Merge lp:~zulcss/ubuntu/precise/nova/trunk into lp:~ubuntu-cloud-archive/ubuntu/precise/nova/trunk

[Chuck Short]

nova g1

[James Page (james-page)]

Hi Chuck

LGTM; one thing I did notice is that on both precise and raring the test suite has errors, but the package still builds despite this - thoughts?

https://jenkins.qa.ubuntu.com/view/Openstack_Testing/view/Grizzly/job/raring_grizzly_nova_trunk/187/consoleFull
https://jenkins.qa.ubuntu.com/view/Openstack_Testing/view/Grizzly/job/precise_grizzly_nova_trunk/186/consoleFull

review: Approve

[James Page (james-page)]

Uploaded to staging

=== modified file '.mailmap'
--- .mailmap	2012-08-27 15:37:18 +0000
+++ .mailmap	2012-11-26 19:55:29 +0000
@@ -21,7 +21,7 @@
 <[e-mail]> <[e-mail]>
 <[e-mail]> <[e-mail]>
 <[e-mail]> <[e-mail]>
-<[e-mail]> <[e-mail]>
+<[e-mail]> <[e-mail]>
 <[e-mail]> <emellor@silver>
 <[e-mail]> <[e-mail]>
 <[e-mail]> <[e-mail]>
@@ -85,6 +85,7 @@
 Dan Wendlandt <[e-mail]> danwent <danwent@dan-xs3-cs>
 Dan Wendlandt <[e-mail]> [e-mail] <>
 Dan Wendlandt <[e-mail]> [e-mail] <[e-mail]>
+Édouard Thuleau <[e-mail]> Thuleau Édouard <[e-mail]>
 Jake Dahn <[e-mail]> jakedahn <[e-mail]>
 Jason Koelker <[e-mail]> Jason Kölker <[e-mail]>
 Jay Pipes <[e-mail]> [e-mail] <>
@@ -116,4 +117,3 @@
 Vishvananda Ishaya <[e-mail]> <root@ubuntu>
 Vivek YS <[e-mail]> Vivek YS [e-mail] <>
 Zhongyue Luo <[e-mail]> <[e-mail]>
-Édouard Thuleau <[e-mail]> Thuleau Édouard <[e-mail]>
 
=== removed directory '.pc'
=== removed file '.pc/.quilt_patches'
--- .pc/.quilt_patches	2012-07-06 10:18:33 +0000
+++ .pc/.quilt_patches	1970-01-01 00:00:00 +0000
@@ -1,1 +0,0 @@
-debian/patches
 
=== removed file '.pc/.quilt_series'
--- .pc/.quilt_series	2012-07-06 10:18:33 +0000
+++ .pc/.quilt_series	1970-01-01 00:00:00 +0000
@@ -1,1 +0,0 @@
-series
 
=== removed file '.pc/.version'
--- .pc/.version	2010-10-08 23:16:58 +0000
+++ .pc/.version	1970-01-01 00:00:00 +0000
@@ -1,1 +0,0 @@
-2
 
=== removed file '.pc/applied-patches'
--- .pc/applied-patches	2012-10-12 12:35:01 +0000
+++ .pc/applied-patches	1970-01-01 00:00:00 +0000
@@ -1,9 +0,0 @@
-path-to-the-xenhost.conf-fixup.patch
-fix-ubuntu-tests.patch
-fix-docs-build-without-network.patch
-avoid_setuptools_git_dependency.patch
-rbd-security.patch
-ubuntu/ubuntu-fix-32-64-bit-iss.patch
-ubuntu/ubuntu-fix-ec2-instance-id-mappings.patch
-ubuntu/fix-libvirt-firewall-slowdown.patch
-ubuntu/fix-ec2-volume-id-mappings.patch
 
=== removed directory '.pc/avoid_setuptools_git_dependency.patch'
=== removed directory '.pc/avoid_setuptools_git_dependency.patch/tools'
=== removed file '.pc/avoid_setuptools_git_dependency.patch/tools/pip-requires'
--- .pc/avoid_setuptools_git_dependency.patch/tools/pip-requires	2012-10-12 12:35:01 +0000
+++ .pc/avoid_setuptools_git_dependency.patch/tools/pip-requires	1970-01-01 00:00:00 +0000
@@ -1,23 +0,0 @@
-SQLAlchemy>=0.7.3
-Cheetah==2.4.4
-amqplib==0.6.1
-anyjson==0.2.4
-boto==2.1.1
-eventlet>=0.9.17
-kombu==1.0.4
-lxml>=2.3,<=2.3.5
-routes==1.12.3
-WebOb==1.0.8
-greenlet>=0.3.1
-PasteDeploy==1.5.0
-paste
-sqlalchemy-migrate>=0.7.2
-netaddr
-suds==0.4
-paramiko
-Babel>=0.9.6
-iso8601>=0.1.4
-httplib2
-setuptools_git>=0.4
-python-quantumclient>=2.0
-python-glanceclient>=0.5.0,<2
 
