 
 def inject_data(image, key=None, net=None, partition=None, nbd=False):
@@ -64,7 +68,7 @@ def inject_data(image, key=None, net=None, partition=None, nbd=False):
     try:
         if not partition is None:
             # create partition
-            out, err = utils.execute('sudo kpartx -a %s' % device)
+            out, err = utils.execute('sudo', 'kpartx', '-a', device)
             if err:
                 raise exception.Error(_('Failed to load partition: %s') % err)
             mapped_device = '/dev/mapper/%sp%s' % (device.split('/')[-1],
@@ -80,13 +84,14 @@ def inject_data(image, key=None, net=None, partition=None, nbd=False):
                                   mapped_device)
 
         # Configure ext2fs so that it doesn't auto-check every N boots
-        out, err = utils.execute('sudo tune2fs -c 0 -i 0 %s' % mapped_device)
+        out, err = utils.execute('sudo', 'tune2fs',
+                                 '-c', 0, '-i', 0, mapped_device)
 
         tmpdir = tempfile.mkdtemp()
         try:
             # mount loopback to dir
             out, err = utils.execute(
-                    'sudo mount %s %s' % (mapped_device, tmpdir))
+                    'sudo', 'mount', mapped_device, tmpdir)
             if err:
                 raise exception.Error(_('Failed to mount filesystem: %s')
                                       % err)
@@ -99,13 +104,13 @@ def inject_data(image, key=None, net=None, partition=None, nbd=False):
                     _inject_net_into_fs(net, tmpdir)
             finally:
                 # unmount device
-                utils.execute('sudo umount %s' % mapped_device)
+                utils.execute('sudo', 'umount', mapped_device)
         finally:
             # remove temporary directory
-            utils.execute('rmdir %s' % tmpdir)
+            utils.execute('rmdir', tmpdir)
             if not partition is None:
                 # remove partitions
-                utils.execute('sudo kpartx -d %s' % device)
+                utils.execute('sudo', 'kpartx', '-d', device)
     finally:
         _unlink_device(device, nbd)
 
@@ -114,16 +119,16 @@ def _link_device(image, nbd):
     """Link image to device using loopback or nbd"""
     if nbd:
         device = _allocate_device()
-        utils.execute('sudo qemu-nbd -c %s %s' % (device, image))
+        utils.execute('sudo', 'qemu-nbd', '-c', device, image)
         # NOTE(vish): this forks into another process, so give it a chance
         #             to set up before continuuing
-        for i in xrange(10):
+        for i in xrange(FLAGS.timeout_nbd):
             if os.path.exists("/sys/block/%s/pid" % os.path.basename(device)):
                 return device
             time.sleep(1)
         raise exception.Error(_('nbd device %s did not show up') % device)
     else:
-        out, err = utils.execute('sudo losetup --find --show %s' % image)
+        out, err = utils.execute('sudo', 'losetup', '--find', '--show', image)
         if err:
             raise exception.Error(_('Could not attach image to loopback: %s')
                                   % err)
@@ -133,13 +138,13 @@ def _link_device(image, nbd):
 def _unlink_device(device, nbd):
     """Unlink image from device using loopback or nbd"""
     if nbd:
-        utils.execute('sudo qemu-nbd -d %s' % device)
+        utils.execute('sudo', 'qemu-nbd', '-d', device)
         _free_device(device)
     else:
-        utils.execute('sudo losetup --detach %s' % device)
+        utils.execute('sudo', 'losetup', '--detach', device)
 
 
-_DEVICES = ['/dev/nbd%s' % i for i in xrange(16)]
+_DEVICES = ['/dev/nbd%s' % i for i in xrange(FLAGS.max_nbd_devices)]
 
 
 def _allocate_device():
@@ -166,11 +171,12 @@ def _inject_key_into_fs(key, fs):
     fs is the path to the base of the filesystem into which to inject the key.
     """
     sshdir = os.path.join(fs, 'root', '.ssh')
-    utils.execute('sudo mkdir -p %s' % sshdir)  # existing dir doesn't matter
-    utils.execute('sudo chown root %s' % sshdir)
-    utils.execute('sudo chmod 700 %s' % sshdir)
+    utils.execute('sudo', 'mkdir', '-p', sshdir)  # existing dir doesn't matter
+    utils.execute('sudo', 'chown', 'root', sshdir)
+    utils.execute('sudo', 'chmod', '700', sshdir)
     keyfile = os.path.join(sshdir, 'authorized_keys')
-    utils.execute('sudo tee -a %s' % keyfile, '\n' + key.strip() + '\n')
+    utils.execute('sudo', 'tee', '-a', keyfile,
+            process_input='\n' + key.strip() + '\n')
 
 
 def _inject_net_into_fs(net, fs):
@@ -179,8 +185,8 @@ def _inject_net_into_fs(net, fs):
     net is the contents of /etc/network/interfaces.
     """
     netdir = os.path.join(os.path.join(fs, 'etc'), 'network')
-    utils.execute('sudo mkdir -p %s' % netdir)  # existing dir doesn't matter
-    utils.execute('sudo chown root:root %s' % netdir)
-    utils.execute('sudo chmod 755 %s' % netdir)
+    utils.execute('sudo', 'mkdir', '-p', netdir)  # existing dir doesn't matter
+    utils.execute('sudo', 'chown', 'root:root', netdir)
+    utils.execute('sudo', 'chmod', 755, netdir)
     netfile = os.path.join(netdir, 'interfaces')
-    utils.execute('sudo tee %s' % netfile, net)
+    utils.execute('sudo', 'tee', netfile, process_input=net)
diff --git a/nova/virt/fake.py b/nova/virt/fake.py
index 92749f38a..3a06284a1 100644
--- a/nova/virt/fake.py
+++ b/nova/virt/fake.py
@@ -139,6 +139,24 @@ class FakeConnection(object):
         """
         pass
 
+    def get_host_ip_addr(self):
+        """
+        Retrieves the IP address of the dom0
+        """
+        pass
+
+    def resize(self, instance, flavor):
+        """
+        Resizes/Migrates the specified instance.
+
+        The flavor parameter determines whether or not the instance RAM and
+        disk space are modified, and if so, to what size.
+
+        The work will be done asynchronously. This function returns a task
+        that allows the caller to detect when it is complete.
+        """
+        pass
+
     def set_admin_password(self, instance, new_pass):
         """
         Set the root password on the specified instance.
@@ -179,6 +197,19 @@ class FakeConnection(object):
         """
         pass
 
+    def migrate_disk_and_power_off(self, instance, dest):
+        """
+        Transfers the disk of a running instance in multiple phases, turning
+        off the instance before the end.
+        """
+        pass
+
+    def attach_disk(self, instance, disk_info):
+        """
+        Attaches the disk to an instance given the metadata disk_info
+        """
+        pass
+
     def pause(self, instance, callback):
         """
         Pause the specified instance.
@@ -319,7 +350,9 @@ class FakeConnection(object):
         return 'FAKE CONSOLE OUTPUT'
 
     def get_ajax_console(self, instance):
-        return 'http://fakeajaxconsole.com/?token=FAKETOKEN'
+        return {'token': 'FAKETOKEN',
+                'host': 'fakeajaxconsole.com',
+                'port': 6969}
 
     def get_console_pool_info(self, console_type):
         return  {'address': '127.0.0.1',
@@ -374,6 +407,27 @@ class FakeConnection(object):
         """
         return True
 
+    def update_available_resource(self, ctxt, host):
+        """This method is supported only by libvirt."""
+        return
+
+    def compare_cpu(self, xml):
+        """This method is supported only by libvirt."""
+        raise NotImplementedError('This method is supported only by libvirt.')
+
+    def ensure_filtering_rules_for_instance(self, instance_ref):
+        """This method is supported only by libvirt."""
+        raise NotImplementedError('This method is supported only by libvirt.')
+
+    def live_migration(self, context, instance_ref, dest,
+                       post_method, recover_method):
+        """This method is supported only by libvirt."""
+        return
+
+    def unfilter_instance(self, instance_ref):
+        """This method is supported only by libvirt."""
+        raise NotImplementedError('This method is supported only by libvirt.')
+
 
 class FakeInstance(object):
 
diff --git a/nova/virt/images.py b/nova/virt/images.py
index 7a6fef330..2e3f2ee4d 100644
--- a/nova/virt/images.py
+++ b/nova/virt/images.py
@@ -28,29 +28,32 @@ import time
 import urllib2
 import urlparse
 
+from nova import context
 from nova import flags
 from nova import log as logging
 from nova import utils
 from nova.auth import manager
 from nova.auth import signer
-from nova.objectstore import image
 
 
 FLAGS = flags.FLAGS
-flags.DEFINE_bool('use_s3', True,
-                  'whether to get images from s3 or use local copy')
-
 LOG = logging.getLogger('nova.virt.images')
 
 
-def fetch(image, path, user, project):
-    if FLAGS.use_s3:
-        f = _fetch_s3_image
-    else:
-        f = _fetch_local_image
-    return f(image, path, user, project)
+def fetch(image_id, path, _user, _project):
+    # TODO(vish): Improve context handling and add owner and auth data
+    #             when it is added to glance.  Right now there is no
+    #             auth checking in glance, so we assume that access was
+    #             checked before we got here.
+    image_service = utils.import_object(FLAGS.image_service)
+    with open(path, "wb") as image_file:
+        elevated = context.get_admin_context()
+        metadata = image_service.get(elevated, image_id, image_file)
+    return metadata
 
 
+# NOTE(vish): The methods below should be unnecessary, but I'm leaving
+#             them in case the glance client does not work on windows.
 def _fetch_image_no_curl(url, path, headers):
     request = urllib2.Request(url)
     for (k, v) in headers.iteritems():
@@ -94,8 +97,7 @@ def _fetch_s3_image(image, path, user, project):
             cmd += ['-H', '\'%s: %s\'' % (k, v)]
 
         cmd += ['-o', path]
-        cmd_out = ' '.join(cmd)
-        return utils.execute(cmd_out)
+        return utils.execute(*cmd)
 
 
 def _fetch_local_image(image, path, user, project):
@@ -103,13 +105,15 @@ def _fetch_local_image(image, path, user, project):
     if sys.platform.startswith('win'):
         return shutil.copy(source, path)
     else:
-        return utils.execute('cp %s %s' % (source, path))
+        return utils.execute('cp', source, path)
 
 
 def _image_path(path):
     return os.path.join(FLAGS.images_path, path)
 
 
+# TODO(vish): xenapi should use the glance client code directly instead
+#             of retrieving the image using this method.
 def image_url(image):
     if FLAGS.image_service == "nova.image.glance.GlanceImageService":
         return "http://%s:%s/images/%s" % (FLAGS.glance_host,
diff --git a/nova/virt/libvirt_conn.py b/nova/virt/libvirt_conn.py
index 4e0fd106f..7994e9547 100644
--- a/nova/virt/libvirt_conn.py
+++ b/nova/virt/libvirt_conn.py
@@ -36,17 +36,19 @@ Supports KVM, QEMU, UML, and XEN.
 
 """
 
+import multiprocessing
 import os
 import shutil
+import sys
 import random
 import subprocess
+import time
 import uuid
 from xml.dom import minidom
 
 
-from eventlet import greenthread
-from eventlet import event
 from eventlet import tpool
+from eventlet import semaphore
 
 import IPy
 
@@ -55,8 +57,8 @@ from nova import db
 from nova import exception
 from nova import flags
 from nova import log as logging
+#from nova import test
 from nova import utils
-#from nova.api import context
 from nova.auth import manager
 from nova.compute import instance_types
 from nova.compute import power_state
@@ -70,6 +72,7 @@ Template = None
 LOG = logging.getLogger('nova.virt.libvirt_conn')
 
 FLAGS = flags.FLAGS
+flags.DECLARE('live_migration_retry_count', 'nova.compute.manager')
 # TODO(vish): These flags should probably go into a shared location
 flags.DEFINE_string('rescue_image_id', 'ami-rescue', 'Rescue ami image')
 flags.DEFINE_string('rescue_kernel_id', 'aki-rescue', 'Rescue aki image')
@@ -100,6 +103,17 @@ flags.DEFINE_string('ajaxterm_portrange',
 flags.DEFINE_string('firewall_driver',
                     'nova.virt.libvirt_conn.IptablesFirewallDriver',
                     'Firewall driver (defaults to iptables)')
+flags.DEFINE_string('cpuinfo_xml_template',
+                    utils.abspath('virt/cpuinfo.xml.template'),
+                    'CpuInfo XML Template (Used only live migration now)')
+flags.DEFINE_string('live_migration_uri',
+                    "qemu+tcp://%s/system",
+                    'Define protocol used by live_migration feature')
+flags.DEFINE_string('live_migration_flag',
+                    "VIR_MIGRATE_UNDEFINE_SOURCE, VIR_MIGRATE_PEER2PEER",
+                    'Define live migration behavior.')
+flags.DEFINE_integer('live_migration_bandwidth', 0,
+                    'Define live migration behavior')
 
 
 def get_connection(read_only):
@@ -146,6 +160,7 @@ class LibvirtConnection(object):
         self.libvirt_uri = self.get_uri()
 
         self.libvirt_xml = open(FLAGS.libvirt_xml_template).read()
+        self.cpuinfo_xml = open(FLAGS.cpuinfo_xml_template).read()
         self._wrapped_conn = None
         self.read_only = read_only
 
@@ -347,22 +362,22 @@ class LibvirtConnection(object):
 
     @exception.wrap_exception
     def pause(self, instance, callback):
-        raise exception.APIError("pause not supported for libvirt.")
+        raise exception.ApiError("pause not supported for libvirt.")
 
     @exception.wrap_exception
     def unpause(self, instance, callback):
-        raise exception.APIError("unpause not supported for libvirt.")
+        raise exception.ApiError("unpause not supported for libvirt.")
 
     @exception.wrap_exception
     def suspend(self, instance, callback):
-        raise exception.APIError("suspend not supported for libvirt")
+        raise exception.ApiError("suspend not supported for libvirt")
 
     @exception.wrap_exception
     def resume(self, instance, callback):
-        raise exception.APIError("resume not supported for libvirt")
+        raise exception.ApiError("resume not supported for libvirt")
 
     @exception.wrap_exception
-    def rescue(self, instance):
+    def rescue(self, instance, callback=None):
         self.destroy(instance, False)
 
         xml = self.to_xml(instance, rescue=True)
@@ -392,7 +407,7 @@ class LibvirtConnection(object):
         return timer.start(interval=0.5, now=True)
 
     @exception.wrap_exception
-    def unrescue(self, instance):
+    def unrescue(self, instance, callback=None):
         # NOTE(vish): Because reboot destroys and recreates an instance using
         #             the normal xml file, we can just call reboot here
         self.reboot(instance)
@@ -438,8 +453,10 @@ class LibvirtConnection(object):
 
         if virsh_output.startswith('/dev/'):
             LOG.info(_("cool, it's a device"))
-            out, err = utils.execute("sudo dd if=%s iflag=nonblock" %
-                                     virsh_output, check_exit_code=False)
+            out, err = utils.execute('sudo', 'dd',
+                                     "if=%s" % virsh_output,
+                                     'iflag=nonblock',
+                                     check_exit_code=False)
             return out
         else:
             return ''
@@ -461,11 +478,11 @@ class LibvirtConnection(object):
         console_log = os.path.join(FLAGS.instances_path, instance['name'],
                                    'console.log')
 
-        utils.execute('sudo chown %d %s' % (os.getuid(), console_log))
+        utils.execute('sudo', 'chown', os.getuid(), console_log)
 
         if FLAGS.libvirt_type == 'xen':
             # Xen is special
-            virsh_output = utils.execute("virsh ttyconsole %s" %
+            virsh_output = utils.execute('virsh', 'ttyconsole',
                                          instance['name'])
             data = self._flush_xen_console(virsh_output)
             fpath = self._append_to_file(data, console_log)
@@ -482,9 +499,10 @@ class LibvirtConnection(object):
                 port = random.randint(int(start_port), int(end_port))
                 # netcat will exit with 0 only if the port is in use,
                 # so a nonzero return value implies it is unused
-                cmd = 'netcat 0.0.0.0 %s -w 1 </dev/null || echo free' % (port)
-                stdout, stderr = utils.execute(cmd)
-                if stdout.strip() == 'free':
+                cmd = 'netcat', '0.0.0.0', port, '-w', '1'
+                try:
+                    stdout, stderr = utils.execute(*cmd, process_input='')
+                except ProcessExecutionError:
                     return port
             raise Exception(_('Unable to find an open port'))
 
@@ -511,7 +529,10 @@ class LibvirtConnection(object):
         subprocess.Popen(cmd, shell=True)
         return {'token': token, 'host': host, 'port': port}
 
-    def _cache_image(self, fn, target, fname, cow=False, *args, **kwargs):
+    _image_sems = {}
+
+    @staticmethod
+    def _cache_image(fn, target, fname, cow=False, *args, **kwargs):
         """Wrapper for a method that creates an image that caches the image.
 
         This wrapper will save the image into a common store and create a
@@ -530,14 +551,21 @@ class LibvirtConnection(object):
             if not os.path.exists(base_dir):
                 os.mkdir(base_dir)
             base = os.path.join(base_dir, fname)
-            if not os.path.exists(base):
-                fn(target=base, *args, **kwargs)
+
+            if fname not in LibvirtConnection._image_sems:
+                LibvirtConnection._image_sems[fname] = semaphore.Semaphore()
+            with LibvirtConnection._image_sems[fname]:
+                if not os.path.exists(base):
+                    fn(target=base, *args, **kwargs)
+            if not LibvirtConnection._image_sems[fname].locked():
+                del LibvirtConnection._image_sems[fname]
+
             if cow:
-                utils.execute('qemu-img create -f qcow2 -o '
-                              'cluster_size=2M,backing_file=%s %s'
-                              % (base, target))
+                utils.execute('qemu-img', 'create', '-f', 'qcow2', '-o',
+                              'cluster_size=2M,backing_file=%s' % base,
+                              target)
             else:
-                utils.execute('cp %s %s' % (base, target))
+                utils.execute('cp', base, target)
 
     def _fetch_image(self, target, image_id, user, project, size=None):
         """Grab image and optionally attempt to resize it"""
@@ -547,7 +575,7 @@ class LibvirtConnection(object):
 
     def _create_local(self, target, local_gb):
         """Create a blank image of specified size"""
-        utils.execute('truncate %s -s %dG' % (target, local_gb))
+        utils.execute('truncate', target, '-s', "%dG" % local_gb)
         # TODO(vish): should we format disk by default?
 
     def _create_image(self, inst, libvirt_xml, suffix='', disk_images=None):
@@ -558,7 +586,7 @@ class LibvirtConnection(object):
                                 fname + suffix)
 
         # ensure directories exist and are writable
-        utils.execute('mkdir -p %s' % basepath(suffix=''))
+        utils.execute('mkdir', '-p', basepath(suffix=''))
 
         LOG.info(_('instance %s: Creating image'), inst['name'])
         f = open(basepath('libvirt.xml'), 'w')
@@ -578,21 +606,23 @@ class LibvirtConnection(object):
                            'ramdisk_id': inst['ramdisk_id']}
 
         if disk_images['kernel_id']:
+            fname = '%08x' % int(disk_images['kernel_id'])
             self._cache_image(fn=self._fetch_image,
                               target=basepath('kernel'),
-                              fname=disk_images['kernel_id'],
+                              fname=fname,
                               image_id=disk_images['kernel_id'],
                               user=user,
                               project=project)
             if disk_images['ramdisk_id']:
+                fname = '%08x' % int(disk_images['ramdisk_id'])
                 self._cache_image(fn=self._fetch_image,
                                   target=basepath('ramdisk'),
-                                  fname=disk_images['ramdisk_id'],
+                                  fname=fname,
                                   image_id=disk_images['ramdisk_id'],
                                   user=user,
                                   project=project)
 