=== removed directory '.pc/fix-docs-build-without-network.patch'
=== removed directory '.pc/fix-docs-build-without-network.patch/doc'
=== removed directory '.pc/fix-docs-build-without-network.patch/doc/source'
=== removed file '.pc/fix-docs-build-without-network.patch/doc/source/conf.py'
--- .pc/fix-docs-build-without-network.patch/doc/source/conf.py	2012-09-20 07:45:50 +0000
+++ .pc/fix-docs-build-without-network.patch/doc/source/conf.py	1970-01-01 00:00:00 +0000
@@ -1,279 +0,0 @@
-# -*- coding: utf-8 -*-
-#
-# nova documentation build configuration file, created by
-# sphinx-quickstart on Sat May  1 15:17:47 2010.
-#
-# This file is execfile()d with the current directory set to
-# its containing dir.
-#
-# Note that not all possible configuration values are present in this
-# autogenerated file.
-#
-# All configuration values have a default; values that are commented out
-# serve to show the default.
-
-import sys
-import os
-
-# If extensions (or modules to document with autodoc) are in another directory,
-# add these directories to sys.path here. If the directory is relative to the
-# documentation root, use os.path.abspath to make it absolute, like shown here.
-sys.path.insert(0, os.path.abspath('../../'))
-sys.path.insert(0, os.path.abspath('../'))
-sys.path.insert(0, os.path.abspath('./'))
-
-# -- General configuration ----------------------------------------------------
-
-# Add any Sphinx extension module names here, as strings. They can be
-# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-
-extensions = ['sphinx.ext.autodoc',
-              'sphinx.ext.intersphinx',
-              'ext.nova_todo',
-              'sphinx.ext.coverage',
-              'sphinx.ext.pngmath',
-              'sphinx.ext.ifconfig',
-              'sphinx.ext.graphviz']
-
-todo_include_todos = True
-
-# Add any paths that contain templates here, relative to this directory.
-# Changing the path so that the Hudson build output contains GA code
-# and the source docs do not contain the code so local, offline sphinx builds
-# are "clean."
-templates_path = []
-if os.getenv('HUDSON_PUBLISH_DOCS'):
-    templates_path = ['_ga', '_templates']
-else:
-    templates_path = ['_templates']
-
-# The suffix of source filenames.
-source_suffix = '.rst'
-
-# The encoding of source files.
-#source_encoding = 'utf-8'
-
-# The master toctree document.
-master_doc = 'index'
-
-# General information about the project.
-project = u'nova'
-copyright = u'2010-present, OpenStack, LLC'
-
-# The version info for the project you're documenting, acts as replacement for
-# |version| and |release|, also used in various other places throughout the
-# built documents.
-#
-from nova import version as nova_version
-#import nova.version
-# The full version, including alpha/beta/rc tags.
-release = nova_version.version_string()
-# The short X.Y version.
-version = nova_version.canonical_version_string()
-
-# The language for content autogenerated by Sphinx. Refer to documentation
-# for a list of supported languages.
-#language = None
-
-# There are two options for replacing |today|: either, you set today to some
-# non-false value, then it is used:
-#today = ''
-# Else, today_fmt is used as the format for a strftime call.
-#today_fmt = '%B %d, %Y'
-
-# List of documents that shouldn't be included in the build.
-unused_docs = [
-    'api_ext/rst_extension_template',
-    'vmwareapi_readme',
-    'installer',
-]
-
-# List of directories, relative to source directory, that shouldn't be searched
-# for source files.
-exclude_trees = []
-
-# The reST default role (used for this markup: `text`) to use
-# for all documents.
-#default_role = None
-
-# If true, '()' will be appended to :func: etc. cross-reference text.
-#add_function_parentheses = True
-
-# If true, the current module name will be prepended to all description
-# unit titles (such as .. function::).
-add_module_names = False
-
-# If true, sectionauthor and moduleauthor directives will be shown in the
-# output. They are ignored by default.
-show_authors = False
-
-# The name of the Pygments (syntax highlighting) style to use.
-pygments_style = 'sphinx'
-
-# A list of ignored prefixes for module index sorting.
-modindex_common_prefix = ['nova.']
-
-# -- Options for man page output ----------------------------------------------
-
-# Grouping the document tree for man pages.
-# List of tuples 'sourcefile', 'target', u'title', u'Authors name', 'manual'
-
-man_pages = [
-    ('man/nova-all', 'nova-all', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-api-ec2', 'nova-api-ec2', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-api-metadata', 'nova-api-metadata', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-api-os-compute', 'nova-api-os-compute',
-     u'Cloud controller fabric', [u'OpenStack'], 1),
-    ('man/nova-api-os-volume', 'nova-api-os-volume',
-      u'Cloud controller fabric', [u'OpenStack'], 1),
-    ('man/nova-api', 'nova-api', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-cert', 'nova-cert', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-compute', 'nova-compute', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-console', 'nova-console', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-consoleauth', 'nova-consoleauth', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-dhcpbridge', 'nova-dhcpbridge', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-manage', 'nova-manage', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-network', 'nova-network', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-novncproxy', 'nova-novncproxy', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-objectstore', 'nova-objectstore', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-rootwrap', 'nova-rootwrap', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-rpc-zmq-receiver', 'nova-rpc-zmq-receiver', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-scheduler', 'nova-scheduler', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-volume-usage-audit', 'nova-volume-usage-audit', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-volume', 'nova-volume', u'Cloud controller fabric',
-     [u'OpenStack'], 1),
-    ('man/nova-xvpvncproxy', 'nova-xvpvncproxy', u'Cloud controller fabric',
-     [u'OpenStack'], 1)
-]
-
-# -- Options for HTML output --------------------------------------------------
-
-# The theme to use for HTML and HTML Help pages.  Major themes that come with
-# Sphinx are currently 'default' and 'sphinxdoc'.
-html_theme_path = ["."]
-html_theme = '_theme'
-
-# Theme options are theme-specific and customize the look and feel of a theme
-# further.  For a list of options available for each theme, see the
-# documentation.
-#html_theme_options = {}
-
-# Add any paths that contain custom themes here, relative to this directory.
-#html_theme_path = []
-
-# The name for this set of Sphinx documents.  If None, it defaults to
-# "<project> v<release> documentation".
-#html_title = None
-
-# A shorter title for the navigation bar.  Default is the same as html_title.
-#html_short_title = None
-
-# The name of an image file (relative to this directory) to place at the top
-# of the sidebar.
-#html_logo = None
-
-# The name of an image file (within the static path) to use as favicon of the
-# docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
-# pixels large.
-#html_favicon = None
-
-# Add any paths that contain custom static files (such as style sheets) here,
-# relative to this directory. They are copied after the builtin static files,
-# so a file named "default.css" will overwrite the builtin "default.css".
-html_static_path = ['_static']
-
-# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
-# using the given strftime format.
-#html_last_updated_fmt = '%b %d, %Y'
-git_cmd = "git log --pretty=format:'%ad, commit %h' --date=local -n1"
-html_last_updated_fmt = os.popen(git_cmd).read()
-
-# If true, SmartyPants will be used to convert quotes and dashes to
-# typographically correct entities.
-#html_use_smartypants = True
-
-# Custom sidebar templates, maps document names to template names.
-#html_sidebars = {}
-
-# Additional templates that should be rendered to pages, maps page names to
-# template names.
-#html_additional_pages = {}
-
-# If false, no module index is generated.
-#html_use_modindex = True
-
-# If false, no index is generated.
-#html_use_index = True
-
-# If true, the index is split into individual pages for each letter.
-#html_split_index = False
-
-# If true, links to the reST sources are added to the pages.
-#html_show_sourcelink = True
-
-# If true, an OpenSearch description file will be output, and all pages will
-# contain a <link> tag referring to it.  The value of this option must be the
-# base URL from which the finished HTML is served.
-#html_use_opensearch = ''
-
-# If nonempty, this is the file name suffix for HTML files (e.g. ".xhtml").
-#html_file_suffix = ''
-
-# Output file base name for HTML help builder.
-htmlhelp_basename = 'novadoc'
-
-
-# -- Options for LaTeX output -------------------------------------------------
-
-# The paper size ('letter' or 'a4').
-#latex_paper_size = 'letter'
-
-# The font size ('10pt', '11pt' or '12pt').
-#latex_font_size = '10pt'
-
-# Grouping the document tree into LaTeX files. List of tuples
-# (source start file, target name, title, author, documentclass
-# [howto/manual]).
-latex_documents = [
-    ('index', 'Nova.tex', u'Nova Documentation',
-     u'Anso Labs, LLC', 'manual'),
-]
-
-# The name of an image file (relative to this directory) to place at the top of
-# the title page.
-#latex_logo = None
-
-# For "manual" documents, if this is true, then toplevel headings are parts,
-# not chapters.
-#latex_use_parts = False
-
-# Additional stuff for the LaTeX preamble.
-#latex_preamble = ''
-
-# Documents to append as an appendix to all manuals.
-#latex_appendices = []
-
-# If false, no module index is generated.
-#latex_use_modindex = True
-
-
-# Example configuration for intersphinx: refer to the Python standard library.
-intersphinx_mapping = {'python': ('http://docs.python.org/', None),
-                       'swift': ('http://swift.openstack.org', None)}
 