-        root_fname = disk_images['image_id']
+        root_fname = '%08x' % int(disk_images['image_id'])
         size = FLAGS.minimum_root_size
         if inst['instance_type'] == 'm1.tiny' or suffix == '.rescue':
             size = None
@@ -606,7 +636,7 @@ class LibvirtConnection(object):
                           user=user,
                           project=project,
                           size=size)
-        type_data = instance_types.INSTANCE_TYPES[inst['instance_type']]
+        type_data = instance_types.get_instance_type(inst['instance_type'])
 
         if type_data['local_gb']:
             self._cache_image(fn=self._create_local,
@@ -658,7 +688,7 @@ class LibvirtConnection(object):
                         ' data into image %(img_id)s (%(e)s)') % locals())
 
         if FLAGS.libvirt_type == 'uml':
-            utils.execute('sudo chown root %s' % basepath('disk'))
+            utils.execute('sudo', 'chown', 'root', basepath('disk'))
 
     def to_xml(self, instance, rescue=False):
         # TODO(termie): cache?
@@ -667,7 +697,8 @@ class LibvirtConnection(object):
                                              instance['id'])
         # FIXME(vish): stick this in db
         instance_type = instance['instance_type']
-        instance_type = instance_types.INSTANCE_TYPES[instance_type]
+        # instance_type = test.INSTANCE_TYPES[instance_type]
+        instance_type = instance_types.get_instance_type(instance_type)
         ip_address = db.instance_get_fixed_address(context.get_admin_context(),
                                                    instance['id'])
         # Assume that the gateway also acts as the dhcp server.
@@ -748,7 +779,7 @@ class LibvirtConnection(object):
                 'cpu_time': cpu_time}
 
     def get_diagnostics(self, instance_name):
-        raise exception.APIError(_("diagnostics are not supported "
+        raise exception.ApiError(_("diagnostics are not supported "
                                    "for libvirt"))
 
     def get_disks(self, instance_name):
@@ -835,6 +866,158 @@ class LibvirtConnection(object):
 
         return interfaces
 
+    def get_vcpu_total(self):
+        """Get vcpu number of physical computer.
+
+        :returns: the number of cpu core.
+
+        """
+
+        # On certain platforms, this will raise a NotImplementedError.
+        try:
+            return multiprocessing.cpu_count()
+        except NotImplementedError:
+            LOG.warn(_("Cannot get the number of cpu, because this "
+                       "function is not implemented for this platform. "
+                       "This error can be safely ignored for now."))
+            return 0
+
+    def get_memory_mb_total(self):
+        """Get the total memory size(MB) of physical computer.
+
+        :returns: the total amount of memory(MB).
+
+        """
+
+        if sys.platform.upper() != 'LINUX2':
+            return 0
+
+        meminfo = open('/proc/meminfo').read().split()
+        idx = meminfo.index('MemTotal:')
+        # transforming kb to mb.
+        return int(meminfo[idx + 1]) / 1024
+
+    def get_local_gb_total(self):
+        """Get the total hdd size(GB) of physical computer.
+
+        :returns:
+            The total amount of HDD(GB).
+            Note that this value shows a partition where
+            NOVA-INST-DIR/instances mounts.
+
+        """
+
+        hddinfo = os.statvfs(FLAGS.instances_path)
+        return hddinfo.f_frsize * hddinfo.f_blocks / 1024 / 1024 / 1024
+
+    def get_vcpu_used(self):
+        """ Get vcpu usage number of physical computer.
+
+        :returns: The total number of vcpu that currently used.
+
+        """
+
+        total = 0
+        for dom_id in self._conn.listDomainsID():
+            dom = self._conn.lookupByID(dom_id)
+            total += len(dom.vcpus()[1])
+        return total
+
+    def get_memory_mb_used(self):
+        """Get the free memory size(MB) of physical computer.
+
+        :returns: the total usage of memory(MB).
+
+        """
+
+        if sys.platform.upper() != 'LINUX2':
+            return 0
+
+        m = open('/proc/meminfo').read().split()
+        idx1 = m.index('MemFree:')
+        idx2 = m.index('Buffers:')
+        idx3 = m.index('Cached:')
+        avail = (int(m[idx1 + 1]) + int(m[idx2 + 1]) + int(m[idx3 + 1])) / 1024
+        return  self.get_memory_mb_total() - avail
+
+    def get_local_gb_used(self):
+        """Get the free hdd size(GB) of physical computer.
+
+        :returns:
+           The total usage of HDD(GB).
+           Note that this value shows a partition where
+           NOVA-INST-DIR/instances mounts.
+
+        """
+
+        hddinfo = os.statvfs(FLAGS.instances_path)
+        avail = hddinfo.f_frsize * hddinfo.f_bavail / 1024 / 1024 / 1024
+        return self.get_local_gb_total() - avail
+
+    def get_hypervisor_type(self):
+        """Get hypervisor type.
+
+        :returns: hypervisor type (ex. qemu)
+
+        """
+
+        return self._conn.getType()
+
+    def get_hypervisor_version(self):
+        """Get hypervisor version.
+
+        :returns: hypervisor version (ex. 12003)
+
+        """
+
+        return self._conn.getVersion()
+
+    def get_cpu_info(self):
+        """Get cpuinfo information.
+
+        Obtains cpu feature from virConnect.getCapabilities,
+        and returns as a json string.
+
+        :return: see above description
+
+        """
+
+        xml = self._conn.getCapabilities()
+        xml = libxml2.parseDoc(xml)
+        nodes = xml.xpathEval('//cpu')
+        if len(nodes) != 1:
+            raise exception.Invalid(_("Invalid xml. '<cpu>' must be 1,"
+                                      "but %d\n") % len(nodes)
+                                      + xml.serialize())
+
+        cpu_info = dict()
+        cpu_info['arch'] = xml.xpathEval('//cpu/arch')[0].getContent()
+        cpu_info['model'] = xml.xpathEval('//cpu/model')[0].getContent()
+        cpu_info['vendor'] = xml.xpathEval('//cpu/vendor')[0].getContent()
+
+        topology_node = xml.xpathEval('//cpu/topology')[0].get_properties()
+        topology = dict()
+        while topology_node != None:
+            name = topology_node.get_name()
+            topology[name] = topology_node.getContent()
+            topology_node = topology_node.get_next()
+
+        keys = ['cores', 'sockets', 'threads']
+        tkeys = topology.keys()
+        if list(set(tkeys)) != list(set(keys)):
+            ks = ', '.join(keys)
+            raise exception.Invalid(_("Invalid xml: topology(%(topology)s) "
+                                      "must have %(ks)s") % locals())
+
+        feature_nodes = xml.xpathEval('//cpu/feature')
+        features = list()
+        for nodes in feature_nodes:
+            features.append(nodes.get_properties().getContent())
+
+        cpu_info['topology'] = topology
+        cpu_info['features'] = features
+        return utils.dumps(cpu_info)
+
     def block_stats(self, instance_name, disk):
         """
         Note that this function takes an instance name, not an Instance, so
@@ -865,6 +1048,207 @@ class LibvirtConnection(object):
     def refresh_security_group_members(self, security_group_id):
         self.firewall_driver.refresh_security_group_members(security_group_id)
 
+    def update_available_resource(self, ctxt, host):
+        """Updates compute manager resource info on ComputeNode table.
+
+        This method is called when nova-coompute launches, and
+        whenever admin executes "nova-manage service update_resource".
+
+        :param ctxt: security context
+        :param host: hostname that compute manager is currently running
+
+        """
+
+        try:
+            service_ref = db.service_get_all_compute_by_host(ctxt, host)[0]
+        except exception.NotFound:
+            raise exception.Invalid(_("Cannot update compute manager "
+                                      "specific info, because no service "
+                                      "record was found."))
+
+        # Updating host information
+        dic = {'vcpus': self.get_vcpu_total(),
+               'memory_mb': self.get_memory_mb_total(),
+               'local_gb': self.get_local_gb_total(),
+               'vcpus_used': self.get_vcpu_used(),
+               'memory_mb_used': self.get_memory_mb_used(),
+               'local_gb_used': self.get_local_gb_used(),
+               'hypervisor_type': self.get_hypervisor_type(),
+               'hypervisor_version': self.get_hypervisor_version(),
+               'cpu_info': self.get_cpu_info()}
+
+        compute_node_ref = service_ref['compute_node']
+        if not compute_node_ref:
+            LOG.info(_('Compute_service record created for %s ') % host)
+            dic['service_id'] = service_ref['id']
+            db.compute_node_create(ctxt, dic)
+        else:
+            LOG.info(_('Compute_service record updated for %s ') % host)
+            db.compute_node_update(ctxt, compute_node_ref[0]['id'], dic)
+
+    def compare_cpu(self, cpu_info):
+        """Checks the host cpu is compatible to a cpu given by xml.
+
+        "xml" must be a part of libvirt.openReadonly().getCapabilities().
+        return values follows by virCPUCompareResult.
+        if 0 > return value, do live migration.
+        'http://libvirt.org/html/libvirt-libvirt.html#virCPUCompareResult'
+
+        :param cpu_info: json string that shows cpu feature(see get_cpu_info())
+        :returns:
+            None. if given cpu info is not compatible to this server,
+            raise exception.
+
+        """
+
+        LOG.info(_('Instance launched has CPU info:\n%s') % cpu_info)
+        dic = utils.loads(cpu_info)
+        xml = str(Template(self.cpuinfo_xml, searchList=dic))
+        LOG.info(_('to xml...\n:%s ' % xml))
+
+        u = "http://libvirt.org/html/libvirt-libvirt.html#virCPUCompareResult"
+        m = _("CPU doesn't have compatibility.\n\n%(ret)s\n\nRefer to %(u)s")
+        # unknown character exists in xml, then libvirt complains
+        try:
+            ret = self._conn.compareCPU(xml, 0)
+        except libvirt.libvirtError, e:
+            ret = e.message
+            LOG.error(m % locals())
+            raise
+
+        if ret <= 0:
+            raise exception.Invalid(m % locals())
+
+        return
+
+    def ensure_filtering_rules_for_instance(self, instance_ref):
+        """Setting up filtering rules and waiting for its completion.
+
+        To migrate an instance, filtering rules to hypervisors
+        and firewalls are inevitable on destination host.
+        ( Waiting only for filterling rules to hypervisor,
+        since filtering rules to firewall rules can be set faster).
+
+        Concretely, the below method must be called.
+        - setup_basic_filtering (for nova-basic, etc.)
+        - prepare_instance_filter(for nova-instance-instance-xxx, etc.)
+
+        to_xml may have to be called since it defines PROJNET, PROJMASK.
+        but libvirt migrates those value through migrateToURI(),
+        so , no need to be called.
+
+        Don't use thread for this method since migration should
+        not be started when setting-up filtering rules operations
+        are not completed.
+
+        :params instance_ref: nova.db.sqlalchemy.models.Instance object
+
+        """
+
+        # If any instances never launch at destination host,
+        # basic-filtering must be set here.
+        self.firewall_driver.setup_basic_filtering(instance_ref)
+        # setting up n)ova-instance-instance-xx mainly.
+        self.firewall_driver.prepare_instance_filter(instance_ref)
+
+        # wait for completion
+        timeout_count = range(FLAGS.live_migration_retry_count)
+        while timeout_count:
+            try:
+                filter_name = 'nova-instance-%s' % instance_ref.name
+                self._conn.nwfilterLookupByName(filter_name)
+                break
+            except libvirt.libvirtError:
+                timeout_count.pop()
+                if len(timeout_count) == 0:
+                    ec2_id = instance_ref['hostname']
+                    iname = instance_ref.name
+                    msg = _('Timeout migrating for %(ec2_id)s(%(iname)s)')
+                    raise exception.Error(msg % locals())
+                time.sleep(1)
+
+    def live_migration(self, ctxt, instance_ref, dest,
+                       post_method, recover_method):
+        """Spawning live_migration operation for distributing high-load.
+
+        :params ctxt: security context
+        :params instance_ref:
+            nova.db.sqlalchemy.models.Instance object
+            instance object that is migrated.
+        :params dest: destination host
+        :params post_method:
+            post operation method.
+            expected nova.compute.manager.post_live_migration.
+        :params recover_method:
+            recovery method when any exception occurs.
+            expected nova.compute.manager.recover_live_migration.
+
+        """
+
+        greenthread.spawn(self._live_migration, ctxt, instance_ref, dest,
+                          post_method, recover_method)
+
+    def _live_migration(self, ctxt, instance_ref, dest,
+                        post_method, recover_method):
+        """Do live migration.
+
+        :params ctxt: security context
+        :params instance_ref:
+            nova.db.sqlalchemy.models.Instance object
+            instance object that is migrated.
+        :params dest: destination host
+        :params post_method:
+            post operation method.
+            expected nova.compute.manager.post_live_migration.
+        :params recover_method:
+            recovery method when any exception occurs.
+            expected nova.compute.manager.recover_live_migration.
+
+        """
+
+        # Do live migration.
+        try:
+            flaglist = FLAGS.live_migration_flag.split(',')
+            flagvals = [getattr(libvirt, x.strip()) for x in flaglist]
+            logical_sum = reduce(lambda x, y: x | y, flagvals)
+
+            if self.read_only:
+                tmpconn = self._connect(self.libvirt_uri, False)
+                dom = tmpconn.lookupByName(instance_ref.name)
+                dom.migrateToURI(FLAGS.live_migration_uri % dest,
+                                 logical_sum,
+                                 None,
+                                 FLAGS.live_migration_bandwidth)
+                tmpconn.close()
+            else:
+                dom = self._conn.lookupByName(instance_ref.name)
+                dom.migrateToURI(FLAGS.live_migration_uri % dest,
+                                 logical_sum,
+                                 None,
+                                 FLAGS.live_migration_bandwidth)
+
+        except Exception:
+            recover_method(ctxt, instance_ref)
+            raise
+
+        # Waiting for completion of live_migration.
+        timer = utils.LoopingCall(f=None)
+
+        def wait_for_live_migration():
+            """waiting for live migration completion"""
+            try:
+                self.get_info(instance_ref.name)['state']
+            except exception.NotFound:
+                timer.stop()
+                post_method(ctxt, instance_ref, dest)
+
+        timer.f = wait_for_live_migration
+        timer.start(interval=0.5, now=True)
+
+    def unfilter_instance(self, instance_ref):
+        """See comments of same method in firewall_driver."""
+        self.firewall_driver.unfilter_instance(instance_ref)
+
 
 class FirewallDriver(object):
     def prepare_instance_filter(self, instance):
@@ -1206,10 +1590,14 @@ class NWFilterFirewall(FirewallDriver):
 
 class IptablesFirewallDriver(FirewallDriver):
     def __init__(self, execute=None, **kwargs):
-        self.execute = execute or utils.execute
+        from nova.network import linux_net
+        self.iptables = linux_net.iptables_manager
         self.instances = {}
         self.nwfilter = NWFilterFirewall(kwargs['get_connection'])
 
+        self.iptables.ipv4['filter'].add_chain('sg-fallback')
+        self.iptables.ipv4['filter'].add_rule('sg-fallback', '-j DROP')
+
     def setup_basic_filtering(self, instance):
         """Use NWFilter from libvirt for this."""
         return self.nwfilter.setup_basic_filtering(instance)
@@ -1218,126 +1606,96 @@ class IptablesFirewallDriver(FirewallDriver):
         """No-op. Everything is done in prepare_instance_filter"""
         pass
 
-    def remove_instance(self, instance):
-        if instance['id'] in self.instances:
-            del self.instances[instance['id']]
+    def unfilter_instance(self, instance):
+        if self.instances.pop(instance['id'], None):
+            self.remove_filters_for_instance(instance)
+            self.iptables.apply()
         else:
             LOG.info(_('Attempted to unfilter instance %s which is not '
-                       'filtered'), instance['id'])
+                     'filtered'), instance['id'])
 
-    def add_instance(self, instance):
+    def prepare_instance_filter(self, instance):
         self.instances[instance['id']] = instance
+        self.add_filters_for_instance(instance)
+        self.iptables.apply()
 
-    def unfilter_instance(self, instance):
-        self.remove_instance(instance)
-        self.apply_ruleset()
+    def add_filters_for_instance(self, instance):
+        chain_name = self._instance_chain_name(instance)
 
-    def prepare_instance_filter(self, instance):
-        self.add_instance(instance)
-        self.apply_ruleset()
-
-    def apply_ruleset(self):
-        current_filter, _ = self.execute('sudo iptables-save -t filter')
-        current_lines = current_filter.split('\n')
-        new_filter = self.modify_rules(current_lines, 4)
-        self.execute('sudo iptables-restore',
-                     process_input='\n'.join(new_filter))
-        if(FLAGS.use_ipv6):
-            current_filter, _ = self.execute('sudo ip6tables-save -t filter')
-            current_lines = current_filter.split('\n')
-            new_filter = self.modify_rules(current_lines, 6)
-            self.execute('sudo ip6tables-restore',
-                         process_input='\n'.join(new_filter))
+        self.iptables.ipv4['filter'].add_chain(chain_name)
+        ipv4_address = self._ip_for_instance(instance)
+        self.iptables.ipv4['filter'].add_rule('local',
+                                              '-d %s -j $%s' %
+                                              (ipv4_address, chain_name))
+
+        if FLAGS.use_ipv6:
+            self.iptables.ipv6['filter'].add_chain(chain_name)
+            ipv6_address = self._ip_for_instance_v6(instance)
+            self.iptables.ipv6['filter'].add_rule('local',
+                                                  '-d %s -j $%s' %
+                                                  (ipv6_address,
+                                                   chain_name))
 
-    def modify_rules(self, current_lines, ip_version=4):
+        ipv4_rules, ipv6_rules = self.instance_rules(instance)
+
+        for rule in ipv4_rules:
+            self.iptables.ipv4['filter'].add_rule(chain_name, rule)
+
+        if FLAGS.use_ipv6:
+            for rule in ipv6_rules:
+                self.iptables.ipv6['filter'].add_rule(chain_name, rule)
+
+    def remove_filters_for_instance(self, instance):
+        chain_name = self._instance_chain_name(instance)
+
+        self.iptables.ipv4['filter'].remove_chain(chain_name)
+        if FLAGS.use_ipv6:
+            self.iptables.ipv6['filter'].remove_chain(chain_name)
+
+    def instance_rules(self, instance):
         ctxt = context.get_admin_context()
-        # Remove any trace of nova rules.
-        new_filter = filter(lambda l: 'nova-' not in l, current_lines)
-
-        seen_chains = False
-        for rules_index in range(len(new_filter)):
-            if not seen_chains:
-                if new_filter[rules_index].startswith(':'):
-                    seen_chains = True
-            elif seen_chains == 1:
-                if not new_filter[rules_index].startswith(':'):
-                    break
 
-        our_chains = [':nova-fallback - [0:0]']
-        our_rules = ['-A nova-fallback -j DROP']
-
-        our_chains += [':nova-local - [0:0]']
-        our_rules += ['-A FORWARD -j nova-local']
-        our_rules += ['-A OUTPUT -j nova-local']
-
-        security_groups = {}
-        # Add our chains
-        # First, we add instance chains and rules
-        for instance_id in self.instances:
-            instance = self.instances[instance_id]
-            chain_name = self._instance_chain_name(instance)
-            if(ip_version == 4):
-                ip_address = self._ip_for_instance(instance)
-            elif(ip_version == 6):
-                ip_address = self._ip_for_instance_v6(instance)
-
-            our_chains += [':%s - [0:0]' % chain_name]
-
-            # Jump to the per-instance chain
-            our_rules += ['-A nova-local -d %s -j %s' % (ip_address,
-                                                         chain_name)]
-
-            # Always drop invalid packets
-            our_rules += ['-A %s -m state --state '
-                          'INVALID -j DROP' % (chain_name,)]
-
-            # Allow established connections
-            our_rules += ['-A %s -m state --state '
-                          'ESTABLISHED,RELATED -j ACCEPT' % (chain_name,)]
-
-            # Jump to each security group chain in turn
-            for security_group in \
-                            db.security_group_get_by_instance(ctxt,
-                                                              instance['id']):
-                security_groups[security_group['id']] = security_group
-
-                sg_chain_name = self._security_group_chain_name(
-                                                          security_group['id'])
+        ipv4_rules = []
+        ipv6_rules = []
 
-                our_rules += ['-A %s -j %s' % (chain_name, sg_chain_name)]
-
-            if(ip_version == 4):
-                # Allow DHCP responses
-                dhcp_server = self._dhcp_server_for_instance(instance)
-                our_rules += ['-A %s -s %s -p udp --sport 67 --dport 68 '
-                                    '-j ACCEPT ' % (chain_name, dhcp_server)]
-                #Allow project network traffic
-                if (FLAGS.allow_project_net_traffic):
-                    cidr = self._project_cidr_for_instance(instance)
-                    our_rules += ['-A %s -s %s -j ACCEPT' % (chain_name, cidr)]
-            elif(ip_version == 6):
-                # Allow RA responses
-                ra_server = self._ra_server_for_instance(instance)
-                if ra_server:
-                    our_rules += ['-A %s -s %s -p icmpv6 -j ACCEPT' %
-                                  (chain_name, ra_server + "/128")]
-                #Allow project network traffic
-                if (FLAGS.allow_project_net_traffic):
-                    cidrv6 = self._project_cidrv6_for_instance(instance)
-                    our_rules += ['-A %s -s %s -j ACCEPT' %
-                                        (chain_name, cidrv6)]
-
-            # If nothing matches, jump to the fallback chain
-            our_rules += ['-A %s -j nova-fallback' % (chain_name,)]
+        # Always drop invalid packets
+        ipv4_rules += ['-m state --state ' 'INVALID -j DROP']
+        ipv6_rules += ['-m state --state ' 'INVALID -j DROP']
 
-        # then, security group chains and rules
-        for security_group_id in security_groups:
-            chain_name = self._security_group_chain_name(security_group_id)
-            our_chains += [':%s - [0:0]' % chain_name]
+        # Allow established connections
+        ipv4_rules += ['-m state --state ESTABLISHED,RELATED -j ACCEPT']
+        ipv6_rules += ['-m state --state ESTABLISHED,RELATED -j ACCEPT']
+
+        dhcp_server = self._dhcp_server_for_instance(instance)
+        ipv4_rules += ['-s %s -p udp --sport 67 --dport 68 '
+                       '-j ACCEPT' % (dhcp_server,)]
+
+        #Allow project network traffic
+        if FLAGS.allow_project_net_traffic:
+            cidr = self._project_cidr_for_instance(instance)
+            ipv4_rules += ['-s %s -j ACCEPT' % (cidr,)]
+
+        # We wrap these in FLAGS.use_ipv6 because they might cause
+        # a DB lookup. The other ones are just list operations, so
+        # they're not worth the clutter.
+        if FLAGS.use_ipv6:
+            # Allow RA responses
+            ra_server = self._ra_server_for_instance(instance)
+            if ra_server:
+                ipv6_rules += ['-s %s/128 -p icmpv6 -j ACCEPT' % (ra_server,)]
+
+            #Allow project network traffic
+            if FLAGS.allow_project_net_traffic:
+                cidrv6 = self._project_cidrv6_for_instance(instance)
+                ipv6_rules += ['-s %s -j ACCEPT' % (cidrv6,)]
 