=== removed directory '.pc/fix-ubuntu-tests.patch'
=== removed directory '.pc/fix-ubuntu-tests.patch/nova'
=== removed directory '.pc/fix-ubuntu-tests.patch/nova/tests'
=== removed file '.pc/fix-ubuntu-tests.patch/nova/tests/test_api.py'
--- .pc/fix-ubuntu-tests.patch/nova/tests/test_api.py	2012-08-16 14:04:11 +0000
+++ .pc/fix-ubuntu-tests.patch/nova/tests/test_api.py	1970-01-01 00:00:00 +0000
@@ -1,616 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-"""Unit tests for the API endpoint"""
-
-import random
-import StringIO
-
-import boto
-from boto.ec2 import regioninfo
-from boto import exception as boto_exc
-# newer versions of boto use their own wrapper on top of httplib.HTTPResponse
-try:
-    from boto.connection import HTTPResponse
-except ImportError:
-    from httplib import HTTPResponse
-import webob
-
-from nova.api import auth
-from nova.api import ec2
-from nova.api.ec2 import apirequest
-from nova.api.ec2 import ec2utils
-from nova import block_device
-from nova import context
-from nova import exception
-from nova import flags
-from nova.openstack.common import timeutils
-from nova import test
-
-
-FLAGS = flags.FLAGS
-
-
-class FakeHttplibSocket(object):
-    """a fake socket implementation for httplib.HTTPResponse, trivial"""
-    def __init__(self, response_string):
-        self.response_string = response_string
-        self._buffer = StringIO.StringIO(response_string)
-
-    def makefile(self, _mode, _other):
-        """Returns the socket's internal buffer"""
-        return self._buffer
-
-
-class FakeHttplibConnection(object):
-    """A fake httplib.HTTPConnection for boto to use
-
-    requests made via this connection actually get translated and routed into
-    our WSGI app, we then wait for the response and turn it back into
-    the HTTPResponse that boto expects.
-    """
-    def __init__(self, app, host, is_secure=False):
-        self.app = app
-        self.host = host
-
-    def request(self, method, path, data, headers):
-        req = webob.Request.blank(path)
-        req.method = method
-        req.body = data
-        req.headers = headers
-        req.headers['Accept'] = 'text/html'
-        req.host = self.host
-        # Call the WSGI app, get the HTTP response
-        resp = str(req.get_response(self.app))
-        # For some reason, the response doesn't have "HTTP/1.0 " prepended; I
-        # guess that's a function the web server usually provides.
-        resp = "HTTP/1.0 %s" % resp
-        self.sock = FakeHttplibSocket(resp)
-        self.http_response = HTTPResponse(self.sock)
-        # NOTE(vish): boto is accessing private variables for some reason
-        self._HTTPConnection__response = self.http_response
-        self.http_response.begin()
-
-    def getresponse(self):
-        return self.http_response
-
-    def getresponsebody(self):
-        return self.sock.response_string
-
-    def close(self):
-        """Required for compatibility with boto/tornado"""
-        pass
-
-
-class XmlConversionTestCase(test.TestCase):
-    """Unit test api xml conversion"""
-    def test_number_conversion(self):
-        conv = ec2utils._try_convert
-        self.assertEqual(conv('None'), None)
-        self.assertEqual(conv('True'), True)
-        self.assertEqual(conv('TRUE'), True)
-        self.assertEqual(conv('true'), True)
-        self.assertEqual(conv('False'), False)
-        self.assertEqual(conv('FALSE'), False)
-        self.assertEqual(conv('false'), False)
-        self.assertEqual(conv('0'), 0)
-        self.assertEqual(conv('42'), 42)
-        self.assertEqual(conv('3.14'), 3.14)
-        self.assertEqual(conv('-57.12'), -57.12)
-        self.assertEqual(conv('0x57'), 0x57)
-        self.assertEqual(conv('-0x57'), -0x57)
-        self.assertEqual(conv('-'), '-')
-        self.assertEqual(conv('-0'), 0)
-        self.assertEqual(conv('0.0'), 0.0)
-        self.assertEqual(conv('1e-8'), 0.0)
-        self.assertEqual(conv('-1e-8'), 0.0)
-        self.assertEqual(conv('0xDD8G'), '0xDD8G')
-        self.assertEqual(conv('0XDD8G'), '0XDD8G')
-        self.assertEqual(conv('-stringy'), '-stringy')
-        self.assertEqual(conv('stringy'), 'stringy')
-        self.assertEqual(conv('add'), 'add')
-        self.assertEqual(conv('remove'), 'remove')
-        self.assertEqual(conv(''), '')
-
-
-class Ec2utilsTestCase(test.TestCase):
-    def test_ec2_id_to_id(self):
-        self.assertEqual(ec2utils.ec2_id_to_id('i-0000001e'), 30)
-        self.assertEqual(ec2utils.ec2_id_to_id('ami-1d'), 29)
-        self.assertEqual(ec2utils.ec2_id_to_id('snap-0000001c'), 28)
-        self.assertEqual(ec2utils.ec2_id_to_id('vol-0000001b'), 27)
-
-    def test_bad_ec2_id(self):
-        self.assertRaises(exception.InvalidEc2Id,
-                          ec2utils.ec2_id_to_id,
-                          'badone')
-
-    def test_id_to_ec2_id(self):
-        self.assertEqual(ec2utils.id_to_ec2_id(30), 'i-0000001e')
-        self.assertEqual(ec2utils.id_to_ec2_id(29, 'ami-%08x'), 'ami-0000001d')
-        self.assertEqual(ec2utils.id_to_ec2_snap_id(28), 'snap-0000001c')
-        self.assertEqual(ec2utils.id_to_ec2_vol_id(27), 'vol-0000001b')
-
-    def test_dict_from_dotted_str(self):
-        in_str = [('BlockDeviceMapping.1.DeviceName', '/dev/sda1'),
-                  ('BlockDeviceMapping.1.Ebs.SnapshotId', 'snap-0000001c'),
-                  ('BlockDeviceMapping.1.Ebs.VolumeSize', '80'),
-                  ('BlockDeviceMapping.1.Ebs.DeleteOnTermination', 'false'),
-                  ('BlockDeviceMapping.2.DeviceName', '/dev/sdc'),
-                  ('BlockDeviceMapping.2.VirtualName', 'ephemeral0')]
-        expected_dict = {
-            'block_device_mapping': {
-            '1': {'device_name': '/dev/sda1',
-                  'ebs': {'snapshot_id': 'snap-0000001c',
-                          'volume_size': 80,
-                          'delete_on_termination': False}},
-            '2': {'device_name': '/dev/sdc',
-                  'virtual_name': 'ephemeral0'}}}
-        out_dict = ec2utils.dict_from_dotted_str(in_str)
-
-        self.assertDictMatch(out_dict, expected_dict)
-
-    def test_properties_root_defice_name(self):
-        mappings = [{"device": "/dev/sda1", "virtual": "root"}]
-        properties0 = {'mappings': mappings}
-        properties1 = {'root_device_name': '/dev/sdb', 'mappings': mappings}
-
-        root_device_name = block_device.properties_root_device_name(
-            properties0)
-        self.assertEqual(root_device_name, '/dev/sda1')
-
-        root_device_name = block_device.properties_root_device_name(
-            properties1)
-        self.assertEqual(root_device_name, '/dev/sdb')
-
-    def test_mapping_prepend_dev(self):
-        mappings = [
-            {'virtual': 'ami',
-             'device': 'sda1'},
-            {'virtual': 'root',
-             'device': '/dev/sda1'},
-
-            {'virtual': 'swap',
-             'device': 'sdb1'},
-            {'virtual': 'swap',
-             'device': '/dev/sdb2'},
-
-            {'virtual': 'ephemeral0',
-            'device': 'sdc1'},
-            {'virtual': 'ephemeral1',
-             'device': '/dev/sdc1'}]
-        expected_result = [
-            {'virtual': 'ami',
-             'device': 'sda1'},
-            {'virtual': 'root',
-             'device': '/dev/sda1'},
-
-            {'virtual': 'swap',
-             'device': '/dev/sdb1'},
-            {'virtual': 'swap',
-             'device': '/dev/sdb2'},
-
-            {'virtual': 'ephemeral0',
-             'device': '/dev/sdc1'},
-            {'virtual': 'ephemeral1',
-             'device': '/dev/sdc1'}]
-        self.assertDictListMatch(block_device.mappings_prepend_dev(mappings),
-                                 expected_result)
-
-
-class ApiEc2TestCase(test.TestCase):
-    """Unit test for the cloud controller on an EC2 API"""
-    def setUp(self):
-        super(ApiEc2TestCase, self).setUp()
-        self.host = '127.0.0.1'
-        # NOTE(vish): skipping the Authorizer
-        roles = ['sysadmin', 'netadmin']
-        ctxt = context.RequestContext('fake', 'fake', roles=roles)
-        self.app = auth.InjectContext(ctxt, ec2.FaultWrapper(
-                ec2.RequestLogging(ec2.Requestify(ec2.Authorizer(ec2.Executor()
-                               ), 'nova.api.ec2.cloud.CloudController'))))
-
-    def expect_http(self, host=None, is_secure=False, api_version=None):