-            rules = \
-              db.security_group_rule_get_by_security_group(ctxt,
-                                                          security_group_id)
+        security_groups = db.security_group_get_by_instance(ctxt,
+                                                            instance['id'])
+
+        # then, security group chains and rules
+        for security_group in security_groups:
+            rules = db.security_group_rule_get_by_security_group(ctxt,
+                                                          security_group['id'])
 
             for rule in rules:
                 logging.info('%r', rule)
@@ -1348,14 +1706,16 @@ class IptablesFirewallDriver(FirewallDriver):
                     continue
 
                 version = _get_ip_version(rule.cidr)
-                if version != ip_version:
-                    continue
+                if version == 4:
+                    rules = ipv4_rules
+                else:
+                    rules = ipv6_rules
 
                 protocol = rule.protocol
                 if version == 6 and rule.protocol == 'icmp':
                     protocol = 'icmpv6'
 
-                args = ['-A', chain_name, '-p', protocol, '-s', rule.cidr]
+                args = ['-p', protocol, '-s', rule.cidr]
 
                 if rule.protocol in ['udp', 'tcp']:
                     if rule.from_port == rule.to_port:
@@ -1376,32 +1736,39 @@ class IptablesFirewallDriver(FirewallDriver):
                             icmp_type_arg += '/%s' % icmp_code
 
                     if icmp_type_arg:
-                        if(ip_version == 4):
+                        if version == 4:
                             args += ['-m', 'icmp', '--icmp-type',
                                      icmp_type_arg]
-                        elif(ip_version == 6):
+                        elif version == 6:
                             args += ['-m', 'icmp6', '--icmpv6-type',
                                      icmp_type_arg]
 
                 args += ['-j ACCEPT']
-                our_rules += [' '.join(args)]
+                rules += [' '.join(args)]
+
+        ipv4_rules += ['-j $sg-fallback']
+        ipv6_rules += ['-j $sg-fallback']
 
-        new_filter[rules_index:rules_index] = our_rules
-        new_filter[rules_index:rules_index] = our_chains
-        logging.info('new_filter: %s', '\n'.join(new_filter))
-        return new_filter
+        return ipv4_rules, ipv6_rules
 
     def refresh_security_group_members(self, security_group):
         pass
 
     def refresh_security_group_rules(self, security_group):
-        self.apply_ruleset()
+        # We use the semaphore to make sure noone applies the rule set
+        # after we've yanked the existing rules but before we've put in
+        # the new ones.
+        with self.iptables.semaphore:
+            for instance in self.instances.values():
+                self.remove_filters_for_instance(instance)
+                self.add_filters_for_instance(instance)
+        self.iptables.apply()
 
     def _security_group_chain_name(self, security_group_id):
         return 'nova-sg-%s' % (security_group_id,)
 
     def _instance_chain_name(self, instance):
-        return 'nova-inst-%s' % (instance['id'],)
+        return 'inst-%s' % (instance['id'],)
 
     def _ip_for_instance(self, instance):
         return db.instance_get_fixed_address(context.get_admin_context(),
diff --git a/nova/virt/xenapi/fake.py b/nova/virt/xenapi/fake.py
index 018d0dcd3..ba12d4d3a 100644
--- a/nova/virt/xenapi/fake.py
+++ b/nova/virt/xenapi/fake.py
@@ -290,6 +290,9 @@ class SessionBase(object):
         #Always return 12GB available
         return 12 * 1024 * 1024 * 1024
 
+    def host_call_plugin(*args):
+        return 'herp'
+
     def xenapi_request(self, methodname, params):
         if methodname.startswith('login'):
             self._login(methodname, params)
@@ -401,7 +404,7 @@ class SessionBase(object):
                 field in _db_content[cls][ref]):
                 return _db_content[cls][ref][field]
 
-        LOG.debuug(_('Raising NotImplemented'))
+        LOG.debug(_('Raising NotImplemented'))
         raise NotImplementedError(
             _('xenapi.fake does not have an implementation for %s or it has '
             'been called with the wrong number of arguments') % name)
diff --git a/nova/virt/xenapi/vm_utils.py b/nova/virt/xenapi/vm_utils.py
index 80cc3035d..f07b57796 100644
--- a/nova/virt/xenapi/vm_utils.py
+++ b/nova/virt/xenapi/vm_utils.py
@@ -24,6 +24,7 @@ import pickle
 import re
 import time
 import urllib
+import uuid
 from xml.dom import minidom
 
 from eventlet import event
@@ -40,9 +41,11 @@ from nova.virt.xenapi import HelperBase
 from nova.virt.xenapi.volume_utils import StorageError
 
 
-FLAGS = flags.FLAGS
 LOG = logging.getLogger("nova.virt.xenapi.vm_utils")
 
+FLAGS = flags.FLAGS
+flags.DEFINE_string('default_os_type', 'linux', 'Default OS type')
+
 XENAPI_POWER_STATE = {
     'Halted': power_state.SHUTDOWN,
     'Running': power_state.RUNNING,
@@ -63,11 +66,14 @@ class ImageType:
         0 - kernel/ramdisk image (goes on dom0's filesystem)
         1 - disk image (local SR, partitioned by objectstore plugin)
         2 - raw disk image (local SR, NOT partitioned by plugin)
+        3 - vhd disk image (local SR, NOT inspected by XS, PV assumed for
+            linux, HVM assumed for Windows)
     """
 
     KERNEL_RAMDISK = 0
     DISK = 1
     DISK_RAW = 2
+    DISK_VHD = 3
 
 
 class VMHelper(HelperBase):
@@ -76,62 +82,82 @@ class VMHelper(HelperBase):
     """
 
     @classmethod
-    def create_vm(cls, session, instance, kernel, ramdisk, pv_kernel=False):
+    def create_vm(cls, session, instance, kernel, ramdisk,
+                  use_pv_kernel=False):
         """Create a VM record.  Returns a Deferred that gives the new
         VM reference.
-        the pv_kernel flag indicates whether the guest is HVM or PV
+        the use_pv_kernel flag indicates whether the guest is HVM or PV
+
+        There are 3 scenarios:
+
+            1. Using paravirtualization,  kernel passed in
+
+            2. Using paravirtualization, kernel within the image
+
+            3. Using hardware virtualization
         """
 
-        instance_type = instance_types.INSTANCE_TYPES[instance.instance_type]
+        instance_type = instance_types.\
+                                get_instance_type(instance.instance_type)
         mem = str(long(instance_type['memory_mb']) * 1024 * 1024)
         vcpus = str(instance_type['vcpus'])
         rec = {
-            'name_label': instance.name,
-            'name_description': '',
+            'actions_after_crash': 'destroy',
+            'actions_after_reboot': 'restart',
+            'actions_after_shutdown': 'destroy',
+            'affinity': '',
+            'blocked_operations': {},
+            'ha_always_run': False,
+            'ha_restart_priority': '',
+            'HVM_boot_params': {},
+            'HVM_boot_policy': '',
             'is_a_template': False,
-            'memory_static_min': '0',
-            'memory_static_max': mem,
             'memory_dynamic_min': mem,
             'memory_dynamic_max': mem,
-            'VCPUs_at_startup': vcpus,
-            'VCPUs_max': vcpus,
-            'VCPUs_params': {},
-            'actions_after_shutdown': 'destroy',
-            'actions_after_reboot': 'restart',
-            'actions_after_crash': 'destroy',
-            'PV_bootloader': '',
-            'PV_kernel': '',
-            'PV_ramdisk': '',
+            'memory_static_min': '0',
+            'memory_static_max': mem,
+            'memory_target': mem,
+            'name_description': '',
+            'name_label': instance.name,
+            'other_config': {'allowvssprovider': False},
+            'other_config': {},
+            'PCI_bus': '',
+            'platform': {'acpi': 'true', 'apic': 'true', 'pae': 'true',
+                         'viridian': 'true', 'timeoffset': '0'},
             'PV_args': '',
+            'PV_bootloader': '',
             'PV_bootloader_args': '',
+            'PV_kernel': '',
             'PV_legacy_args': '',
-            'HVM_boot_policy': '',
-            'HVM_boot_params': {},
-            'platform': {},
-            'PCI_bus': '',
+            'PV_ramdisk': '',
             'recommendations': '',
-            'affinity': '',
+            'tags': [],
             'user_version': '0',
-            'other_config': {},
+            'VCPUs_at_startup': vcpus,
+            'VCPUs_max': vcpus,
+            'VCPUs_params': {},
+            'xenstore_data': {}
             }
-        #Complete VM configuration record according to the image type
-        #non-raw/raw with PV kernel/raw in HVM mode
-        if instance.kernel_id:
-            rec['PV_bootloader'] = ''
-            rec['PV_kernel'] = kernel
-            rec['PV_ramdisk'] = ramdisk
-            rec['PV_args'] = 'root=/dev/xvda1'
-            rec['PV_bootloader_args'] = ''
-            rec['PV_legacy_args'] = ''
-        else:
-            if pv_kernel:
-                rec['PV_args'] = 'noninteractive'
-                rec['PV_bootloader'] = 'pygrub'
+
+        # Complete VM configuration record according to the image type
+        # non-raw/raw with PV kernel/raw in HVM mode
+        if use_pv_kernel:
+            rec['platform']['nx'] = 'false'
+            if instance.kernel_id:
+                # 1. Kernel explicitly passed in, use that
+                rec['PV_args'] = 'root=/dev/xvda1'
+                rec['PV_kernel'] = kernel
+                rec['PV_ramdisk'] = ramdisk
             else:
-                rec['HVM_boot_policy'] = 'BIOS order'
-                rec['HVM_boot_params'] = {'order': 'dc'}
-                rec['platform'] = {'acpi': 'true', 'apic': 'true',
-                                   'pae': 'true', 'viridian': 'true'}
+                # 2. Use kernel within the image
+                rec['PV_args'] = 'clocksource=jiffies'
+                rec['PV_bootloader'] = 'pygrub'
+        else:
+            # 3. Using hardware virtualization
+            rec['platform']['nx'] = 'true'
+            rec['HVM_boot_params'] = {'order': 'dc'}
+            rec['HVM_boot_policy'] = 'BIOS order'
+
         LOG.debug(_('Created VM %s...'), instance.name)
         vm_ref = session.call_xenapi('VM.create', rec)
         instance_name = instance.name
@@ -140,7 +166,8 @@ class VMHelper(HelperBase):
 
     @classmethod
     def ensure_free_mem(cls, session, instance):
-        instance_type = instance_types.INSTANCE_TYPES[instance.instance_type]
+        instance_type = instance_types.get_instance_type(
+            instance.instance_type)
         mem = long(instance_type['memory_mb']) * 1024 * 1024
         #get free memory from host
         host = session.get_xenapi_host()
@@ -175,13 +202,13 @@ class VMHelper(HelperBase):
     @classmethod
     def find_vbd_by_number(cls, session, vm_ref, number):
         """Get the VBD reference from the device number"""
-        vbds = session.get_xenapi().VM.get_VBDs(vm_ref)
-        if vbds:
-            for vbd in vbds:
+        vbd_refs = session.get_xenapi().VM.get_VBDs(vm_ref)
+        if vbd_refs:
+            for vbd_ref in vbd_refs:
                 try:
-                    vbd_rec = session.get_xenapi().VBD.get_record(vbd)
+                    vbd_rec = session.get_xenapi().VBD.get_record(vbd_ref)
                     if vbd_rec['userdevice'] == str(number):
-                        return vbd
+                        return vbd_ref
                 except cls.XenAPI.Failure, exc:
                     LOG.exception(exc)
         raise StorageError(_('VBD not found in instance %s') % vm_ref)
@@ -201,19 +228,17 @@ class VMHelper(HelperBase):
         """Destroy VBD from host database"""
         try:
             task = session.call_xenapi('Async.VBD.destroy', vbd_ref)
-            #FIXME(armando): find a solution to missing instance_id
-            #with Josh Kearney
-            session.wait_for_task(0, task)
+            session.wait_for_task(task)
         except cls.XenAPI.Failure, exc:
             LOG.exception(exc)
             raise StorageError(_('Unable to destroy VBD %s') % vbd_ref)
 
     @classmethod
-    def create_vif(cls, session, vm_ref, network_ref, mac_address):
+    def create_vif(cls, session, vm_ref, network_ref, mac_address, dev="0"):
         """Create a VIF record.  Returns a Deferred that gives the new
         VIF reference."""
         vif_rec = {}
-        vif_rec['device'] = '0'
+        vif_rec['device'] = dev
         vif_rec['network'] = network_ref
         vif_rec['VM'] = vm_ref
         vif_rec['MAC'] = mac_address
@@ -249,24 +274,40 @@ class VMHelper(HelperBase):
         return vdi_ref
 
     @classmethod
+    def get_vdi_for_vm_safely(cls, session, vm_ref):
+        vdi_refs = VMHelper.lookup_vm_vdis(session, vm_ref)
+        if vdi_refs is None:
+            raise Exception(_("No VDIs found for VM %s") % vm_ref)
+        else:
+            num_vdis = len(vdi_refs)
+            if num_vdis != 1:
+                raise Exception(
+                        _("Unexpected number of VDIs (%(num_vdis)s) found"
+                        " for VM %(vm_ref)s") % locals())
+
+        vdi_ref = vdi_refs[0]
+        vdi_rec = session.get_xenapi().VDI.get_record(vdi_ref)
+        return vdi_ref, vdi_rec
+
+    @classmethod
     def create_snapshot(cls, session, instance_id, vm_ref, label):
-        """ Creates Snapshot (Template) VM, Snapshot VBD, Snapshot VDI,
-        Snapshot VHD
-        """
+        """Creates Snapshot (Template) VM, Snapshot VBD, Snapshot VDI,
+        Snapshot VHD"""
         #TODO(sirp): Add quiesce and VSS locking support when Windows support
         # is added
         LOG.debug(_("Snapshotting VM %(vm_ref)s with label '%(label)s'...")
                 % locals())
 
-        vm_vdi_ref, vm_vdi_rec = get_vdi_for_vm_safely(session, vm_ref)
+        vm_vdi_ref, vm_vdi_rec = cls.get_vdi_for_vm_safely(session, vm_ref)
         vm_vdi_uuid = vm_vdi_rec["uuid"]
         sr_ref = vm_vdi_rec["SR"]
 
         original_parent_uuid = get_vhd_parent_uuid(session, vm_vdi_ref)
 
         task = session.call_xenapi('Async.VM.snapshot', vm_ref, label)
-        template_vm_ref = session.wait_for_task(instance_id, task)
-        template_vdi_rec = get_vdi_for_vm_safely(session, template_vm_ref)[1]
+        template_vm_ref = session.wait_for_task(task, instance_id)
+        template_vdi_rec = cls.get_vdi_for_vm_safely(session,
+                template_vm_ref)[1]
         template_vdi_uuid = template_vdi_rec["uuid"]
 
         LOG.debug(_('Created snapshot %(template_vm_ref)s from'
@@ -276,29 +317,56 @@ class VMHelper(HelperBase):
             session, instance_id, sr_ref, vm_vdi_ref, original_parent_uuid)
 
         #TODO(sirp): we need to assert only one parent, not parents two deep
-        return template_vm_ref, [template_vdi_uuid, parent_uuid]
+        template_vdi_uuids = {'image': parent_uuid,
+                              'snap': template_vdi_uuid}
+        return template_vm_ref, template_vdi_uuids
+
+    @classmethod
+    def get_sr(cls, session, sr_label='slices'):
+        """Finds the SR named by the given name label and returns
+        the UUID"""
+        return session.call_xenapi('SR.get_by_name_label', sr_label)[0]
+
+    @classmethod
+    def get_sr_path(cls, session):
+        """Return the path to our storage repository
+
+        This is used when we're dealing with VHDs directly, either by taking
+        snapshots or by restoring an image in the DISK_VHD format.
+        """
+        sr_ref = safe_find_sr(session)
+        sr_rec = session.get_xenapi().SR.get_record(sr_ref)
+        sr_uuid = sr_rec["uuid"]
+        return os.path.join(FLAGS.xenapi_sr_base_path, sr_uuid)
 
     @classmethod
-    def upload_image(cls, session, instance_id, vdi_uuids, image_id):
+    def upload_image(cls, session, instance, vdi_uuids, image_id):
         """ Requests that the Glance plugin bundle the specified VDIs and
         push them into Glance using the specified human-friendly name.
         """
+        # NOTE(sirp): Currently we only support uploading images as VHD, there
+        # is no RAW equivalent (yet)
         logging.debug(_("Asking xapi to upload %(vdi_uuids)s as"
                 " ID %(image_id)s") % locals())
 
+        os_type = instance.os_type or FLAGS.default_os_type
+
         params = {'vdi_uuids': vdi_uuids,
                   'image_id': image_id,
                   'glance_host': FLAGS.glance_host,
-                  'glance_port': FLAGS.glance_port}
+                  'glance_port': FLAGS.glance_port,
+                  'sr_path': cls.get_sr_path(session),
+                  'os_type': os_type}
 
         kwargs = {'params': pickle.dumps(params)}
-        task = session.async_call_plugin('glance', 'put_vdis', kwargs)
-        session.wait_for_task(instance_id, task)
+        task = session.async_call_plugin('glance', 'upload_vhd', kwargs)
+        session.wait_for_task(task, instance.id)
 
     @classmethod
-    def fetch_image(cls, session, instance_id, image, user, project, type):
+    def fetch_image(cls, session, instance_id, image, user, project,
+                    image_type):
         """
-        type is interpreted as an ImageType instance
+        image_type is interpreted as an ImageType instance
         Related flags:
             xenapi_image_service = ['glance', 'objectstore']
             glance_address = 'address for glance services'
@@ -308,87 +376,220 @@ class VMHelper(HelperBase):
 
         if FLAGS.xenapi_image_service == 'glance':
             return cls._fetch_image_glance(session, instance_id, image,
-                                           access, type)
+                                           access, image_type)
         else:
             return cls._fetch_image_objectstore(session, instance_id, image,
-                                                access, user.secret, type)
+                                                access, user.secret,
+                                                image_type)
 
     @classmethod
-    def _fetch_image_glance(cls, session, instance_id, image, access, type):
-        sr = find_sr(session)
-        if sr is None:
-            raise exception.NotFound('Cannot find SR to write VDI to')
+    def _fetch_image_glance_vhd(cls, session, instance_id, image, access,
+                                image_type):
+        LOG.debug(_("Asking xapi to fetch vhd image %(image)s")
+                    % locals())
+
+        sr_ref = safe_find_sr(session)
+
+        # NOTE(sirp): The Glance plugin runs under Python 2.4 which does not
+        # have the `uuid` module. To work around this, we generate the uuids
+        # here (under Python 2.6+) and pass them as arguments
+        uuid_stack = [str(uuid.uuid4()) for i in xrange(2)]
+
+        params = {'image_id': image,
+                  'glance_host': FLAGS.glance_host,
+                  'glance_port': FLAGS.glance_port,
+                  'uuid_stack': uuid_stack,
+                  'sr_path': cls.get_sr_path(session)}
+
+        kwargs = {'params': pickle.dumps(params)}
+        task = session.async_call_plugin('glance', 'download_vhd', kwargs)
+        vdi_uuid = session.wait_for_task(task, instance_id)
 
-        c = glance.client.Client(FLAGS.glance_host, FLAGS.glance_port)
+        cls.scan_sr(session, instance_id, sr_ref)
+
+        # Set the name-label to ease debugging
+        vdi_ref = session.get_xenapi().VDI.get_by_uuid(vdi_uuid)
+        name_label = get_name_label_for_image(image)
+        session.get_xenapi().VDI.set_name_label(vdi_ref, name_label)
+
+        LOG.debug(_("xapi 'download_vhd' returned VDI UUID %(vdi_uuid)s")
+                  % locals())
+        return vdi_uuid
+
+    @classmethod
+    def _fetch_image_glance_disk(cls, session, instance_id, image, access,
+                                 image_type):
+        """Fetch the image from Glance
+
+        NOTE:
+        Unlike _fetch_image_glance_vhd, this method does not use the Glance
+        plugin; instead, it streams the disks through domU to the VDI
+        directly.
+
+        """
+        # FIXME(sirp): Since the Glance plugin seems to be required for the
+        # VHD disk, it may be worth using the plugin for both VHD and RAW and
+        # DISK restores
+        sr_ref = safe_find_sr(session)
 
-        meta, image_file = c.get_image(image)
+        client = glance.client.Client(FLAGS.glance_host, FLAGS.glance_port)
+        meta, image_file = client.get_image(image)
         virtual_size = int(meta['size'])
         vdi_size = virtual_size
         LOG.debug(_("Size for image %(image)s:%(virtual_size)d") % locals())
-        if type == ImageType.DISK:
+
+        if image_type == ImageType.DISK:
             # Make room for MBR.
             vdi_size += MBR_SIZE_BYTES
 
-        vdi = cls.create_vdi(session, sr, _('Glance image %s') % image,
-                             vdi_size, False)
+        name_label = get_name_label_for_image(image)
+        vdi_ref = cls.create_vdi(session, sr_ref, name_label, vdi_size, False)
 