-        """Returns a new EC2 connection"""
-        self.ec2 = boto.connect_ec2(
-                aws_access_key_id='fake',
-                aws_secret_access_key='fake',
-                is_secure=False,
-                region=regioninfo.RegionInfo(None, 'test', self.host),
-                port=8773,
-                path='/services/Cloud')
-        if api_version:
-            self.ec2.APIVersion = api_version
-
-        self.mox.StubOutWithMock(self.ec2, 'new_http_connection')
-        self.http = FakeHttplibConnection(
-                self.app, '%s:8773' % (self.host), False)
-        # pylint: disable=E1103
-        if boto.Version >= '2':
-            self.ec2.new_http_connection(host or '%s:8773' % (self.host),
-                is_secure).AndReturn(self.http)
-        else:
-            self.ec2.new_http_connection(host, is_secure).AndReturn(self.http)
-        return self.http
-
-    def test_return_valid_isoformat(self):
-        """
-            Ensure that the ec2 api returns datetime in xs:dateTime
-            (which apparently isn't datetime.isoformat())
-            NOTE(ken-pepple): https://bugs.launchpad.net/nova/+bug/721297
-        """
-        conv = apirequest._database_to_isoformat
-        # sqlite database representation with microseconds
-        time_to_convert = timeutils.parse_strtime("2011-02-21 20:14:10.634276",
-                                                  "%Y-%m-%d %H:%M:%S.%f")
-        self.assertEqual(conv(time_to_convert), '2011-02-21T20:14:10.634Z')
-        # mysqlite database representation
-        time_to_convert = timeutils.parse_strtime("2011-02-21 19:56:18",
-                                                  "%Y-%m-%d %H:%M:%S")
-        self.assertEqual(conv(time_to_convert), '2011-02-21T19:56:18.000Z')
-
-    def test_xmlns_version_matches_request_version(self):
-        self.expect_http(api_version='2010-10-30')
-        self.mox.ReplayAll()
-
-        # Any request should be fine
-        self.ec2.get_all_instances()
-        self.assertTrue(self.ec2.APIVersion in self.http.getresponsebody(),
-                       'The version in the xmlns of the response does '
-                       'not match the API version given in the request.')
-
-    def test_describe_instances(self):
-        """Test that, after creating a user and a project, the describe
-        instances call to the API works properly"""
-        self.expect_http()
-        self.mox.ReplayAll()
-        self.assertEqual(self.ec2.get_all_instances(), [])
-
-    def test_terminate_invalid_instance(self):
-        """Attempt to terminate an invalid instance"""
-        self.expect_http()
-        self.mox.ReplayAll()
-        self.assertRaises(boto_exc.EC2ResponseError,
-                self.ec2.terminate_instances, "i-00000005")
-
-    def test_get_all_key_pairs(self):
-        """Test that, after creating a user and project and generating
-         a key pair, that the API call to list key pairs works properly"""
-        keyname = "".join(random.choice("sdiuisudfsdcnpaqwertasd")
-                          for x in range(random.randint(4, 8)))
-        self.expect_http()
-        self.mox.ReplayAll()
-        self.ec2.create_key_pair(keyname)
-        rv = self.ec2.get_all_key_pairs()
-        results = [k for k in rv if k.name == keyname]
-        self.assertEquals(len(results), 1)
-
-    def test_create_duplicate_key_pair(self):
-        """Test that, after successfully generating a keypair,
-        requesting a second keypair with the same name fails sanely"""
-        self.expect_http()
-        self.mox.ReplayAll()
-        self.ec2.create_key_pair('test')
-
-        try:
-            self.ec2.create_key_pair('test')
-        except boto_exc.EC2ResponseError, e:
-            if e.code == 'KeyPairExists':
-                pass
-            else:
-                self.fail("Unexpected EC2ResponseError: %s "
-                          "(expected KeyPairExists)" % e.code)
-        else:
-            self.fail('Exception not raised.')
-
-    def test_get_all_security_groups(self):
-        """Test that we can retrieve security groups"""
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        rv = self.ec2.get_all_security_groups()
-
-        self.assertEquals(len(rv), 1)
-        self.assertEquals(rv[0].name, 'default')
-
-    def test_create_delete_security_group(self):
-        """Test that we can create a security group"""
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd")
-                                      for x in range(random.randint(4, 8)))
-
-        self.ec2.create_security_group(security_group_name, 'test group')
-
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        rv = self.ec2.get_all_security_groups()
-        self.assertEquals(len(rv), 2)
-        self.assertTrue(security_group_name in [group.name for group in rv])
-
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        self.ec2.delete_security_group(security_group_name)
-
-    def test_group_name_valid_chars_security_group(self):
-        """ Test that we sanely handle invalid security group names.
-         EC2 API Spec states we should only accept alphanumeric characters,
-         spaces, dashes, and underscores. Amazon implementation
-         accepts more characters - so, [:print:] is ok. """
-
-        bad_strict_ec2 = "aa \t\x01\x02\x7f"
-        bad_amazon_ec2 = "aa #^% -=99"
-        test_raise = [
-            (True, bad_amazon_ec2, "test desc"),
-            (True, "test name", bad_amazon_ec2),
-            (False, bad_strict_ec2, "test desc"),
-        ]
-        for test in test_raise:
-            self.expect_http()
-            self.mox.ReplayAll()
-            FLAGS.ec2_strict_validation = test[0]
-            self.assertRaises(boto_exc.EC2ResponseError,
-                              self.ec2.create_security_group,
-                              test[1],
-                              test[2])
-        test_accept = [
-            (False, bad_amazon_ec2, "test desc"),
-            (False, "test name", bad_amazon_ec2),
-        ]
-        for test in test_accept:
-            self.expect_http()
-            self.mox.ReplayAll()
-            FLAGS.ec2_strict_validation = test[0]
-            self.ec2.create_security_group(test[1], test[2])
-            self.expect_http()
-            self.mox.ReplayAll()
-            self.ec2.delete_security_group(test[1])
-
-    def test_group_name_valid_length_security_group(self):
-        """Test that we sanely handle invalid security group names.
-         API Spec states that the length should not exceed 255 chars """
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        # Test block group_name > 255 chars
-        security_group_name = "".join(random.choice("poiuytrewqasdfghjklmnbvc")
-                                      for x in range(random.randint(256, 266)))
-
-        self.assertRaises(boto_exc.EC2ResponseError,
-                self.ec2.create_security_group,
-                security_group_name,
-                'test group')
-
-    def test_authorize_revoke_security_group_cidr(self):
-        """
-        Test that we can add and remove CIDR based rules
-        to a security group
-        """
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd")
-                                      for x in range(random.randint(4, 8)))
-
-        group = self.ec2.create_security_group(security_group_name,
-                                               'test group')
-
-        self.expect_http()
-        self.mox.ReplayAll()
-        group.connection = self.ec2
-
-        group.authorize('tcp', 80, 81, '0.0.0.0/0')
-        group.authorize('icmp', -1, -1, '0.0.0.0/0')
-        group.authorize('udp', 80, 81, '0.0.0.0/0')
-        group.authorize('tcp', 1, 65535, '0.0.0.0/0')
-        group.authorize('udp', 1, 65535, '0.0.0.0/0')
-        group.authorize('icmp', 1, 0, '0.0.0.0/0')
-        group.authorize('icmp', 0, 1, '0.0.0.0/0')
-        group.authorize('icmp', 0, 0, '0.0.0.0/0')
-
-        def _assert(message, *args):
-            try:
-                group.authorize(*args)
-            except boto_exc.EC2ResponseError as e:
-                self.assertEqual(e.status, 400, 'Expected status to be 400')
-                self.assertIn(message, e.error_message, e.error_message)
-            else:
-                raise self.failureException, 'EC2ResponseError not raised'
-
-        # Invalid CIDR address