-        with_vdi_attached_here(session, vdi, False,
+        with_vdi_attached_here(session, vdi_ref, False,
                                lambda dev:
-                               _stream_disk(dev, type,
+                               _stream_disk(dev, image_type,
                                             virtual_size, image_file))
-        if (type == ImageType.KERNEL_RAMDISK):
+        if image_type == ImageType.KERNEL_RAMDISK:
             #we need to invoke a plugin for copying VDI's
             #content into proper path
-            LOG.debug(_("Copying VDI %s to /boot/guest on dom0"), vdi)
+            LOG.debug(_("Copying VDI %s to /boot/guest on dom0"), vdi_ref)
             fn = "copy_kernel_vdi"
             args = {}
-            args['vdi-ref'] = vdi
+            args['vdi-ref'] = vdi_ref
             #let the plugin copy the correct number of bytes
             args['image-size'] = str(vdi_size)
             task = session.async_call_plugin('glance', fn, args)
-            filename = session.wait_for_task(instance_id, task)
+            filename = session.wait_for_task(task, instance_id)
             #remove the VDI as it is not needed anymore
-            session.get_xenapi().VDI.destroy(vdi)
-            LOG.debug(_("Kernel/Ramdisk VDI %s destroyed"), vdi)
+            session.get_xenapi().VDI.destroy(vdi_ref)
+            LOG.debug(_("Kernel/Ramdisk VDI %s destroyed"), vdi_ref)
             return filename
         else:
-            return session.get_xenapi().VDI.get_uuid(vdi)
+            return session.get_xenapi().VDI.get_uuid(vdi_ref)
+
+    @classmethod
+    def determine_disk_image_type(cls, instance):
+        """Disk Image Types are used to determine where the kernel will reside
+        within an image. To figure out which type we're dealing with, we use
+        the following rules:
+
+        1. If we're using Glance, we can use the image_type field to
+           determine the image_type
+
+        2. If we're not using Glance, then we need to deduce this based on
+           whether a kernel_id is specified.
+        """
+        def log_disk_format(image_type):
+            pretty_format = {ImageType.KERNEL_RAMDISK: 'KERNEL_RAMDISK',
+                             ImageType.DISK: 'DISK',
+                             ImageType.DISK_RAW: 'DISK_RAW',
+                             ImageType.DISK_VHD: 'DISK_VHD'}
+            disk_format = pretty_format[image_type]
+            image_id = instance.image_id
+            instance_id = instance.id
+            LOG.debug(_("Detected %(disk_format)s format for image "
+                        "%(image_id)s, instance %(instance_id)s") % locals())
+
+        def determine_from_glance():
+            glance_disk_format2nova_type = {
+                'ami': ImageType.DISK,
+                'aki': ImageType.KERNEL_RAMDISK,
+                'ari': ImageType.KERNEL_RAMDISK,
+                'raw': ImageType.DISK_RAW,
+                'vhd': ImageType.DISK_VHD}
+            client = glance.client.Client(FLAGS.glance_host, FLAGS.glance_port)
+            meta = client.get_image_meta(instance.image_id)
+            disk_format = meta['disk_format']
+            try:
+                return glance_disk_format2nova_type[disk_format]
+            except KeyError:
+                raise exception.NotFound(
+                    _("Unrecognized disk_format '%(disk_format)s'")
+                    % locals())
+
+        def determine_from_instance():
+            if instance.kernel_id:
+                return ImageType.DISK
+            else:
+                return ImageType.DISK_RAW
+
+        # FIXME(sirp): can we unify the ImageService and xenapi_image_service
+        # abstractions?
+        if FLAGS.xenapi_image_service == 'glance':
+            image_type = determine_from_glance()
+        else:
+            image_type = determine_from_instance()
+
+        log_disk_format(image_type)
+        return image_type
+
+    @classmethod
+    def _fetch_image_glance(cls, session, instance_id, image, access,
+                            image_type):
+        if image_type == ImageType.DISK_VHD:
+            return cls._fetch_image_glance_vhd(
+                session, instance_id, image, access, image_type)
+        else:
+            return cls._fetch_image_glance_disk(
+                session, instance_id, image, access, image_type)
 
     @classmethod
     def _fetch_image_objectstore(cls, session, instance_id, image, access,
-                                 secret, type):
+                                 secret, image_type):
         url = images.image_url(image)
         LOG.debug(_("Asking xapi to fetch %(url)s as %(access)s") % locals())
-        fn = (type != ImageType.KERNEL_RAMDISK) and 'get_vdi' or 'get_kernel'
+        if image_type == ImageType.KERNEL_RAMDISK:
+            fn = 'get_kernel'
+        else:
+            fn = 'get_vdi'
         args = {}
         args['src_url'] = url
         args['username'] = access
         args['password'] = secret
         args['add_partition'] = 'false'
         args['raw'] = 'false'
-        if type != ImageType.KERNEL_RAMDISK:
+        if image_type != ImageType.KERNEL_RAMDISK:
             args['add_partition'] = 'true'
-            if type == ImageType.DISK_RAW:
+            if image_type == ImageType.DISK_RAW:
                 args['raw'] = 'true'
         task = session.async_call_plugin('objectstore', fn, args)
-        uuid = session.wait_for_task(instance_id, task)
+        uuid = session.wait_for_task(task, instance_id)
         return uuid
 
     @classmethod
-    def lookup_image(cls, session, instance_id, vdi_ref):
+    def determine_is_pv(cls, session, instance_id, vdi_ref, disk_image_type,
+                        os_type):
+        """
+        Determine whether the VM will use a paravirtualized kernel or if it
+        will use hardware virtualization.
+
+            1. Objectstore (any image type):
+               We use plugin to figure out whether the VDI uses PV
+
+            2. Glance (VHD): then we use `os_type`, raise if not set
+
+            3. Glance (DISK_RAW): use Pygrub to figure out if pv kernel is
+               available
+
+            4. Glance (DISK): pv is assumed
+        """
         if FLAGS.xenapi_image_service == 'glance':
-            return cls._lookup_image_glance(session, vdi_ref)
+            # 2, 3, 4: Glance
+            return cls._determine_is_pv_glance(
+              session, vdi_ref, disk_image_type, os_type)
         else:
-            return cls._lookup_image_objectstore(session, instance_id, vdi_ref)
+            # 1. Objecstore
+            return cls._determine_is_pv_objectstore(session, instance_id,
+                                                    vdi_ref)
 
     @classmethod
-    def _lookup_image_objectstore(cls, session, instance_id, vdi_ref):
+    def _determine_is_pv_objectstore(cls, session, instance_id, vdi_ref):
         LOG.debug(_("Looking up vdi %s for PV kernel"), vdi_ref)
         fn = "is_vdi_pv"
         args = {}
         args['vdi-ref'] = vdi_ref
         task = session.async_call_plugin('objectstore', fn, args)
-        pv_str = session.wait_for_task(instance_id, task)
+        pv_str = session.wait_for_task(task, instance_id)
         pv = None
         if pv_str.lower() == 'true':
             pv = True
@@ -398,54 +599,72 @@ class VMHelper(HelperBase):
         return pv
 
     @classmethod
-    def _lookup_image_glance(cls, session, vdi_ref):
+    def _determine_is_pv_glance(cls, session, vdi_ref, disk_image_type,
+                                os_type):
+        """
+        For a Glance image, determine if we need paravirtualization.
+
+        The relevant scenarios are:
+            2. Glance (VHD): then we use `os_type`, raise if not set
+
+            3. Glance (DISK_RAW): use Pygrub to figure out if pv kernel is
+               available
+
+            4. Glance (DISK): pv is assumed
+        """
+
         LOG.debug(_("Looking up vdi %s for PV kernel"), vdi_ref)
+        if disk_image_type == ImageType.DISK_VHD:
+            # 2. VHD
+            if os_type == 'windows':
+                is_pv = False
+            else:
+                is_pv = True
+        elif disk_image_type == ImageType.DISK_RAW:
+            # 3. RAW
+            is_pv = with_vdi_attached_here(session, vdi_ref, True, _is_vdi_pv)
+        elif disk_image_type == ImageType.DISK:
+            # 4. Disk
+            is_pv = True
+        else:
+            raise exception.Error(_("Unknown image format %(disk_image_type)s")
+                                  % locals())
 
-        def is_vdi_pv(dev):
-            LOG.debug(_("Running pygrub against %s"), dev)
-            output = os.popen('pygrub -qn /dev/%s' % dev)
-            for line in output.readlines():
-                #try to find kernel string
-                m = re.search('(?<=kernel:)/.*(?:>)', line)
-                if m and m.group(0).find('xen') != -1:
-                    LOG.debug(_("Found Xen kernel %s") % m.group(0))
-                    return True
-            LOG.debug(_("No Xen kernel found.  Booting HVM."))
-            return False
-        return with_vdi_attached_here(session, vdi_ref, True, is_vdi_pv)
+        return is_pv
 
     @classmethod
-    def lookup(cls, session, i):
+    def lookup(cls, session, name_label):
         """Look the instance i up, and returns it if available"""
-        vms = session.get_xenapi().VM.get_by_name_label(i)
-        n = len(vms)
+        vm_refs = session.get_xenapi().VM.get_by_name_label(name_label)
+        n = len(vm_refs)
         if n == 0:
             return None
         elif n > 1:
-            raise exception.Duplicate(_('duplicate name found: %s') % i)
+            raise exception.Duplicate(_('duplicate name found: %s') %
+                                        name_label)
         else:
-            return vms[0]
+            return vm_refs[0]
 
     @classmethod
-    def lookup_vm_vdis(cls, session, vm):
+    def lookup_vm_vdis(cls, session, vm_ref):
         """Look for the VDIs that are attached to the VM"""
         # Firstly we get the VBDs, then the VDIs.
         # TODO(Armando): do we leave the read-only devices?
-        vbds = session.get_xenapi().VM.get_VBDs(vm)
-        vdis = []
-        if vbds:
-            for vbd in vbds:
+        vbd_refs = session.get_xenapi().VM.get_VBDs(vm_ref)
+        vdi_refs = []
+        if vbd_refs:
+            for vbd_ref in vbd_refs:
                 try:
-                    vdi = session.get_xenapi().VBD.get_VDI(vbd)
+                    vdi_ref = session.get_xenapi().VBD.get_VDI(vbd_ref)
                     # Test valid VDI
-                    record = session.get_xenapi().VDI.get_record(vdi)
+                    record = session.get_xenapi().VDI.get_record(vdi_ref)
                     LOG.debug(_('VDI %s is still available'), record['uuid'])
                 except cls.XenAPI.Failure, exc:
                     LOG.exception(exc)
                 else:
-                    vdis.append(vdi)
-            if len(vdis) > 0:
-                return vdis
+                    vdi_refs.append(vdi_ref)
+            if len(vdi_refs) > 0:
+                return vdi_refs
             else:
                 return None
 
@@ -496,6 +715,21 @@ class VMHelper(HelperBase):
         except cls.XenAPI.Failure as e:
             return {"Unable to retrieve diagnostics": e}
 
+    @classmethod
+    def scan_sr(cls, session, instance_id=None, sr_ref=None):
+        """Scans the SR specified by sr_ref"""
+        if sr_ref:
+            LOG.debug(_("Re-scanning SR %s"), sr_ref)
+            task = session.call_xenapi('Async.SR.scan', sr_ref)
+            session.wait_for_task(task, instance_id)
+
+    @classmethod
+    def scan_default_sr(cls, session):
+        """Looks for the system default SR and triggers a re-scan"""
+        #FIXME(sirp/mdietz): refactor scan_default_sr in there
+        sr_ref = cls.get_sr(session)
+        session.call_xenapi('SR.scan', sr_ref)
+
 
 def get_rrd(host, uuid):
     """Return the VM RRD XML as a string"""
@@ -538,12 +772,6 @@ def get_vhd_parent_uuid(session, vdi_ref):
         return None
 
 
-def scan_sr(session, instance_id, sr_ref):
-    LOG.debug(_("Re-scanning SR %s"), sr_ref)
-    task = session.call_xenapi('Async.SR.scan', sr_ref)
-    session.wait_for_task(instance_id, task)
-
-
 def wait_for_vhd_coalesce(session, instance_id, sr_ref, vdi_ref,
                           original_parent_uuid):
     """ Spin until the parent VHD is coalesced into its parent VHD
@@ -568,7 +796,7 @@ def wait_for_vhd_coalesce(session, instance_id, sr_ref, vdi_ref,
                     " %(max_attempts)d), giving up...") % locals())
             raise exception.Error(msg)
 
-        scan_sr(session, instance_id, sr_ref)
+        VMHelper.scan_sr(session, instance_id, sr_ref)
         parent_uuid = get_vhd_parent_uuid(session, vdi_ref)
         if original_parent_uuid and (parent_uuid != original_parent_uuid):
             LOG.debug(_("Parent %(parent_uuid)s doesn't match original parent"
@@ -599,18 +827,29 @@ def get_vdi_for_vm_safely(session, vm_ref):
     return vdi_ref, vdi_rec
 
 
+def safe_find_sr(session):
+    """Same as find_sr except raises a NotFound exception if SR cannot be
+    determined
+    """
+    sr_ref = find_sr(session)
+    if sr_ref is None:
+        raise exception.NotFound(_('Cannot find SR to read/write VDI'))
+    return sr_ref
+
+
 def find_sr(session):
+    """Return the storage repository to hold VM images"""
     host = session.get_xenapi_host()
-    srs = session.get_xenapi().SR.get_all()
-    for sr in srs:
-        sr_rec = session.get_xenapi().SR.get_record(sr)
+    sr_refs = session.get_xenapi().SR.get_all()
+    for sr_ref in sr_refs:
+        sr_rec = session.get_xenapi().SR.get_record(sr_ref)
         if not ('i18n-key' in sr_rec['other_config'] and
                 sr_rec['other_config']['i18n-key'] == 'local-storage'):
             continue
-        for pbd in sr_rec['PBDs']:
-            pbd_rec = session.get_xenapi().PBD.get_record(pbd)
+        for pbd_ref in sr_rec['PBDs']:
+            pbd_rec = session.get_xenapi().PBD.get_record(pbd_ref)
             if pbd_rec['host'] == host:
-                return sr
+                return sr_ref
     return None
 
 
@@ -635,11 +874,11 @@ def remap_vbd_dev(dev):
     return remapped_dev
 
 
-def with_vdi_attached_here(session, vdi, read_only, f):
+def with_vdi_attached_here(session, vdi_ref, read_only, f):
     this_vm_ref = get_this_vm_ref(session)
     vbd_rec = {}
     vbd_rec['VM'] = this_vm_ref
-    vbd_rec['VDI'] = vdi
+    vbd_rec['VDI'] = vdi_ref
     vbd_rec['userdevice'] = 'autodetect'
     vbd_rec['bootable'] = False
     vbd_rec['mode'] = read_only and 'RO' or 'RW'
@@ -650,28 +889,28 @@ def with_vdi_attached_here(session, vdi, read_only, f):
     vbd_rec['qos_algorithm_type'] = ''
     vbd_rec['qos_algorithm_params'] = {}
     vbd_rec['qos_supported_algorithms'] = []
-    LOG.debug(_('Creating VBD for VDI %s ... '), vdi)
-    vbd = session.get_xenapi().VBD.create(vbd_rec)
-    LOG.debug(_('Creating VBD for VDI %s done.'), vdi)
+    LOG.debug(_('Creating VBD for VDI %s ... '), vdi_ref)
+    vbd_ref = session.get_xenapi().VBD.create(vbd_rec)
+    LOG.debug(_('Creating VBD for VDI %s done.'), vdi_ref)
     try:
-        LOG.debug(_('Plugging VBD %s ... '), vbd)
-        session.get_xenapi().VBD.plug(vbd)
-        LOG.debug(_('Plugging VBD %s done.'), vbd)
-        orig_dev = session.get_xenapi().VBD.get_device(vbd)
-        LOG.debug(_('VBD %(vbd)s plugged as %(orig_dev)s') % locals())
+        LOG.debug(_('Plugging VBD %s ... '), vbd_ref)
+        session.get_xenapi().VBD.plug(vbd_ref)
+        LOG.debug(_('Plugging VBD %s done.'), vbd_ref)
+        orig_dev = session.get_xenapi().VBD.get_device(vbd_ref)
+        LOG.debug(_('VBD %(vbd_ref)s plugged as %(orig_dev)s') % locals())
         dev = remap_vbd_dev(orig_dev)
         if dev != orig_dev:
-            LOG.debug(_('VBD %(vbd)s plugged into wrong dev, '
+            LOG.debug(_('VBD %(vbd_ref)s plugged into wrong dev, '
                         'remapping to %(dev)s') % locals())
         return f(dev)
     finally:
-        LOG.debug(_('Destroying VBD for VDI %s ... '), vdi)
-        vbd_unplug_with_retry(session, vbd)
-        ignore_failure(session.get_xenapi().VBD.destroy, vbd)
-        LOG.debug(_('Destroying VBD for VDI %s done.'), vdi)
+        LOG.debug(_('Destroying VBD for VDI %s ... '), vdi_ref)
+        vbd_unplug_with_retry(session, vbd_ref)
+        ignore_failure(session.get_xenapi().VBD.destroy, vbd_ref)
+        LOG.debug(_('Destroying VBD for VDI %s done.'), vdi_ref)
 
 
-def vbd_unplug_with_retry(session, vbd):
+def vbd_unplug_with_retry(session, vbd_ref):
     """Call VBD.unplug on the given VBD, with a retry if we get
     DEVICE_DETACH_REJECTED.  For reasons which I don't understand, we're
     seeing the device still in use, even when all processes using the device
@@ -679,7 +918,7 @@ def vbd_unplug_with_retry(session, vbd):
     # FIXME(sirp): We can use LoopingCall here w/o blocking sleep()
     while True:
         try:
-            session.get_xenapi().VBD.unplug(vbd)
+            session.get_xenapi().VBD.unplug(vbd_ref)
             LOG.debug(_('VBD.unplug successful first time.'))
             return
         except VMHelper.XenAPI.Failure, e:
@@ -714,9 +953,22 @@ def get_this_vm_ref(session):
     return session.get_xenapi().VM.get_by_uuid(get_this_vm_uuid())
 
 
-def _stream_disk(dev, type, virtual_size, image_file):
+def _is_vdi_pv(dev):
+    LOG.debug(_("Running pygrub against %s"), dev)
+    output = os.popen('pygrub -qn /dev/%s' % dev)
+    for line in output.readlines():
+        #try to find kernel string
+        m = re.search('(?<=kernel:)/.*(?:>)', line)
+        if m and m.group(0).find('xen') != -1:
+            LOG.debug(_("Found Xen kernel %s") % m.group(0))
+            return True
+    LOG.debug(_("No Xen kernel found.  Booting HVM."))
+    return False
+
+
+def _stream_disk(dev, image_type, virtual_size, image_file):
     offset = 0
-    if type == ImageType.DISK:
+    if image_type == ImageType.DISK:
         offset = MBR_SIZE_BYTES
         _write_partition(virtual_size, dev)
 
@@ -735,13 +987,17 @@ def _write_partition(virtual_size, dev):
     LOG.debug(_('Writing partition table %(primary_first)d %(primary_last)d'
             ' to %(dest)s...') % locals())
 
-    def execute(cmd, process_input=None, check_exit_code=True):
-        return utils.execute(cmd=cmd,
-                             process_input=process_input,
-                             check_exit_code=check_exit_code)
+    def execute(*cmd, **kwargs):
+        return utils.execute(*cmd, **kwargs)
 
-    execute('parted --script %s mklabel msdos' % dest)
-    execute('parted --script %s mkpart primary %ds %ds' %
-            (dest, primary_first, primary_last))
+    execute('parted', '--script', dest, 'mklabel', 'msdos')
+    execute('parted', '--script', dest, 'mkpart', 'primary',
+            '%ds' % primary_first,
+            '%ds' % primary_last)
 
     LOG.debug(_('Writing partition table %s done.'), dest)
+
+
+def get_name_label_for_image(image):
+    # TODO(sirp): This should eventually be the URI for the Glance image
+    return _('Glance image %s') % image
diff --git a/nova/virt/xenapi/vmops.py b/nova/virt/xenapi/vmops.py
index 0168681f6..fcb290d03 100644
--- a/nova/virt/xenapi/vmops.py
+++ b/nova/virt/xenapi/vmops.py
@@ -22,6 +22,7 @@ Management class for VM-related functions (spawn, reboot, etc).
 import json
 import M2Crypto
 import os
+import pickle
 import subprocess
 import tempfile
 import uuid
@@ -49,107 +50,91 @@ class VMOps(object):
     def __init__(self, session):
         self.XenAPI = session.get_imported_xenapi()
         self._session = session
+
         VMHelper.XenAPI = self.XenAPI
 
     def list_instances(self):
         """List VM instances"""
-        vms = []
-        for vm in self._session.get_xenapi().VM.get_all():
-            rec = self._session.get_xenapi().VM.get_record(vm)
-            if not rec["is_a_template"] and not rec["is_control_domain"]:
-                vms.append(rec["name_label"])
-        return vms
+        vm_refs = []
+        for vm_ref in self._session.get_xenapi().VM.get_all():
+            vm_rec = self._session.get_xenapi().VM.get_record(vm_ref)
+            if not vm_rec["is_a_template"] and not vm_rec["is_control_domain"]:
+                vm_refs.append(vm_rec["name_label"])
+        return vm_refs
+
+    def _start(self, instance, vm_ref=None):
+        """Power on a VM instance"""
+        if not vm_ref:
+            vm_ref = VMHelper.lookup(self._session, instance.name)
+        if vm_ref is None:
+            raise exception(_('Attempted to power on non-existent instance'
+            ' bad instance id %s') % instance.id)
+        LOG.debug(_("Starting instance %s"), instance.name)
+        self._session.call_xenapi('VM.start', vm_ref, False, False)
+
+    def create_disk(self, instance):
+        user = AuthManager().get_user(instance.user_id)
+        project = AuthManager().get_project(instance.project_id)
+        disk_image_type = VMHelper.determine_disk_image_type(instance)
+        vdi_uuid = VMHelper.fetch_image(self._session, instance.id,
+                instance.image_id, user, project, disk_image_type)
+        return vdi_uuid
 
     def spawn(self, instance):
+        vdi_uuid = self.create_disk(instance)
+        self._spawn_with_disk(instance, vdi_uuid=vdi_uuid)
+
+    def _spawn_with_disk(self, instance, vdi_uuid):
         """Create VM instance"""
-        vm = VMHelper.lookup(self._session, instance.name)
-        if vm is not None:
+        instance_name = instance.name
+        vm_ref = VMHelper.lookup(self._session, instance_name)
+        if vm_ref is not None:
             raise exception.Duplicate(_('Attempted to create'
-            ' non-unique name %s') % instance.name)
+                    ' non-unique name %s') % instance_name)
 
         #ensure enough free memory is available
         if not VMHelper.ensure_free_mem(self._session, instance):
-                name = instance['name']
-                LOG.exception(_('instance %(name)s: not enough free memory')
-                              % locals())
-                db.instance_set_state(context.get_admin_context(),
-                                      instance['id'],
-                                      power_state.SHUTDOWN)
-                return
+            LOG.exception(_('instance %(instance_name)s: not enough free '
+                          'memory') % locals())
+            db.instance_set_state(context.get_admin_context(),
+                                  instance['id'],
+                                  power_state.SHUTDOWN)
+            return
 
         user = AuthManager().get_user(instance.user_id)
         project = AuthManager().get_project(instance.project_id)
 
-        #if kernel is not present we must download a raw disk
-        if instance.kernel_id:
-            disk_image_type = ImageType.DISK
-        else:
-            disk_image_type = ImageType.DISK_RAW
-        vdi_uuid = VMHelper.fetch_image(self._session, instance.id,
-            instance.image_id, user, project, disk_image_type)
+        # Are we building from a pre-existing disk?
         vdi_ref = self._session.call_xenapi('VDI.get_by_uuid', vdi_uuid)
-        #Have a look at the VDI and see if it has a PV kernel
-        pv_kernel = False
-        if not instance.kernel_id:
-            pv_kernel = VMHelper.lookup_image(self._session, instance.id,
-                                              vdi_ref)
+
+        disk_image_type = VMHelper.determine_disk_image_type(instance)
+
         kernel = None
         if instance.kernel_id:
             kernel = VMHelper.fetch_image(self._session, instance.id,
                 instance.kernel_id, user, project, ImageType.KERNEL_RAMDISK)
+
         ramdisk = None
         if instance.ramdisk_id:
             ramdisk = VMHelper.fetch_image(self._session, instance.id,
                 instance.ramdisk_id, user, project, ImageType.KERNEL_RAMDISK)
-        vm_ref = VMHelper.create_vm(self._session,
-                                          instance, kernel, ramdisk, pv_kernel)
-        VMHelper.create_vbd(self._session, vm_ref, vdi_ref, 0, True)
 
-        # write network info
-        admin_context = context.get_admin_context()
-
-        # TODO(tr3buchet) - remove comment in multi-nic
-        # I've decided to go ahead and consider multiple IPs and networks
-        # at this stage even though they aren't implemented because these will
-        # be needed for multi-nic and there was no sense writing it for single
-        # network/single IP and then having to turn around and re-write it
-        IPs = db.fixed_ip_get_all_by_instance(admin_context, instance['id'])
-        for network in db.network_get_all_by_instance(admin_context,
-                                                      instance['id']):
-            network_IPs = [ip for ip in IPs if ip.network_id == network.id]
+        use_pv_kernel = VMHelper.determine_is_pv(self._session, instance.id,
+            vdi_ref, disk_image_type, instance.os_type)
+        vm_ref = VMHelper.create_vm(self._session, instance, kernel, ramdisk,
+                                    use_pv_kernel)
 
-            def ip_dict(ip):
-                return {'netmask': network['netmask'],
-                        'enabled': '1',
-                        'ip': ip.address}
-
-            mac_id = instance.mac_address.replace(':', '')
-            location = 'vm-data/networking/%s' % mac_id
-            mapping = {'label': network['label'],
-                       'gateway': network['gateway'],
-                       'mac': instance.mac_address,
-                       'dns': [network['dns']],
-                       'ips': [ip_dict(ip) for ip in network_IPs]}
-            self.write_to_param_xenstore(vm_ref, {location: mapping})
-
-            # TODO(tr3buchet) - remove comment in multi-nic
-            # this bit here about creating the vifs will be updated
-            # in multi-nic to handle multiple IPs on the same network
-            # and multiple networks
-            # for now it works as there is only one of each
-            bridge = network['bridge']
-            network_ref = \
-                NetworkHelper.find_network_with_bridge(self._session, bridge)
+        VMHelper.create_vbd(session=self._session, vm_ref=vm_ref,
+                vdi_ref=vdi_ref, userdevice=0, bootable=True)
 
-            if network_ref:
-                VMHelper.create_vif(self._session, vm_ref,
-                                    network_ref, instance.mac_address)
+        # inject_network_info and create vifs
+        networks = self.inject_network_info(instance)
+        self.create_vifs(instance, networks)
 
         LOG.debug(_('Starting VM %s...'), vm_ref)
-        self._session.call_xenapi('VM.start', vm_ref, False, False)
-        instance_name = instance.name
+        self._start(instance, vm_ref)
         LOG.info(_('Spawning VM %(instance_name)s created %(vm_ref)s.')
-                % locals())
+                 % locals())
 
         def _inject_onset_files():
             onset_files = instance.onset_files
@@ -173,18 +158,18 @@ class VMOps(object):
 
         def _wait_for_boot():
             try:
-                state = self.get_info(instance['name'])['state']
+                state = self.get_info(instance_name)['state']
                 db.instance_set_state(context.get_admin_context(),
                                       instance['id'], state)
                 if state == power_state.RUNNING:
-                    LOG.debug(_('Instance %s: booted'), instance['name'])
+                    LOG.debug(_('Instance %s: booted'), instance_name)
                     timer.stop()
                     _inject_onset_files()
                     return True
             except Exception, exc:
                 LOG.warn(exc)
                 LOG.exception(_('instance %s: failed to boot'),
-                              instance['name'])
+                              instance_name)
                 db.instance_set_state(context.get_admin_context(),
                                       instance['id'],
                                       power_state.SHUTDOWN)
@@ -193,7 +178,7 @@ class VMOps(object):
 
         timer.f = _wait_for_boot
 
-        # call reset networking
+        # call to reset network to configure network from xenstore
         self.reset_network(instance)
 
         return timer.start(interval=0.5, now=True)
@@ -202,38 +187,55 @@ class VMOps(object):
         """Refactored out the common code of many methods that receive either
         a vm name or a vm instance, and want a vm instance in return.
         """
-        vm = None
-        try:
-            if instance_or_vm.startswith("OpaqueRef:"):
-                # Got passed an opaque ref; return it
+        # if instance_or_vm is a string it must be opaque ref or instance name
+        if isinstance(instance_or_vm, basestring):
+            obj = None
+            try:
+                # check for opaque ref
+                obj = self._session.get_xenapi().VM.get_record(instance_or_vm)
                 return instance_or_vm
-            else:
-                # Must be the instance name
+            except self.XenAPI.Failure:
+                # wasn't an opaque ref, must be an instance name
                 instance_name = instance_or_vm
-        except (AttributeError, KeyError):
-            # Note the the KeyError will only happen with fakes.py
-            # Not a string; must be an ID or a vm instance
-            if isinstance(instance_or_vm, (int, long)):
-                ctx = context.get_admin_context()
-                try:
-                    instance_obj = db.instance_get(ctx, instance_or_vm)
-                    instance_name = instance_obj.name
-                except exception.NotFound:
-                    # The unit tests screw this up, as they use an integer for
-                    # the vm name. I'd fix that up, but that's a matter for
-                    # another bug report. So for now, just try with the passed
-                    # value
-                    instance_name = instance_or_vm
-            else:
-                instance_name = instance_or_vm.name
-        vm = VMHelper.lookup(self._session, instance_name)
-        if vm is None:
+
+        # if instance_or_vm is an int/long it must be instance id
+        elif isinstance(instance_or_vm, (int, long)):
+            ctx = context.get_admin_context()
+            try:
+                instance_obj = db.instance_get(ctx, instance_or_vm)
+                instance_name = instance_obj.name
+            except exception.NotFound:
+                # The unit tests screw this up, as they use an integer for
+                # the vm name. I'd fix that up, but that's a matter for
+                # another bug report. So for now, just try with the passed
+                # value
+                instance_name = instance_or_vm
+
+        # otherwise instance_or_vm is an instance object
+        else:
+            instance_name = instance_or_vm.name
+        vm_ref = VMHelper.lookup(self._session, instance_name)
+        if vm_ref is None:
             raise exception.NotFound(
                             _('Instance not present %s') % instance_name)
-        return vm
+        return vm_ref
+
+    def _acquire_bootlock(self, vm):
+        """Prevent an instance from booting"""
+        self._session.call_xenapi(
+            "VM.set_blocked_operations",
+            vm,
+            {"start": ""})
+
+    def _release_bootlock(self, vm):
+        """Allow an instance to boot"""
+        self._session.call_xenapi(
+            "VM.remove_from_blocked_operations",
+            vm,
+            "start")
 
     def snapshot(self, instance, image_id):
-        """ Create snapshot from a running VM instance
+        """Create snapshot from a running VM instance
 
         :param instance: instance to be snapshotted
         :param image_id: id of image to upload to
@@ -254,7 +256,20 @@ class VMOps(object):
             that will bundle the VHDs together and then push the bundle into
             Glance.
         """
+        template_vm_ref = None
+        try:
+            template_vm_ref, template_vdi_uuids = self._get_snapshot(instance)
+            # call plugin to ship snapshot off to glance
+            VMHelper.upload_image(
+                    self._session, instance, template_vdi_uuids, image_id)
+        finally:
+            if template_vm_ref:
+                self._destroy(instance, template_vm_ref,
+                        shutdown=False, destroy_kernel_ramdisk=False)
 
+        logging.debug(_("Finished snapshot and upload for VM %s"), instance)
+
+    def _get_snapshot(self, instance):
         #TODO(sirp): Add quiesce and VSS locking support when Windows support
         # is added
 
@@ -265,25 +280,95 @@ class VMOps(object):
         try:
             template_vm_ref, template_vdi_uuids = VMHelper.create_snapshot(
                 self._session, instance.id, vm_ref, label)
+            return template_vm_ref, template_vdi_uuids
         except self.XenAPI.Failure, exc:
             logging.error(_("Unable to Snapshot %(vm_ref)s: %(exc)s")
                     % locals())
             return
 
+    def migrate_disk_and_power_off(self, instance, dest):
+        """Copies a VHD from one host machine to another
+
+        :param instance: the instance that owns the VHD in question
+        :param dest: the destination host machine
+        :param disk_type: values are 'primary' or 'cow'
+        """
+        vm_ref = VMHelper.lookup(self._session, instance.name)
+
+        # The primary VDI becomes the COW after the snapshot, and we can
+        # identify it via the VBD. The base copy is the parent_uuid returned
+        # from the snapshot creation
+
+        base_copy_uuid = cow_uuid = None
+        template_vdi_uuids = template_vm_ref = None
         try:
-            # call plugin to ship snapshot off to glance
-            VMHelper.upload_image(
-                self._session, instance.id, template_vdi_uuids, image_id)
+            # transfer the base copy
+            template_vm_ref, template_vdi_uuids = self._get_snapshot(instance)
+            base_copy_uuid = template_vdi_uuids[1]
+            vdi_ref, vm_vdi_rec = \
+                    VMHelper.get_vdi_for_vm_safely(self._session, vm_ref)
+            cow_uuid = vm_vdi_rec['uuid']
+
+            params = {'host': dest,
+                      'vdi_uuid': base_copy_uuid,
+                      'instance_id': instance.id,
+                      'sr_path': VMHelper.get_sr_path(self._session)}
+
+            task = self._session.async_call_plugin('migration', 'transfer_vhd',
+                    {'params': pickle.dumps(params)})
+            self._session.wait_for_task(task, instance.id)
+
+            # Now power down the instance and transfer the COW VHD
+            self._shutdown(instance, vm_ref, method='clean')
+
+            params = {'host': dest,
+                      'vdi_uuid': cow_uuid,
+                      'instance_id': instance.id,
+                      'sr_path': VMHelper.get_sr_path(self._session), }
+
+            task = self._session.async_call_plugin('migration', 'transfer_vhd',
+                    {'params': pickle.dumps(params)})
+            self._session.wait_for_task(task, instance.id)
+
         finally:
-            self._destroy(instance, template_vm_ref, shutdown=False)
+            if template_vm_ref:
+                self._destroy(instance, template_vm_ref,
+                        shutdown=False, destroy_kernel_ramdisk=False)
 
-        logging.debug(_("Finished snapshot and upload for VM %s"), instance)
+        # TODO(mdietz): we could also consider renaming these to something
+        # sensible so we don't need to blindly pass around dictionaries
+        return {'base_copy': base_copy_uuid, 'cow': cow_uuid}
+
+    def attach_disk(self, instance, base_copy_uuid, cow_uuid):
+        """Links the base copy VHD to the COW via the XAPI plugin"""
+        vm_ref = VMHelper.lookup(self._session, instance.name)
+        new_base_copy_uuid = str(uuid.uuid4())
+        new_cow_uuid = str(uuid.uuid4())
+        params = {'instance_id': instance.id,
+                  'old_base_copy_uuid': base_copy_uuid,
+                  'old_cow_uuid': cow_uuid,
+                  'new_base_copy_uuid': new_base_copy_uuid,
+                  'new_cow_uuid': new_cow_uuid,
+                  'sr_path': VMHelper.get_sr_path(self._session), }
+
+        task = self._session.async_call_plugin('migration',
+                'move_vhds_into_sr', {'params': pickle.dumps(params)})
+        self._session.wait_for_task(task, instance.id)
+
+        # Now we rescan the SR so we find the VHDs
+        VMHelper.scan_default_sr(self._session)
+
+        return new_cow_uuid
+
+    def resize(self, instance, flavor):
+        """Resize a running instance by changing it's RAM and disk size """
+        raise NotImplementedError()
 
     def reboot(self, instance):
         """Reboot VM instance"""
-        vm = self._get_vm_opaque_ref(instance)
-        task = self._session.call_xenapi('Async.VM.clean_reboot', vm)
-        self._session.wait_for_task(instance.id, task)
+        vm_ref = self._get_vm_opaque_ref(instance)
+        task = self._session.call_xenapi('Async.VM.clean_reboot', vm_ref)
+        self._session.wait_for_task(task, instance.id)
 
     def set_admin_password(self, instance, new_pass):
         """Set the root/admin password on the VM instance. This is done via
@@ -349,57 +434,96 @@ class VMOps(object):
             raise RuntimeError(resp_dict['message'])
         return resp_dict['message']
 
-    def _shutdown(self, instance, vm):
-        """Shutdown an instance """
+    def _shutdown(self, instance, vm_ref, hard=True):
+        """Shutdown an instance"""
         state = self.get_info(instance['name'])['state']
         if state == power_state.SHUTDOWN:
             LOG.warn(_("VM %(vm)s already halted, skipping shutdown...") %
                      locals())
             return
 
+        instance_id = instance.id
+        LOG.debug(_("Shutting down VM for Instance %(instance_id)s")
+                  % locals())
         try:
-            task = self._session.call_xenapi('Async.VM.hard_shutdown', vm)
-            self._session.wait_for_task(instance.id, task)
+            task = None
+            if hard:
+                task = self._session.call_xenapi("Async.VM.hard_shutdown",
+                                                 vm_ref)
+            else:
+                task = self._session.call_xenapi("Async.VM.clean_shutdown",
+                                                 vm_ref)
+            self._session.wait_for_task(task, instance.id)
         except self.XenAPI.Failure, exc:
             LOG.exception(exc)
 
-    def _destroy_vdis(self, instance, vm):
-        """Destroys all VDIs associated with a VM """
-        vdis = VMHelper.lookup_vm_vdis(self._session, vm)
+    def _destroy_vdis(self, instance, vm_ref):
+        """Destroys all VDIs associated with a VM"""
+        instance_id = instance.id
+        LOG.debug(_("Destroying VDIs for Instance %(instance_id)s")
+                  % locals())
+        vdi_refs = VMHelper.lookup_vm_vdis(self._session, vm_ref)
 
-        if not vdis:
+        if not vdi_refs:
             return
 
-        for vdi in vdis:
+        for vdi_ref in vdi_refs:
             try:
-                task = self._session.call_xenapi('Async.VDI.destroy', vdi)
-                self._session.wait_for_task(instance.id, task)
+                task = self._session.call_xenapi('Async.VDI.destroy', vdi_ref)
+                self._session.wait_for_task(task, instance.id)
             except self.XenAPI.Failure, exc:
                 LOG.exception(exc)
 
-    def _destroy_vm(self, instance, vm):
-        """Destroys a VM record """
+    def _destroy_kernel_ramdisk(self, instance, vm_ref):
+        """
+        Three situations can occur:
+
+            1. We have neither a ramdisk nor a kernel, in which case we are a
+               RAW image and can omit this step
+
+            2. We have one or the other, in which case, we should flag as an
+               error
+
+            3. We have both, in which case we safely remove both the kernel
+               and the ramdisk.
+        """
+        instance_id = instance.id
+        if not instance.kernel_id and not instance.ramdisk_id:
+            # 1. No kernel or ramdisk
+            LOG.debug(_("Instance %(instance_id)s using RAW or VHD, "
+                        "skipping kernel and ramdisk deletion") % locals())
+            return
+
+        if not (instance.kernel_id and instance.ramdisk_id):
+            # 2. We only have kernel xor ramdisk
+            raise exception.NotFound(
+                _("Instance %(instance_id)s has a kernel or ramdisk but not "
+                  "both" % locals()))
+
+        # 3. We have both kernel and ramdisk
+        (kernel, ramdisk) = VMHelper.lookup_kernel_ramdisk(self._session,
+                                                           vm_ref)
+
+        LOG.debug(_("Removing kernel/ramdisk files"))
+
+        args = {'kernel-file': kernel, 'ramdisk-file': ramdisk}
+        task = self._session.async_call_plugin(
+            'glance', 'remove_kernel_ramdisk', args)
+        self._session.wait_for_task(task, instance.id)
+
+        LOG.debug(_("kernel/ramdisk files removed"))
+
+    def _destroy_vm(self, instance, vm_ref):
+        """Destroys a VM record"""
+        instance_id = instance.id
         try:
-            kernel = None
-            ramdisk = None
-            if instance.kernel_id or instance.ramdisk_id:
-                (kernel, ramdisk) = VMHelper.lookup_kernel_ramdisk(
-                                    self._session, vm)
-            task1 = self._session.call_xenapi('Async.VM.destroy', vm)
-            LOG.debug(_("Removing kernel/ramdisk files"))
-            fn = "remove_kernel_ramdisk"
-            args = {}
-            if kernel:
-                args['kernel-file'] = kernel
-            if ramdisk:
-                args['ramdisk-file'] = ramdisk
-            task2 = self._session.async_call_plugin('glance', fn, args)
-            self._session.wait_for_task(instance.id, task1)
-            self._session.wait_for_task(instance.id, task2)
-            LOG.debug(_("kernel/ramdisk files removed"))
+            task = self._session.call_xenapi('Async.VM.destroy', vm_ref)
+            self._session.wait_for_task(task, instance_id)
         except self.XenAPI.Failure, exc:
             LOG.exception(exc)
 
+        LOG.debug(_("Instance %(instance_id)s VM destroyed") % locals())
+
     def destroy(self, instance):
         """
         Destroy VM instance
@@ -407,71 +531,148 @@ class VMOps(object):
         This is the method exposed by xenapi_conn.destroy(). The rest of the
         destroy_* methods are internal.
         """
-        vm = VMHelper.lookup(self._session, instance.name)
-        return self._destroy(instance, vm, shutdown=True)
+        instance_id = instance.id
+        LOG.info(_("Destroying VM for Instance %(instance_id)s") % locals())
+        vm_ref = VMHelper.lookup(self._session, instance.name)
+        return self._destroy(instance, vm_ref, shutdown=True)
 
-    def _destroy(self, instance, vm, shutdown=True):
+    def _destroy(self, instance, vm_ref, shutdown=True,
+                 destroy_kernel_ramdisk=True):
         """
         Destroys VM instance by performing:
 
-        1. A shutdown if requested
-        2. Destroying associated VDIs
-        3. Destroying that actual VM record
+            1. A shutdown if requested
+            2. Destroying associated VDIs
+            3. Destroying kernel and ramdisk files (if necessary)
+            4. Destroying that actual VM record
         """
-        if vm is None:
-            # Don't complain, just return.  This lets us clean up instances
-            # that have already disappeared from the underlying platform.
+        if vm_ref is None:
+            LOG.warning(_("VM is not present, skipping destroy..."))
             return
 
         if shutdown:
-            self._shutdown(instance, vm)
+            self._shutdown(instance, vm_ref)
 
-        self._destroy_vdis(instance, vm)
-        self._destroy_vm(instance, vm)
+        self._destroy_vdis(instance, vm_ref)
+        if destroy_kernel_ramdisk:
+            self._destroy_kernel_ramdisk(instance, vm_ref)
+        self._destroy_vm(instance, vm_ref)
 
     def _wait_with_callback(self, instance_id, task, callback):
         ret = None
         try:
-            ret = self._session.wait_for_task(instance_id, task)
+            ret = self._session.wait_for_task(task, instance_id)
         except self.XenAPI.Failure, exc:
             LOG.exception(exc)
         callback(ret)
 
     def pause(self, instance, callback):
         """Pause VM instance"""
-        vm = self._get_vm_opaque_ref(instance)
-        task = self._session.call_xenapi('Async.VM.pause', vm)
+        vm_ref = self._get_vm_opaque_ref(instance)
+        task = self._session.call_xenapi('Async.VM.pause', vm_ref)
         self._wait_with_callback(instance.id, task, callback)
 
     def unpause(self, instance, callback):
         """Unpause VM instance"""
-        vm = self._get_vm_opaque_ref(instance)
-        task = self._session.call_xenapi('Async.VM.unpause', vm)
+        vm_ref = self._get_vm_opaque_ref(instance)
+        task = self._session.call_xenapi('Async.VM.unpause', vm_ref)
         self._wait_with_callback(instance.id, task, callback)
 
     def suspend(self, instance, callback):
         """suspend the specified instance"""
-        vm = self._get_vm_opaque_ref(instance)
-        task = self._session.call_xenapi('Async.VM.suspend', vm)
+        vm_ref = self._get_vm_opaque_ref(instance)
+        task = self._session.call_xenapi('Async.VM.suspend', vm_ref)
         self._wait_with_callback(instance.id, task, callback)
 
     def resume(self, instance, callback):
         """resume the specified instance"""
-        vm = self._get_vm_opaque_ref(instance)
-        task = self._session.call_xenapi('Async.VM.resume', vm, False, True)
+        vm_ref = self._get_vm_opaque_ref(instance)
+        task = self._session.call_xenapi('Async.VM.resume', vm_ref, False,
+                                         True)
         self._wait_with_callback(instance.id, task, callback)
 
+    def rescue(self, instance, callback):
+        """Rescue the specified instance
+            - shutdown the instance VM
+            - set 'bootlock' to prevent the instance from starting in rescue
+            - spawn a rescue VM (the vm name-label will be instance-N-rescue)
+
+        """
+        rescue_vm_ref = VMHelper.lookup(self._session,
+                                        instance.name + "-rescue")
+        if rescue_vm_ref:
+            raise RuntimeError(_(
+                "Instance is already in Rescue Mode: %s" % instance.name))
+
+        vm_ref = self._get_vm_opaque_ref(instance)
+        self._shutdown(instance, vm_ref)
+        self._acquire_bootlock(vm_ref)
+
+        instance._rescue = True
+        self.spawn(instance)
+        rescue_vm_ref = self._get_vm_opaque_ref(instance)
+
+        vbd_ref = self._session.get_xenapi().VM.get_VBDs(vm_ref)[0]
+        vdi_ref = self._session.get_xenapi().VBD.get_record(vbd_ref)["VDI"]
+        rescue_vbd_ref = VMHelper.create_vbd(self._session, rescue_vm_ref,
+                                             vdi_ref, 1, False)
+
+        self._session.call_xenapi("Async.VBD.plug", rescue_vbd_ref)
+
+    def unrescue(self, instance, callback):
+        """Unrescue the specified instance
+            - unplug the instance VM's disk from the rescue VM
+            - teardown the rescue VM
+            - release the bootlock to allow the instance VM to start
+
+        """
+        rescue_vm_ref = VMHelper.lookup(self._session,
+                                    instance.name + "-rescue")
+
+        if not rescue_vm_ref:
+            raise exception.NotFound(_(
+                "Instance is not in Rescue Mode: %s" % instance.name))
+
+        original_vm_ref = self._get_vm_opaque_ref(instance)
+        vbd_refs = self._session.get_xenapi().VM.get_VBDs(rescue_vm_ref)
+
+        instance._rescue = False
+
+        for vbd_ref in vbd_refs:
+            _vbd_ref = self._session.get_xenapi().VBD.get_record(vbd_ref)
+            if _vbd_ref["userdevice"] == "1":
+                VMHelper.unplug_vbd(self._session, vbd_ref)
+                VMHelper.destroy_vbd(self._session, vbd_ref)
+
+        task1 = self._session.call_xenapi("Async.VM.hard_shutdown",
+                                          rescue_vm_ref)
+        self._session.wait_for_task(task1, instance.id)
+
+        vdi_refs = VMHelper.lookup_vm_vdis(self._session, rescue_vm_ref)
+        for vdi_ref in vdi_refs:
+            try:
+                task = self._session.call_xenapi('Async.VDI.destroy', vdi_ref)
+                self._session.wait_for_task(task, instance.id)
+            except self.XenAPI.Failure:
+                continue
+
+        task2 = self._session.call_xenapi('Async.VM.destroy', rescue_vm_ref)
+        self._session.wait_for_task(task2, instance.id)
+
+        self._release_bootlock(original_vm_ref)
+        self._start(instance, original_vm_ref)
+
     def get_info(self, instance):
         """Return data about VM instance"""
-        vm = self._get_vm_opaque_ref(instance)
-        rec = self._session.get_xenapi().VM.get_record(vm)
-        return VMHelper.compile_info(rec)
+        vm_ref = self._get_vm_opaque_ref(instance)
+        vm_rec = self._session.get_xenapi().VM.get_record(vm_ref)
+        return VMHelper.compile_info(vm_rec)
 
     def get_diagnostics(self, instance):
         """Return data about VM diagnostics"""
-        vm = self._get_vm_opaque_ref(instance)
-        rec = self._session.get_xenapi().VM.get_record(vm)
-        return VMHelper.compile_diagnostics(self._session, rec)
+        vm_ref = self._get_vm_opaque_ref(instance)
+        vm_rec = self._session.get_xenapi().VM.get_record(vm_ref)
+        return VMHelper.compile_diagnostics(self._session, vm_rec)
 
     def get_console_output(self, instance):
         """Return snapshot of console"""
@@ -483,6 +684,89 @@ class VMOps(object):
         # TODO: implement this!
         return 'http://fakeajaxconsole/fake_url'
 
+    def inject_network_info(self, instance):
+        """
+        Generate the network info and make calls to place it into the
+        xenstore and the xenstore param list
+
+        """
+        # TODO(tr3buchet) - remove comment in multi-nic
+        # I've decided to go ahead and consider multiple IPs and networks
+        # at this stage even though they aren't implemented because these will
+        # be needed for multi-nic and there was no sense writing it for single
+        # network/single IP and then having to turn around and re-write it
+        vm_ref = self._get_vm_opaque_ref(instance.id)
+        logging.debug(_("injecting network info to xenstore for vm: |%s|"),
+                        vm_ref)
+        admin_context = context.get_admin_context()
+        IPs = db.fixed_ip_get_all_by_instance(admin_context, instance['id'])
+        networks = db.network_get_all_by_instance(admin_context,
+                                                  instance['id'])
+        for network in networks:
+            network_IPs = [ip for ip in IPs if ip.network_id == network.id]
+
+            def ip_dict(ip):
+                return {
+                    "ip": ip.address,
+                    "netmask": network["netmask"],
+                    "enabled": "1"}
+
+            def ip6_dict(ip6):
+                return {
+                    "ip": ip6.addressV6,
+                    "netmask": ip6.netmaskV6,
+                    "gateway": ip6.gatewayV6,
+                    "enabled": "1"}
+
+            mac_id = instance.mac_address.replace(':', '')
+            location = 'vm-data/networking/%s' % mac_id
+            mapping = {
+                'label': network['label'],
+                'gateway': network['gateway'],
+                'mac': instance.mac_address,
+                'dns': [network['dns']],
+                'ips': [ip_dict(ip) for ip in network_IPs],
+                'ip6s': [ip6_dict(ip) for ip in network_IPs]}
+
+            self.write_to_param_xenstore(vm_ref, {location: mapping})
+
+            try:
+                self.write_to_xenstore(vm_ref, location, mapping['location'])
+            except KeyError:
+                # catch KeyError for domid if instance isn't running
+                pass
+
+        return networks
+
+    def create_vifs(self, instance, networks=None):
+        """
+        Creates vifs for an instance
+
+        """
+        vm_ref = self._get_vm_opaque_ref(instance.id)
+        logging.debug(_("creating vif(s) for vm: |%s|"), vm_ref)
+        if networks is None:
+            networks = db.network_get_all_by_instance(admin_context,
+                                                      instance['id'])
+        # TODO(tr3buchet) - remove comment in multi-nic
+        # this bit here about creating the vifs will be updated
+        # in multi-nic to handle multiple IPs on the same network
+        # and multiple networks
+        # for now it works as there is only one of each
+        for network in networks:
+            bridge = network['bridge']
+            network_ref = \
+                NetworkHelper.find_network_with_bridge(self._session, bridge)
+
+            if network_ref:
+                try:
+                    device = "1" if instance._rescue else "0"
+                except AttributeError:
+                    device = "0"
+
+                VMHelper.create_vif(self._session, vm_ref, network_ref,
+                                    instance.mac_address, device)
+
     def reset_network(self, instance):
         """
         Creates uuid arg to pass to make_agent_call and calls it.
@@ -545,13 +829,13 @@ class VMOps(object):
         Any errors raised by the plugin will in turn raise a RuntimeError here.
         """
         instance_id = vm.id
-        vm = self._get_vm_opaque_ref(vm)
-        rec = self._session.get_xenapi().VM.get_record(vm)
-        args = {'dom_id': rec['domid'], 'path': path}
+        vm_ref = self._get_vm_opaque_ref(vm)
+        vm_rec = self._session.get_xenapi().VM.get_record(vm_ref)
+        args = {'dom_id': vm_rec['domid'], 'path': path}
         args.update(addl_args)
         try:
             task = self._session.async_call_plugin(plugin, method, args)
-            ret = self._session.wait_for_task(instance_id, task)
+            ret = self._session.wait_for_task(task, instance_id)
         except self.XenAPI.Failure, e:
             ret = None
             err_trace = e.details[-1]
@@ -627,9 +911,9 @@ class VMOps(object):
         value for 'keys' is passed, the returned dict is filtered to only
         return the values for those keys.
         """
-        vm = self._get_vm_opaque_ref(instance_or_vm)
+        vm_ref = self._get_vm_opaque_ref(instance_or_vm)
         data = self._session.call_xenapi_request('VM.get_xenstore_data',
-                (vm, ))
+                (vm_ref, ))
         ret = {}
         if keys is None:
             keys = data.keys()
@@ -647,11 +931,11 @@ class VMOps(object):
         """Takes a key/value pair and adds it to the xenstore parameter
         record for the given vm instance. If the key exists in xenstore,
         it is overwritten"""
-        vm = self._get_vm_opaque_ref(instance_or_vm)
+        vm_ref = self._get_vm_opaque_ref(instance_or_vm)
         self.remove_from_param_xenstore(instance_or_vm, key)
         jsonval = json.dumps(val)
         self._session.call_xenapi_request('VM.add_to_xenstore_data',
-                (vm, key, jsonval))
+                                          (vm_ref, key, jsonval))
 
     def write_to_param_xenstore(self, instance_or_vm, mapping):
         """Takes a dict and writes each key/value pair to the xenstore
@@ -666,14 +950,14 @@ class VMOps(object):
         them from the xenstore parameter record data for the given VM.
         If the key doesn't exist, the request is ignored.
         """
-        vm = self._get_vm_opaque_ref(instance_or_vm)
+        vm_ref = self._get_vm_opaque_ref(instance_or_vm)
         if isinstance(key_or_keys, basestring):
             keys = [key_or_keys]
         else:
             keys = key_or_keys
         for key in keys:
             self._session.call_xenapi_request('VM.remove_from_xenstore_data',
-                    (vm, key))
+                                              (vm_ref, key))
 
     def clear_param_xenstore(self, instance_or_vm):
         """Removes all data from the xenstore parameter record for this VM."""
diff --git a/nova/virt/xenapi/volume_utils.py b/nova/virt/xenapi/volume_utils.py
index d5ebd29d5..72284ac02 100644
--- a/nova/virt/xenapi/volume_utils.py
+++ b/nova/virt/xenapi/volume_utils.py
@@ -117,16 +117,16 @@ class VolumeHelper(HelperBase):
     def introduce_vdi(cls, session, sr_ref):
         """Introduce VDI in the host"""
         try:
-            vdis = session.get_xenapi().SR.get_VDIs(sr_ref)
+            vdi_refs = session.get_xenapi().SR.get_VDIs(sr_ref)
         except cls.XenAPI.Failure, exc:
             LOG.exception(exc)
             raise StorageError(_('Unable to introduce VDI on SR %s') % sr_ref)
         try:
-            vdi_rec = session.get_xenapi().VDI.get_record(vdis[0])
+            vdi_rec = session.get_xenapi().VDI.get_record(vdi_refs[0])
         except cls.XenAPI.Failure, exc:
             LOG.exception(exc)
             raise StorageError(_('Unable to get record'
-                                 ' of VDI %s on') % vdis[0])
+                                 ' of VDI %s on') % vdi_refs[0])
         else:
             try:
                 return session.get_xenapi().VDI.introduce(
diff --git a/nova/virt/xenapi/volumeops.py b/nova/virt/xenapi/volumeops.py
index d89a6f995..757ecf5ad 100644
--- a/nova/virt/xenapi/volumeops.py
+++ b/nova/virt/xenapi/volumeops.py
@@ -83,7 +83,7 @@ class VolumeOps(object):
                 try:
                     task = self._session.call_xenapi('Async.VBD.plug',
                                                            vbd_ref)
-                    self._session.wait_for_task(vol_rec['deviceNumber'], task)
+                    self._session.wait_for_task(task, vol_rec['deviceNumber'])
                 except self.XenAPI.Failure, exc:
                     LOG.exception(exc)
                     VolumeHelper.destroy_iscsi_storage(self._session,
diff --git a/nova/virt/xenapi_conn.py b/nova/virt/xenapi_conn.py
index c2f65699f..da42a83b6 100644
--- a/nova/virt/xenapi_conn.py
+++ b/nova/virt/xenapi_conn.py
@@ -49,6 +49,12 @@ reactor thread if the VM.get_by_name_label or VM.get_record calls block.
                              address for the nova-volume host
 :target_port:                iSCSI Target Port, 3260 Default
 :iqn_prefix:                 IQN Prefix, e.g. 'iqn.2010-10.org.openstack'
+
+**Variable Naming Scheme**
+
+- suffix "_ref" for opaque references
+- suffix "_uuid" for UUIDs
+- suffix "_rec" for record objects
 """
 
 import sys
@@ -100,6 +106,8 @@ flags.DEFINE_integer('xenapi_vhd_coalesce_max_attempts',
                      5,
                      'Max number of times to poll for VHD to coalesce.'
                      '  Used only if connection_type=xenapi.')
+flags.DEFINE_string('xenapi_sr_base_path', '/var/run/sr-mount',
+                    'Base path to the storage repository')
 flags.DEFINE_string('target_host',
                     None,
                     'iSCSI Target Host')
@@ -156,10 +164,20 @@ class XenAPIConnection(object):
         """Create VM instance"""
         self._vmops.spawn(instance)
 
+    def finish_resize(self, instance, disk_info):
+        """Completes a resize, turning on the migrated instance"""
+        vdi_uuid = self._vmops.attach_disk(instance, disk_info['base_copy'],
+                disk_info['cow'])
+        self._vmops._spawn_with_disk(instance, vdi_uuid)
+
     def snapshot(self, instance, image_id):
         """ Create snapshot from a running VM instance """
         self._vmops.snapshot(instance, image_id)
 
+    def resize(self, instance, flavor):
+        """Resize a VM instance"""
+        raise NotImplementedError()
+
     def reboot(self, instance):
         """Reboot VM instance"""
         self._vmops.reboot(instance)
@@ -186,6 +204,11 @@ class XenAPIConnection(object):
         """Unpause paused VM instance"""
         self._vmops.unpause(instance, callback)
 
+    def migrate_disk_and_power_off(self, instance, dest):
+        """Transfers the VHD of a running instance to another host, then shuts
+        off the instance copies over the COW disk"""
+        return self._vmops.migrate_disk_and_power_off(instance, dest)
+
     def suspend(self, instance, callback):
         """suspend the specified instance"""
         self._vmops.suspend(instance, callback)
@@ -194,10 +217,22 @@ class XenAPIConnection(object):
         """resume the specified instance"""
         self._vmops.resume(instance, callback)
 
+    def rescue(self, instance, callback):
+        """Rescue the specified instance"""
+        self._vmops.rescue(instance, callback)
+
+    def unrescue(self, instance, callback):
+        """Unrescue the specified instance"""
+        self._vmops.unrescue(instance, callback)
+
     def reset_network(self, instance):
         """reset networking for specified instance"""
         self._vmops.reset_network(instance)
 
+    def inject_network_info(self, instance):
+        """inject network info for specified instance"""
+        self._vmops.inject_network_info(instance)
+
     def get_info(self, instance_id):
         """Return data about VM instance"""
         return self._vmops.get_info(instance_id)
@@ -214,6 +249,10 @@ class XenAPIConnection(object):
         """Return link to instance's ajax console"""
         return self._vmops.get_ajax_console(instance)
 
+    def get_host_ip_addr(self):
+        xs_url = urlparse.urlparse(FLAGS.xenapi_connection_url)
+        return xs_url.netloc
+
     def attach_volume(self, instance_name, device_path, mountpoint):
         """Attach volume storage to VM instance"""
         return self._volumeops.attach_volume(instance_name,
@@ -230,6 +269,27 @@ class XenAPIConnection(object):
                  'username': FLAGS.xenapi_connection_username,
                  'password': FLAGS.xenapi_connection_password}
 
+    def update_available_resource(self, ctxt, host):
+        """This method is supported only by libvirt."""
+        return
+
+    def compare_cpu(self, xml):
+        """This method is supported only by libvirt."""
+        raise NotImplementedError('This method is supported only by libvirt.')
+
+    def ensure_filtering_rules_for_instance(self, instance_ref):
+        """This method is supported only libvirt."""
+        return
+
+    def live_migration(self, context, instance_ref, dest,
+                       post_method, recover_method):
+        """This method is supported only by libvirt."""
+        return
+
+    def unfilter_instance(self, instance_ref):
+        """This method is supported only by libvirt."""
+        raise NotImplementedError('This method is supported only by libvirt.')
+
 
 class XenAPISession(object):
     """The session to invoke XenAPI SDK calls"""
@@ -273,7 +333,7 @@ class XenAPISession(object):
                              self._session.xenapi.Async.host.call_plugin,
                              self.get_xenapi_host(), plugin, fn, args)
 
-    def wait_for_task(self, id, task):
+    def wait_for_task(self, task, id=None):
         """Return the result of the given task. The task is polled
         until it completes. Not re-entrant."""
         done = event.Event()
@@ -300,10 +360,11 @@ class XenAPISession(object):
         try:
             name = self._session.xenapi.task.get_name_label(task)
             status = self._session.xenapi.task.get_status(task)
-            action = dict(
-                instance_id=int(id),
-                action=name[0:255],  # Ensure action is never > 255
-                error=None)
+            if id:
+                action = dict(
+                    instance_id=int(id),
+                    action=name[0:255],  # Ensure action is never > 255
+                    error=None)
             if status == "pending":
                 return
             elif status == "success":
@@ -317,7 +378,9 @@ class XenAPISession(object):
                 LOG.warn(_("Task [%(name)s] %(task)s status:"
                         " %(status)s    %(error_info)s") % locals())
                 done.send_exception(self.XenAPI.Failure(error_info))
-            db.instance_action_create(context.get_admin_context(), action)
+
+            if id:
+                db.instance_action_create(context.get_admin_context(), action)
         except self.XenAPI.Failure, exc:
             LOG.warn(exc)
             done.send_exception(*sys.exc_info())
diff --git a/nova/volume/api.py b/nova/volume/api.py
index 478c83486..2f4494845 100644
--- a/nova/volume/api.py
+++ b/nova/volume/api.py
@@ -49,7 +49,7 @@ class API(base.Base):
 
         options = {
             'size': size,
-            'user_id': context.user.id,
+            'user_id': context.user_id,
             'project_id': context.project_id,
             'availability_zone': FLAGS.storage_availability_zone,
             'status': "creating",
@@ -85,7 +85,7 @@ class API(base.Base):
         return self.db.volume_get(context, volume_id)
 
     def get_all(self, context):
-        if context.user.is_admin():
+        if context.is_admin:
             return self.db.volume_get_all(context)
         return self.db.volume_get_all_by_project(context, context.project_id)
 
diff --git a/nova/volume/driver.py b/nova/volume/driver.py
index 82f4c2f54..7b4bacdec 100644
--- a/nova/volume/driver.py
+++ b/nova/volume/driver.py
@@ -21,6 +21,7 @@ Drivers for volumes.
 """
 
 import time
+import os
 
 from nova import exception
 from nova import flags
@@ -36,6 +37,8 @@ flags.DEFINE_string('aoe_eth_dev', 'eth0',
                     'Which device to export the volumes on')
 flags.DEFINE_string('num_shell_tries', 3,
                     'number of times to attempt to run flakey shell commands')
+flags.DEFINE_string('num_iscsi_scan_tries', 3,
+                    'number of times to rescan iSCSI target to find volume')
 flags.DEFINE_integer('num_shelves',
                     100,
                     'Number of vblade shelves')
@@ -62,14 +65,14 @@ class VolumeDriver(object):
         self._execute = execute
         self._sync_exec = sync_exec
 
-    def _try_execute(self, command):
+    def _try_execute(self, *command):
         # NOTE(vish): Volume commands can partially fail due to timing, but
         #             running them a second time on failure will usually
         #             recover nicely.
         tries = 0
         while True:
             try:
-                self._execute(command)
+                self._execute(*command)
                 return True
             except exception.ProcessExecutionError:
                 tries = tries + 1
@@ -81,34 +84,35 @@ class VolumeDriver(object):
 
     def check_for_setup_error(self):
         """Returns an error if prerequisites aren't met"""
-        out, err = self._execute("sudo vgs --noheadings -o name")
+        out, err = self._execute('sudo', 'vgs', '--noheadings', '-o', 'name')
         volume_groups = out.split()
         if not FLAGS.volume_group in volume_groups:
             raise exception.Error(_("volume group %s doesn't exist")
                                   % FLAGS.volume_group)
 
     def create_volume(self, volume):
-        """Creates a logical volume."""
+        """Creates a logical volume. Can optionally return a Dictionary of
+        changes to the volume object to be persisted."""
         if int(volume['size']) == 0:
             sizestr = '100M'
         else:
             sizestr = '%sG' % volume['size']
-        self._try_execute("sudo lvcreate -L %s -n %s %s" %
-                          (sizestr,
+        self._try_execute('sudo', 'lvcreate', '-L', sizestr, '-n',
                            volume['name'],
-                           FLAGS.volume_group))
+                           FLAGS.volume_group)
 
     def delete_volume(self, volume):
         """Deletes a logical volume."""
         try:
-            self._try_execute("sudo lvdisplay %s/%s" %
+            self._try_execute('sudo', 'lvdisplay',
+                              '%s/%s' %
                               (FLAGS.volume_group,
                                volume['name']))
         except Exception as e:
             # If the volume isn't present, then don't attempt to delete
             return True
 
-        self._try_execute("sudo lvremove -f %s/%s" %
+        self._try_execute('sudo', 'lvremove', '-f', "%s/%s" %
                           (FLAGS.volume_group,
                            volume['name']))
 
@@ -123,7 +127,8 @@ class VolumeDriver(object):
         raise NotImplementedError()
 
     def create_export(self, context, volume):
-        """Exports the volume."""
+        """Exports the volume. Can optionally return a Dictionary of changes
+        to the volume object to be persisted."""
         raise NotImplementedError()
 
     def remove_export(self, context, volume):
@@ -138,6 +143,10 @@ class VolumeDriver(object):
         """Undiscover volume on a remote host."""
         raise NotImplementedError()
 
+    def check_for_export(self, context, volume_id):
+        """Make sure volume is exported."""
+        raise NotImplementedError()
+
 
 class AOEDriver(VolumeDriver):
     """Implements AOE specific volume commands."""
@@ -163,12 +172,13 @@ class AOEDriver(VolumeDriver):
          blade_id) = self.db.volume_allocate_shelf_and_blade(context,
                                                              volume['id'])
         self._try_execute(
-                "sudo vblade-persist setup %s %s %s /dev/%s/%s" %
-                (shelf_id,
+                'sudo', 'vblade-persist', 'setup',
+                 shelf_id,
                  blade_id,
                  FLAGS.aoe_eth_dev,
-                 FLAGS.volume_group,
-                 volume['name']))
+                 "/dev/%s/%s" %
+                 (FLAGS.volume_group,
+                  volume['name']))
         # NOTE(vish): The standard _try_execute does not work here
         #             because these methods throw errors if other
         #             volumes on this host are in the process of
@@ -177,9 +187,9 @@ class AOEDriver(VolumeDriver):
         #             just wait a bit for the current volume to
         #             be ready and ignore any errors.
         time.sleep(2)
-        self._execute("sudo vblade-persist auto all",
+        self._execute('sudo', 'vblade-persist', 'auto', 'all',
                       check_exit_code=False)
-        self._execute("sudo vblade-persist start all",
+        self._execute('sudo', 'vblade-persist', 'start', 'all',
                       check_exit_code=False)
 
     def remove_export(self, context, volume):
@@ -187,20 +197,50 @@ class AOEDriver(VolumeDriver):
         (shelf_id,
          blade_id) = self.db.volume_get_shelf_and_blade(context,
                                                         volume['id'])
-        self._try_execute("sudo vblade-persist stop %s %s" %
-                          (shelf_id, blade_id))
-        self._try_execute("sudo vblade-persist destroy %s %s" %
-                          (shelf_id, blade_id))
+        self._try_execute('sudo', 'vblade-persist', 'stop',
+                          shelf_id, blade_id)
+        self._try_execute('sudo', 'vblade-persist', 'destroy',
+                          shelf_id, blade_id)
 
-    def discover_volume(self, _volume):
+    def discover_volume(self, context, _volume):
         """Discover volume on a remote host."""
+        (shelf_id,
+         blade_id) = self.db.volume_get_shelf_and_blade(context,
+                                                        _volume['id'])
         self._execute("sudo aoe-discover")
-        self._execute("sudo aoe-stat", check_exit_code=False)
+        out, err = self._execute("sudo aoe-stat", check_exit_code=False)
+        device_path = 'e%(shelf_id)d.%(blade_id)d' % locals()
+        if out.find(device_path) >= 0:
+            return "/dev/etherd/%s" % device_path
+        else:
+            return
 
     def undiscover_volume(self, _volume):
         """Undiscover volume on a remote host."""
         pass
 
+    def check_for_export(self, context, volume_id):
+        """Make sure volume is exported."""
+        (shelf_id,
+         blade_id) = self.db.volume_get_shelf_and_blade(context,
+                                                        volume_id)
+        cmd = "sudo vblade-persist ls --no-header"
+        out, _err = self._execute(cmd)
+        exported = False
+        for line in out.split('\n'):
+            param = line.split(' ')
+            if len(param) == 6 and param[0] == str(shelf_id) \
+                    and param[1] == str(blade_id) and param[-1] == "run":
+                exported = True
+                break
+        if not exported:
+            # Instance will be terminated in this case.
+            desc = _("Cannot confirm exported volume id:%(volume_id)s. "
+                     "vblade process for e%(shelf_id)s.%(blade_id)s "
+                     "isn't running.") % locals()
+            raise exception.ProcessExecutionError(out, _err, cmd=cmd,
+                                                  description=desc)
+
 
 class FakeAOEDriver(AOEDriver):
     """Logs calls instead of executing."""
@@ -222,7 +262,18 @@ class FakeAOEDriver(AOEDriver):
 
 
 class ISCSIDriver(VolumeDriver):
-    """Executes commands relating to ISCSI volumes."""
+    """Executes commands relating to ISCSI volumes.
+
+    We make use of model provider properties as follows:
+
+    :provider_location:    if present, contains the iSCSI target information
+                           in the same format as an ietadm discovery
+                           i.e. '<ip>:<port>,<portal> <target IQN>'
+
+    :provider_auth:    if present, contains a space-separated triple:
+                       '<auth method> <auth username> <auth password>'.
+                       `CHAP` is the only auth_method in use at the moment.
+    """
 
     def ensure_export(self, context, volume):
         """Synchronously recreates an export for a logical volume."""
@@ -236,13 +287,16 @@ class ISCSIDriver(VolumeDriver):
 
         iscsi_name = "%s%s" % (FLAGS.iscsi_target_prefix, volume['name'])
         volume_path = "/dev/%s/%s" % (FLAGS.volume_group, volume['name'])
-        self._sync_exec("sudo ietadm --op new "
-                        "--tid=%s --params Name=%s" %
-                        (iscsi_target, iscsi_name),
+        self._sync_exec('sudo', 'ietadm', '--op', 'new',
+                        "--tid=%s" % iscsi_target,
+                        '--params',
+                        "Name=%s" % iscsi_name,
                         check_exit_code=False)
-        self._sync_exec("sudo ietadm --op new --tid=%s "
-                        "--lun=0 --params Path=%s,Type=fileio" %
-                        (iscsi_target, volume_path),
+        self._sync_exec('sudo', 'ietadm', '--op', 'new',
+                        "--tid=%s" % iscsi_target,
+                        '--lun=0',
+                        '--params',
+                        "Path=%s,Type=fileio" % volume_path,
                         check_exit_code=False)
 
     def _ensure_iscsi_targets(self, context, host):
@@ -263,12 +317,13 @@ class ISCSIDriver(VolumeDriver):
                                                       volume['host'])
         iscsi_name = "%s%s" % (FLAGS.iscsi_target_prefix, volume['name'])
         volume_path = "/dev/%s/%s" % (FLAGS.volume_group, volume['name'])
-        self._execute("sudo ietadm --op new "
-                      "--tid=%s --params Name=%s" %
+        self._execute('sudo', 'ietadm', '--op', 'new',
+                      '--tid=%s --params Name=%s' %
                       (iscsi_target, iscsi_name))
-        self._execute("sudo ietadm --op new --tid=%s "
-                      "--lun=0 --params Path=%s,Type=fileio" %
-                      (iscsi_target, volume_path))
+        self._execute('sudo', 'ietadm', '--op', 'new',
+                      '--tid=%s' % iscsi_target,
+                      '--lun=0', '--params',
+                      'Path=%s,Type=fileio' % volume_path)
 
     def remove_export(self, context, volume):
         """Removes an export for a logical volume."""
@@ -283,51 +338,176 @@ class ISCSIDriver(VolumeDriver):
         try:
             # ietadm show will exit with an error
             # this export has already been removed
-            self._execute("sudo ietadm --op show --tid=%s " % iscsi_target)
+            self._execute('sudo', 'ietadm', '--op', 'show',
+                          '--tid=%s' % iscsi_target)
         except Exception as e:
             LOG.info(_("Skipping remove_export. No iscsi_target " +
                        "is presently exported for volume: %d"), volume['id'])
             return
 
-        self._execute("sudo ietadm --op delete --tid=%s "
-                      "--lun=0" % iscsi_target)
-        self._execute("sudo ietadm --op delete --tid=%s" %
-                      iscsi_target)
+        self._execute('sudo', 'ietadm', '--op', 'delete',
+                      '--tid=%s' % iscsi_target,
+                      '--lun=0')
+        self._execute('sudo', 'ietadm', '--op', 'delete',
+                      '--tid=%s' % iscsi_target)
+
+    def _do_iscsi_discovery(self, volume):
+        #TODO(justinsb): Deprecate discovery and use stored info
+        #NOTE(justinsb): Discovery won't work with CHAP-secured targets (?)
+        LOG.warn(_("ISCSI provider_location not stored, using discovery"))
 
-    def _get_name_and_portal(self, volume):
-        """Gets iscsi name and portal from volume name and host."""
         volume_name = volume['name']
-        host = volume['host']
-        (out, _err) = self._execute("sudo iscsiadm -m discovery -t "
-                                    "sendtargets -p %s" % host)
+
+        (out, _err) = self._execute('sudo', 'iscsiadm', '-m', 'discovery',
+                                    '-t', 'sendtargets', '-p', volume['host'])
         for target in out.splitlines():
             if FLAGS.iscsi_ip_prefix in target and volume_name in target:
-                (location, _sep, iscsi_name) = target.partition(" ")
-                break
-        iscsi_portal = location.split(",")[0]
-        return (iscsi_name, iscsi_portal)
+                return target
+        return None
 
-    def discover_volume(self, volume):
+    def _get_iscsi_properties(self, volume):
+        """Gets iscsi configuration
+
+        We ideally get saved information in the volume entity, but fall back
+        to discovery if need be. Discovery may be completely removed in future
+        The properties are:
+
+        :target_discovered:    boolean indicating whether discovery was used
+
+        :target_iqn:    the IQN of the iSCSI target
+
+        :target_portal:    the portal of the iSCSI target
+
+        :auth_method:, :auth_username:, :auth_password:
+
+            the authentication details. Right now, either auth_method is not
+            present meaning no authentication, or auth_method == `CHAP`
+            meaning use CHAP with the specified credentials.
+        """
+
+        properties = {}
+
+        location = volume['provider_location']
+
+        if location:
+            # provider_location is the same format as iSCSI discovery output
+            properties['target_discovered'] = False
+        else:
+            location = self._do_iscsi_discovery(volume)
+
+            if not location:
+                raise exception.Error(_("Could not find iSCSI export "
+                                        " for volume %s") %
+                                      (volume['name']))
+
+            LOG.debug(_("ISCSI Discovery: Found %s") % (location))
+            properties['target_discovered'] = True
+
+        (iscsi_target, _sep, iscsi_name) = location.partition(" ")
+
+        iscsi_portal = iscsi_target.split(",")[0]
+
+        properties['target_iqn'] = iscsi_name
+        properties['target_portal'] = iscsi_portal
+
+        auth = volume['provider_auth']
+
+        if auth:
+            (auth_method, auth_username, auth_secret) = auth.split()
+
+            properties['auth_method'] = auth_method
+            properties['auth_username'] = auth_username
+            properties['auth_password'] = auth_secret
+
+        return properties
+
+    def _run_iscsiadm(self, iscsi_properties, iscsi_command):
+        command = ("sudo iscsiadm -m node -T %s -p %s %s" %
+                   (iscsi_properties['target_iqn'],
+                    iscsi_properties['target_portal'],
+                    iscsi_command))
+        (out, err) = self._execute(command)
+        LOG.debug("iscsiadm %s: stdout=%s stderr=%s" %
+                  (iscsi_command, out, err))
+        return (out, err)
+
+    def _iscsiadm_update(self, iscsi_properties, property_key, property_value):
+        iscsi_command = ("--op update -n %s -v %s" %
+                         (property_key, property_value))
+        return self._run_iscsiadm(iscsi_properties, iscsi_command)
+
+    def discover_volume(self, context, volume):
         """Discover volume on a remote host."""
-        iscsi_name, iscsi_portal = self._get_name_and_portal(volume)
-        self._execute("sudo iscsiadm -m node -T %s -p %s --login" %
-                      (iscsi_name, iscsi_portal))
-        self._execute("sudo iscsiadm -m node -T %s -p %s --op update "
-                      "-n node.startup -v automatic" %
-                      (iscsi_name, iscsi_portal))
-        return "/dev/disk/by-path/ip-%s-iscsi-%s-lun-0" % (iscsi_portal,
-                                                           iscsi_name)
+        iscsi_properties = self._get_iscsi_properties(volume)
+
+        if not iscsi_properties['target_discovered']:
+            self._run_iscsiadm(iscsi_properties, "--op new")
+
+        if iscsi_properties.get('auth_method'):
+            self._iscsiadm_update(iscsi_properties,
+                                  "node.session.auth.authmethod",
+                                  iscsi_properties['auth_method'])
+            self._iscsiadm_update(iscsi_properties,
+                                  "node.session.auth.username",
+                                  iscsi_properties['auth_username'])
+            self._iscsiadm_update(iscsi_properties,
+                                  "node.session.auth.password",
+                                  iscsi_properties['auth_password'])
+
+        self._run_iscsiadm(iscsi_properties, "--login")
+
+        self._iscsiadm_update(iscsi_properties, "node.startup", "automatic")
+
+        mount_device = ("/dev/disk/by-path/ip-%s-iscsi-%s-lun-0" %
+                        (iscsi_properties['target_portal'],
+                         iscsi_properties['target_iqn']))
+
+        # The /dev/disk/by-path/... node is not always present immediately
+        # TODO(justinsb): This retry-with-delay is a pattern, move to utils?
+        tries = 0
+        while not os.path.exists(mount_device):
+            if tries >= FLAGS.num_iscsi_scan_tries:
+                raise exception.Error(_("iSCSI device not found at %s") %
+                                      (mount_device))
+
+            LOG.warn(_("ISCSI volume not yet found at: %(mount_device)s. "
+                       "Will rescan & retry.  Try number: %(tries)s") %
+                     locals())
+
+            # The rescan isn't documented as being necessary(?), but it helps
+            self._run_iscsiadm(iscsi_properties, "--rescan")
+
+            tries = tries + 1
+            if not os.path.exists(mount_device):
+                time.sleep(tries ** 2)
+
+        if tries != 0:
+            LOG.debug(_("Found iSCSI node %(mount_device)s "
+                        "(after %(tries)s rescans)") %
+                      locals())
+
+        return mount_device
 
     def undiscover_volume(self, volume):
         """Undiscover volume on a remote host."""
-        iscsi_name, iscsi_portal = self._get_name_and_portal(volume)
-        self._execute("sudo iscsiadm -m node -T %s -p %s --op update "
-                      "-n node.startup -v manual" %
-                      (iscsi_name, iscsi_portal))
-        self._execute("sudo iscsiadm -m node -T %s -p %s --logout " %
-                      (iscsi_name, iscsi_portal))
-        self._execute("sudo iscsiadm -m node --op delete "
-                      "--targetname %s" % iscsi_name)
+        iscsi_properties = self._get_iscsi_properties(volume)
+        self._iscsiadm_update(iscsi_properties, "node.startup", "manual")
+        self._run_iscsiadm(iscsi_properties, "--logout")
+        self._run_iscsiadm(iscsi_properties, "--op delete")
+
+    def check_for_export(self, context, volume_id):
+        """Make sure volume is exported."""
+
+        tid = self.db.volume_get_iscsi_target_num(context, volume_id)
+        try:
+            self._execute("sudo ietadm --op show --tid=%(tid)d" % locals())
+        except exception.ProcessExecutionError, e:
+            # Instances remount read-only in this case.
+            # /etc/init.d/iscsitarget restart and rebooting nova-volume
+            # is better since ensure_export() works at boot time.
+            logging.error(_("Cannot confirm exported volume "
+                            "id:%(volume_id)s.") % locals())
+            raise
 
 
 class FakeISCSIDriver(ISCSIDriver):
@@ -353,7 +533,7 @@ class RBDDriver(VolumeDriver):
 
     def check_for_setup_error(self):
         """Returns an error if prerequisites aren't met"""
-        (stdout, stderr) = self._execute("rados lspools")
+        (stdout, stderr) = self._execute('rados', 'lspools')
         pools = stdout.split("\n")
         if not FLAGS.rbd_pool in pools:
             raise exception.Error(_("rbd has no pool %s") %
@@ -365,16 +545,13 @@ class RBDDriver(VolumeDriver):
             size = 100
         else:
             size = int(volume['size']) * 1024
-        self._try_execute("rbd --pool %s --size %d create %s" %
-                          (FLAGS.rbd_pool,
-                           size,
-                           volume['name']))
+        self._try_execute('rbd', '--pool', FLAGS.rbd_pool,
+                          '--size', size, 'create', volume['name'])
 
     def delete_volume(self, volume):
         """Deletes a logical volume."""
-        self._try_execute("rbd --pool %s rm %s" %
-                          (FLAGS.rbd_pool,
-                           volume['name']))
+        self._try_execute('rbd', '--pool', FLAGS.rbd_pool,
+                          'rm', voluname['name'])
 
     def local_path(self, volume):
         """Returns the path of the rbd volume."""
@@ -409,7 +586,7 @@ class SheepdogDriver(VolumeDriver):
     def check_for_setup_error(self):
         """Returns an error if prerequisites aren't met"""
         try:
-            (out, err) = self._execute("collie cluster info")
+            (out, err) = self._execute('collie', 'cluster', 'info')
             if not out.startswith('running'):
                 raise exception.Error(_("Sheepdog is not working: %s") % out)
         except exception.ProcessExecutionError:
@@ -421,12 +598,13 @@ class SheepdogDriver(VolumeDriver):
             sizestr = '100M'
         else:
             sizestr = '%sG' % volume['size']
-        self._try_execute("qemu-img create sheepdog:%s %s" %
-                          (volume['name'], sizestr))
+        self._try_execute('qemu-img', 'create',
+                          "sheepdog:%s" % volume['name'],
+                          sizestr)
 
     def delete_volume(self, volume):
         """Deletes a logical volume"""
-        self._try_execute("collie vdi delete %s" % volume['name'])
+        self._try_execute('collie', 'vdi', 'delete', volume['name'])
 
     def local_path(self, volume):
         return "sheepdog:%s" % volume['name']
diff --git a/nova/volume/manager.py b/nova/volume/manager.py
index d2f02e4e0..9dea35b35 100644
--- a/nova/volume/manager.py
+++ b/nova/volume/manager.py
@@ -107,10 +107,14 @@ class VolumeManager(manager.Manager):
             vol_size = volume_ref['size']
             LOG.debug(_("volume %(vol_name)s: creating lv of"
                     " size %(vol_size)sG") % locals())
-            self.driver.create_volume(volume_ref)
+            model_update = self.driver.create_volume(volume_ref)
+            if model_update:
+                self.db.volume_update(context, volume_ref['id'], model_update)
 
             LOG.debug(_("volume %s: creating export"), volume_ref['name'])
-            self.driver.create_export(context, volume_ref)
+            model_update = self.driver.create_export(context, volume_ref)
+            if model_update:
+                self.db.volume_update(context, volume_ref['id'], model_update)
         except Exception:
             self.db.volume_update(context,
                                   volume_ref['id'], {'status': 'error'})
@@ -156,7 +160,7 @@ class VolumeManager(manager.Manager):
         if volume_ref['host'] == self.host and FLAGS.use_local_volumes:
             path = self.driver.local_path(volume_ref)
         else:
-            path = self.driver.discover_volume(volume_ref)
+            path = self.driver.discover_volume(context, volume_ref)
         return path
 
     def remove_compute_volume(self, context, volume_id):
@@ -167,3 +171,9 @@ class VolumeManager(manager.Manager):
             return True
         else:
             self.driver.undiscover_volume(volume_ref)
+
+    def check_for_export(self, context, instance_id):
+        """Make sure whether volume is exported."""
+        instance_ref = self.db.instance_get(context, instance_id)
+        for volume in instance_ref['volumes']:
+            self.driver.check_for_export(context, volume['id'])
diff --git a/nova/volume/san.py b/nova/volume/san.py
index 26d6125e7..9532c8116 100644
--- a/nova/volume/san.py
+++ b/nova/volume/san.py
@@ -16,13 +16,16 @@
 #    under the License.
 """
 Drivers for san-stored volumes.
+
 The unique thing about a SAN is that we don't expect that we can run the volume
- controller on the SAN hardware.  We expect to access it over SSH or some API.
+controller on the SAN hardware.  We expect to access it over SSH or some API.
 """
 
 import os
 import paramiko
 
+from xml.etree import ElementTree
+
 from nova import exception
 from nova import flags
 from nova import log as logging
@@ -41,37 +44,19 @@ flags.DEFINE_string('san_password', '',
                     'Password for SAN controller')
 flags.DEFINE_string('san_privatekey', '',
                     'Filename of private key to use for SSH authentication')
+flags.DEFINE_string('san_clustername', '',
+                    'Cluster name to use for creating volumes')
+flags.DEFINE_integer('san_ssh_port', 22,
+                    'SSH port to use with SAN')
 
 
 class SanISCSIDriver(ISCSIDriver):
     """ Base class for SAN-style storage volumes
-        (storage providers we access over SSH)"""
-    #Override because SAN ip != host ip
-    def _get_name_and_portal(self, volume):
-        """Gets iscsi name and portal from volume name and host."""
-        volume_name = volume['name']
-
-        # TODO(justinsb): store in volume, remerge with generic iSCSI code
-        host = FLAGS.san_ip
-
-        (out, _err) = self._execute("sudo iscsiadm -m discovery -t "
-                                    "sendtargets -p %s" % host)
-
-        location = None
-        find_iscsi_name = self._build_iscsi_target_name(volume)
-        for target in out.splitlines():
-            if find_iscsi_name in target:
-                (location, _sep, iscsi_name) = target.partition(" ")
-                break
-        if not location:
-            raise exception.Error(_("Could not find iSCSI export "
-                                    " for volume %s") %
-                                  volume_name)
-
-        iscsi_portal = location.split(",")[0]
-        LOG.debug("iscsi_name=%s, iscsi_portal=%s" %
-                  (iscsi_name, iscsi_portal))
-        return (iscsi_name, iscsi_portal)
+
+    A SAN-style storage value is 'different' because the volume controller
+    probably won't run on it, so we need to access is over SSH or another
+    remote protocol.
+    """
 
     def _build_iscsi_target_name(self, volume):
         return "%s%s" % (FLAGS.iscsi_target_prefix, volume['name'])
@@ -85,6 +70,7 @@ class SanISCSIDriver(ISCSIDriver):
         ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
         if FLAGS.san_password:
             ssh.connect(FLAGS.san_ip,
+                        port=FLAGS.san_ssh_port,
                         username=FLAGS.san_login,
                         password=FLAGS.san_password)
         elif FLAGS.san_privatekey:
@@ -92,10 +78,11 @@ class SanISCSIDriver(ISCSIDriver):
             # It sucks that paramiko doesn't support DSA keys
             privatekey = paramiko.RSAKey.from_private_key_file(privatekeyfile)
             ssh.connect(FLAGS.san_ip,
+                        port=FLAGS.san_ssh_port,
                         username=FLAGS.san_login,
                         pkey=privatekey)
         else:
-            raise exception.Error("Specify san_password or san_privatekey")
+            raise exception.Error(_("Specify san_password or san_privatekey"))
         return ssh
 
     def _run_ssh(self, command, check_exit_code=True):
@@ -124,10 +111,10 @@ class SanISCSIDriver(ISCSIDriver):
     def check_for_setup_error(self):
         """Returns an error if prerequisites aren't met"""
         if not (FLAGS.san_password or FLAGS.san_privatekey):
-            raise exception.Error("Specify san_password or san_privatekey")
+            raise exception.Error(_("Specify san_password or san_privatekey"))
 
         if not (FLAGS.san_ip):
-            raise exception.Error("san_ip must be set")
+            raise exception.Error(_("san_ip must be set"))
 
 
 def _collect_lines(data):
@@ -155,17 +142,27 @@ def _get_prefixed_values(data, prefix):
 
 class SolarisISCSIDriver(SanISCSIDriver):
     """Executes commands relating to Solaris-hosted ISCSI volumes.
+
     Basic setup for a Solaris iSCSI server:
+
     pkg install storage-server SUNWiscsit
+
     svcadm enable stmf
+
     svcadm enable -r svc:/network/iscsi/target:default
+
     pfexec itadm create-tpg e1000g0 ${MYIP}
+
     pfexec itadm create-target -t e1000g0
 
+
     Then grant the user that will be logging on lots of permissions.
     I'm not sure exactly which though:
+
     zfs allow justinsb create,mount,destroy rpool
+
     usermod -P'File System Management' justinsb
+
     usermod -P'Primary Administrator' justinsb
 
     Also make sure you can login using san_login & san_password/san_privatekey
@@ -306,6 +303,17 @@ class SolarisISCSIDriver(SanISCSIDriver):
             self._run_ssh("pfexec /usr/sbin/stmfadm add-view -t %s %s" %
                           (target_group_name, luid))
 
+        #TODO(justinsb): Is this always 1? Does it matter?
+        iscsi_portal_interface = '1'
+        iscsi_portal = FLAGS.san_ip + ":3260," + iscsi_portal_interface
+
+        db_update = {}
+        db_update['provider_location'] = ("%s %s" %
+                                          (iscsi_portal,
+                                           iscsi_name))
+
+        return db_update
+
     def remove_export(self, context, volume):
         """Removes an export for a logical volume."""
 
@@ -333,3 +341,245 @@ class SolarisISCSIDriver(SanISCSIDriver):
         if self._is_lu_created(volume):
             self._run_ssh("pfexec /usr/sbin/sbdadm delete-lu %s" %
                           (luid))
+
+
+class HpSanISCSIDriver(SanISCSIDriver):
+    """Executes commands relating to HP/Lefthand SAN ISCSI volumes.
+
+    We use the CLIQ interface, over SSH.
+
+    Rough overview of CLIQ commands used:
+
+    :createVolume:    (creates the volume)
+
+    :getVolumeInfo:    (to discover the IQN etc)
+
+    :getClusterInfo:    (to discover the iSCSI target IP address)
+
+    :assignVolumeChap:    (exports it with CHAP security)
+
+    The 'trick' here is that the HP SAN enforces security by default, so
+    normally a volume mount would need both to configure the SAN in the volume
+    layer and do the mount on the compute layer.  Multi-layer operations are
+    not catered for at the moment in the nova architecture, so instead we
+    share the volume using CHAP at volume creation time.  Then the mount need
+    only use those CHAP credentials, so can take place exclusively in the
+    compute layer.
+    """
+
+    def _cliq_run(self, verb, cliq_args):
+        """Runs a CLIQ command over SSH, without doing any result parsing"""
+        cliq_arg_strings = []
+        for k, v in cliq_args.items():
+            cliq_arg_strings.append(" %s=%s" % (k, v))
+        cmd = verb + ''.join(cliq_arg_strings)
+
+        return self._run_ssh(cmd)
+
+    def _cliq_run_xml(self, verb, cliq_args, check_cliq_result=True):
+        """Runs a CLIQ command over SSH, parsing and checking the output"""
+        cliq_args['output'] = 'XML'
+        (out, _err) = self._cliq_run(verb, cliq_args)
+
+        LOG.debug(_("CLIQ command returned %s"), out)
+
+        result_xml = ElementTree.fromstring(out)
+        if check_cliq_result:
+            response_node = result_xml.find("response")
+            if response_node is None:
+                msg = (_("Malformed response to CLIQ command "
+                         "%(verb)s %(cliq_args)s. Result=%(out)s") %
+                       locals())
+                raise exception.Error(msg)
+
+            result_code = response_node.attrib.get("result")
+
+            if result_code != "0":
+                msg = (_("Error running CLIQ command %(verb)s %(cliq_args)s. "
+                         " Result=%(out)s") %
+                       locals())
+                raise exception.Error(msg)
+
+        return result_xml
+
+    def _cliq_get_cluster_info(self, cluster_name):
+        """Queries for info about the cluster (including IP)"""
+        cliq_args = {}
+        cliq_args['clusterName'] = cluster_name
+        cliq_args['searchDepth'] = '1'
+        cliq_args['verbose'] = '0'
+
+        result_xml = self._cliq_run_xml("getClusterInfo", cliq_args)
+
+        return result_xml
+
+    def _cliq_get_cluster_vip(self, cluster_name):
+        """Gets the IP on which a cluster shares iSCSI volumes"""
+        cluster_xml = self._cliq_get_cluster_info(cluster_name)
+
+        vips = []
+        for vip in cluster_xml.findall("response/cluster/vip"):
+            vips.append(vip.attrib.get('ipAddress'))
+
+        if len(vips) == 1:
+            return vips[0]
+
+        _xml = ElementTree.tostring(cluster_xml)
+        msg = (_("Unexpected number of virtual ips for cluster "
+                 " %(cluster_name)s. Result=%(_xml)s") %
+               locals())
+        raise exception.Error(msg)
+
+    def _cliq_get_volume_info(self, volume_name):
+        """Gets the volume info, including IQN"""
+        cliq_args = {}
+        cliq_args['volumeName'] = volume_name
+        result_xml = self._cliq_run_xml("getVolumeInfo", cliq_args)
+
+        # Result looks like this:
+        #<gauche version="1.0">
+        #  <response description="Operation succeeded." name="CliqSuccess"
+        #            processingTime="87" result="0">
+        #    <volume autogrowPages="4" availability="online" blockSize="1024"
+        #       bytesWritten="0" checkSum="false" clusterName="Cluster01"
+        #       created="2011-02-08T19:56:53Z" deleting="false" description=""
+        #       groupName="Group01" initialQuota="536870912" isPrimary="true"
+        #       iscsiIqn="iqn.2003-10.com.lefthandnetworks:group01:25366:vol-b"
+        #       maxSize="6865387257856" md5="9fa5c8b2cca54b2948a63d833097e1ca"
+        #       minReplication="1" name="vol-b" parity="0" replication="2"
+        #       reserveQuota="536870912" scratchQuota="4194304"
+        #       serialNumber="9fa5c8b2cca54b2948a63d833097e1ca0000000000006316"
+        #       size="1073741824" stridePages="32" thinProvision="true">
+        #      <status description="OK" value="2"/>
+        #      <permission access="rw"
+        #            authGroup="api-34281B815713B78-(trimmed)51ADD4B7030853AA7"
+        #            chapName="chapusername" chapRequired="true" id="25369"
+        #            initiatorSecret="" iqn="" iscsiEnabled="true"
+        #            loadBalance="true" targetSecret="supersecret"/>
+        #    </volume>
+        #  </response>
+        #</gauche>
+
+        # Flatten the nodes into a dictionary; use prefixes to avoid collisions
+        volume_attributes = {}
+
+        volume_node = result_xml.find("response/volume")
+        for k, v in volume_node.attrib.items():
+            volume_attributes["volume." + k] = v
+
+        status_node = volume_node.find("status")
+        if not status_node is None:
+            for k, v in status_node.attrib.items():
+                volume_attributes["status." + k] = v
+
+        # We only consider the first permission node
+        permission_node = volume_node.find("permission")
+        if not permission_node is None:
+            for k, v in status_node.attrib.items():
+                volume_attributes["permission." + k] = v
+
+        LOG.debug(_("Volume info: %(volume_name)s => %(volume_attributes)s") %
+                  locals())
+        return volume_attributes
+
+    def create_volume(self, volume):
+        """Creates a volume."""
+        cliq_args = {}
+        cliq_args['clusterName'] = FLAGS.san_clustername
+        #TODO(justinsb): Should we default to inheriting thinProvision?
+        cliq_args['thinProvision'] = '1' if FLAGS.san_thin_provision else '0'
+        cliq_args['volumeName'] = volume['name']
+        if int(volume['size']) == 0:
+            cliq_args['size'] = '100MB'
+        else:
+            cliq_args['size'] = '%sGB' % volume['size']
+
+        self._cliq_run_xml("createVolume", cliq_args)
+
+        volume_info = self._cliq_get_volume_info(volume['name'])
+        cluster_name = volume_info['volume.clusterName']
+        iscsi_iqn = volume_info['volume.iscsiIqn']
+
+        #TODO(justinsb): Is this always 1? Does it matter?
+        cluster_interface = '1'
+
+        cluster_vip = self._cliq_get_cluster_vip(cluster_name)
+        iscsi_portal = cluster_vip + ":3260," + cluster_interface
+
+        model_update = {}
+        model_update['provider_location'] = ("%s %s" %
+                                             (iscsi_portal,
+                                              iscsi_iqn))
+
+        return model_update
+
+    def delete_volume(self, volume):
+        """Deletes a volume."""
+        cliq_args = {}
+        cliq_args['volumeName'] = volume['name']
+        cliq_args['prompt'] = 'false'  # Don't confirm
+
+        self._cliq_run_xml("deleteVolume", cliq_args)
+
+    def local_path(self, volume):
+        # TODO(justinsb): Is this needed here?
+        raise exception.Error(_("local_path not supported"))
+
+    def ensure_export(self, context, volume):
+        """Synchronously recreates an export for a logical volume."""
+        return self._do_export(context, volume, force_create=False)
+
+    def create_export(self, context, volume):
+        return self._do_export(context, volume, force_create=True)
+
+    def _do_export(self, context, volume, force_create):
+        """Supports ensure_export and create_export"""
+        volume_info = self._cliq_get_volume_info(volume['name'])
+
+        is_shared = 'permission.authGroup' in volume_info
+
+        model_update = {}
+
+        should_export = False
+
+        if force_create or not is_shared:
+            should_export = True
+            # Check that we have a project_id
+            project_id = volume['project_id']
+            if not project_id:
+                project_id = context.project_id
+
+            if project_id:
+                #TODO(justinsb): Use a real per-project password here
+                chap_username = 'proj_' + project_id
+                # HP/Lefthand requires that the password be >= 12 characters
+                chap_password = 'project_secret_' + project_id
+            else:
+                msg = (_("Could not determine project for volume %s, "
+                         "can't export") %
+                         (volume['name']))
+                if force_create:
+                    raise exception.Error(msg)
+                else:
+                    LOG.warn(msg)
+                    should_export = False
+
+        if should_export:
+            cliq_args = {}
+            cliq_args['volumeName'] = volume['name']
+            cliq_args['chapName'] = chap_username
+            cliq_args['targetSecret'] = chap_password
+
+            self._cliq_run_xml("assignVolumeChap", cliq_args)
+
+            model_update['provider_auth'] = ("CHAP %s %s" %
+                                             (chap_username, chap_password))
+
+        return model_update
+
+    def remove_export(self, context, volume):
+        """Removes an export for a logical volume."""
+        cliq_args = {}
+        cliq_args['volumeName'] = volume['name']
+
+        self._cliq_run_xml("unassignVolume", cliq_args)
diff --git a/nova/wsgi.py b/nova/wsgi.py
index e01cc1e1e..ba0819466 100644
--- a/nova/wsgi.py
+++ b/nova/wsgi.py
@@ -36,6 +36,7 @@ import webob.exc
 
 from paste import deploy
 
+from nova import exception
 from nova import flags
 from nova import log as logging
 from nova import utils
@@ -59,7 +60,6 @@ class Server(object):
     """Server class to manage multiple WSGI sockets and applications."""
 
     def __init__(self, threads=1000):
-        logging.basicConfig()
         self.pool = eventlet.GreenPool(threads)
 
     def start(self, application, port, host='0.0.0.0', backlog=128):
@@ -83,6 +83,35 @@ class Server(object):
                              log=WritableLogger(logger))
 
 
+class Request(webob.Request):
+
+    def best_match_content_type(self):
+        """
+        Determine the most acceptable content-type based on the
+        query extension then the Accept header
+        """
+
+        parts = self.path.rsplit(".", 1)
+
+        if len(parts) > 1:
+            format = parts[1]
+            if format in ["json", "xml"]:
+                return "application/{0}".format(parts[1])
+
+        ctypes = ["application/json", "application/xml"]
+        bm = self.accept.best_match(ctypes)
+
+        return bm or "application/json"
+
+    def get_content_type(self):
+        try:
+            ct = self.headers["Content-Type"]
+            assert ct in ("application/xml", "application/json")
+            return ct
+        except Exception:
+            raise webob.exc.HTTPBadRequest("Invalid content type")
+
+
 class Application(object):
     """Base WSGI application wrapper. Subclasses need to implement __call__."""
 
@@ -114,7 +143,7 @@ class Application(object):
     def __call__(self, environ, start_response):
         r"""Subclasses will probably want to implement __call__ like this:
 
-        @webob.dec.wsgify
+        @webob.dec.wsgify(RequestClass=Request)
         def __call__(self, req):
           # Any of the following objects work as responses:
 
@@ -200,7 +229,7 @@ class Middleware(Application):
         """Do whatever you'd like to the response."""
         return response
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=Request)
     def __call__(self, req):
         response = self.process_request(req)
         if response:
@@ -213,7 +242,7 @@ class Debug(Middleware):
     """Helper class that can be inserted into any WSGI application chain
     to get information about the request and response."""
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=Request)
     def __call__(self, req):
         print ("*" * 40) + " REQUEST ENVIRON"
         for key, value in req.environ.items():
@@ -277,7 +306,7 @@ class Router(object):
         self._router = routes.middleware.RoutesMiddleware(self._dispatch,
                                                           self.map)
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=Request)
     def __call__(self, req):
         """
         Route the incoming request to a controller based on self.map.
@@ -286,7 +315,7 @@ class Router(object):
         return self._router
 
     @staticmethod
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=Request)
     def _dispatch(req):
         """
         Called by self._router after matching the incoming request to a route
@@ -305,11 +334,11 @@ class Controller(object):
     WSGI app that reads routing information supplied by RoutesMiddleware
     and calls the requested action method upon itself.  All action methods
     must, in addition to their normal parameters, accept a 'req' argument
-    which is the incoming webob.Request.  They raise a webob.exc exception,
+    which is the incoming wsgi.Request.  They raise a webob.exc exception,
     or return a dict which will be serialized by requested content type.
     """
 
-    @webob.dec.wsgify
+    @webob.dec.wsgify(RequestClass=Request)
     def __call__(self, req):
         """
         Call the method specified in req.environ by RoutesMiddleware.
@@ -319,32 +348,45 @@ class Controller(object):
         method = getattr(self, action)
         del arg_dict['controller']
         del arg_dict['action']
+        if 'format' in arg_dict:
+            del arg_dict['format']
         arg_dict['req'] = req
         result = method(**arg_dict)
+
         if type(result) is dict:
-            return self._serialize(result, req)
+            content_type = req.best_match_content_type()
+            body = self._serialize(result, content_type)
+
+            response = webob.Response()
+            response.headers["Content-Type"] = content_type
+            response.body = body
+            return response
+
         else:
             return result
 
-    def _serialize(self, data, request):
+    def _serialize(self, data, content_type):
         """
-        Serialize the given dict to the response type requested in request.
+        Serialize the given dict to the provided content_type.
         Uses self._serialization_metadata if it exists, which is a dict mapping
         MIME types to information needed to serialize to that type.
         """
         _metadata = getattr(type(self), "_serialization_metadata", {})
-        serializer = Serializer(request.environ, _metadata)
-        return serializer.to_content_type(data)
+        serializer = Serializer(_metadata)
+        try:
+            return serializer.serialize(data, content_type)
+        except exception.InvalidContentType:
+            raise webob.exc.HTTPNotAcceptable()
 
-    def _deserialize(self, data, request):
+    def _deserialize(self, data, content_type):
         """
-        Deserialize the request body to the response type requested in request.
+        Deserialize the request body to the specefied content type.
         Uses self._serialization_metadata if it exists, which is a dict mapping
         MIME types to information needed to serialize to that type.
         """
         _metadata = getattr(type(self), "_serialization_metadata", {})
-        serializer = Serializer(request.environ, _metadata)
-        return serializer.deserialize(data)
+        serializer = Serializer(_metadata)
+        return serializer.deserialize(data, content_type)
 
 
 class Serializer(object):
@@ -352,50 +394,53 @@ class Serializer(object):
     Serializes and deserializes dictionaries to certain MIME types.
     """
 
-    def __init__(self, environ, metadata=None):
+    def __init__(self, metadata=None):
         """
         Create a serializer based on the given WSGI environment.
         'metadata' is an optional dict mapping MIME types to information
         needed to serialize a dictionary to that type.
         """
         self.metadata = metadata or {}
-        req = webob.Request.blank('', environ)
-        suffix = req.path_info.split('.')[-1].lower()
-        if suffix == 'json':
-            self.handler = self._to_json
-        elif suffix == 'xml':
-            self.handler = self._to_xml
-        elif 'application/json' in req.accept:
-            self.handler = self._to_json
-        elif 'application/xml' in req.accept:
-            self.handler = self._to_xml
-        else:
-            # This is the default
-            self.handler = self._to_json
 
-    def to_content_type(self, data):
-        """
-        Serialize a dictionary into a string.
+    def _get_serialize_handler(self, content_type):
+        handlers = {
+            "application/json": self._to_json,
+            "application/xml": self._to_xml,
+        }
+
+        try:
+            return handlers[content_type]
+        except Exception:
+            raise exception.InvalidContentType()
 
-        The format of the string will be decided based on the Content Type
-        requested in self.environ: by Accept: header, or by URL suffix.
+    def serialize(self, data, content_type):
         """
-        return self.handler(data)
+        Serialize a dictionary into a string of the specified content type.
+        """
+        return self._get_serialize_handler(content_type)(data)
 
-    def deserialize(self, datastring):
+    def deserialize(self, datastring, content_type):
         """
         Deserialize a string to a dictionary.
 
         The string must be in the format of a supported MIME type.
         """
-        datastring = datastring.strip()
+        return self.get_deserialize_handler(content_type)(datastring)
+
+    def get_deserialize_handler(self, content_type):
+        handlers = {
+            "application/json": self._from_json,
+            "application/xml": self._from_xml,
+        }
+
         try:
-            is_xml = (datastring[0] == '<')
-            if not is_xml:
-                return utils.loads(datastring)
-            return self._from_xml(datastring)
-        except:
-            return None
+            return handlers[content_type]
+        except Exception:
+            raise exception.InvalidContentType(_("Invalid content type %s"
+                                                 % content_type))
+
+    def _from_json(self, datastring):
+        return utils.loads(datastring)
 
     def _from_xml(self, datastring):
         xmldata = self.metadata.get('application/xml', {})
@@ -515,10 +560,3 @@ def load_paste_app(filename, appname):
     except LookupError:
         pass
     return app
-
-
-def paste_config_to_flags(config, mixins):
-    for k, v in mixins.iteritems():
-        value = config.get(k, v)
-        converted_value = FLAGS[k].parser.Parse(value)
-        setattr(FLAGS, k, converted_value)