-        _assert('Invalid CIDR', 'tcp', 80, 81, '0.0.0.0/0444')
-        # Missing ports
-        _assert('Not enough parameters', 'tcp', '0.0.0.0/0')
-        # from port cannot be greater than to port
-        _assert('Invalid port range', 'tcp', 100, 1, '0.0.0.0/0')
-        # For tcp, negative values are not allowed
-        _assert('Invalid port range', 'tcp', -1, 1, '0.0.0.0/0')
-        # For tcp, valid port range 1-65535
-        _assert('Invalid port range', 'tcp', 1, 65599, '0.0.0.0/0')
-        # Invalid Cidr for ICMP type
-        _assert('Invalid CIDR', 'icmp', -1, -1, '0.0.444.0/4')
-        # Invalid protocol
-        _assert('An unknown error has occurred', 'xyz', 1, 14, '0.0.0.0/0')
-        # Invalid port
-        _assert('An unknown error has occurred', 'tcp', " ", "81", '0.0.0.0/0')
-        # Invalid icmp port
-        _assert('An unknown error has occurred', 'icmp', " ", "81",
-                '0.0.0.0/0')
-        # Invalid CIDR Address
-        _assert('Invalid CIDR', 'icmp', -1, -1, '0.0.0.0')
-        # Invalid CIDR Address
-        _assert('Invalid CIDR', 'icmp', -1, -1, '0.0.0.0/')
-        # Invalid Cidr ports
-        _assert('Invalid port range', 'icmp', 1, 256, '0.0.0.0/0')
-
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        rv = self.ec2.get_all_security_groups()
-
-        group = [grp for grp in rv if grp.name == security_group_name][0]
-
-        self.assertEquals(len(group.rules), 8)
-        self.assertEquals(int(group.rules[0].from_port), 80)
-        self.assertEquals(int(group.rules[0].to_port), 81)
-        self.assertEquals(len(group.rules[0].grants), 1)
-        self.assertEquals(str(group.rules[0].grants[0]), '0.0.0.0/0')
-
-        self.expect_http()
-        self.mox.ReplayAll()
-        group.connection = self.ec2
-
-        group.revoke('tcp', 80, 81, '0.0.0.0/0')
-        group.revoke('icmp', -1, -1, '0.0.0.0/0')
-        group.revoke('udp', 80, 81, '0.0.0.0/0')
-        group.revoke('tcp', 1, 65535, '0.0.0.0/0')
-        group.revoke('udp', 1, 65535, '0.0.0.0/0')
-        group.revoke('icmp', 1, 0, '0.0.0.0/0')
-        group.revoke('icmp', 0, 1, '0.0.0.0/0')
-        group.revoke('icmp', 0, 0, '0.0.0.0/0')
-
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        self.ec2.delete_security_group(security_group_name)
-
-        self.expect_http()
-        self.mox.ReplayAll()
-        group.connection = self.ec2
-
-        rv = self.ec2.get_all_security_groups()
-
-        self.assertEqual(len(rv), 1)
-        self.assertEqual(rv[0].name, 'default')
-
-    def test_authorize_revoke_security_group_cidr_v6(self):
-        """
-        Test that we can add and remove CIDR based rules
-        to a security group for IPv6
-        """
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd")
-                                      for x in range(random.randint(4, 8)))
-
-        group = self.ec2.create_security_group(security_group_name,
-                                               'test group')
-
-        self.expect_http()
-        self.mox.ReplayAll()
-        group.connection = self.ec2
-
-        group.authorize('tcp', 80, 81, '::/0')
-
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        rv = self.ec2.get_all_security_groups()
-
-        group = [grp for grp in rv if grp.name == security_group_name][0]
-        self.assertEquals(len(group.rules), 1)
-        self.assertEquals(int(group.rules[0].from_port), 80)
-        self.assertEquals(int(group.rules[0].to_port), 81)
-        self.assertEquals(len(group.rules[0].grants), 1)
-        self.assertEquals(str(group.rules[0].grants[0]), '::/0')
-
-        self.expect_http()
-        self.mox.ReplayAll()
-        group.connection = self.ec2
-
-        group.revoke('tcp', 80, 81, '::/0')
-
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        self.ec2.delete_security_group(security_group_name)
-
-        self.expect_http()
-        self.mox.ReplayAll()
-        group.connection = self.ec2
-
-        rv = self.ec2.get_all_security_groups()
-
-        self.assertEqual(len(rv), 1)
-        self.assertEqual(rv[0].name, 'default')
-
-    def test_authorize_revoke_security_group_foreign_group(self):
-        """
-        Test that we can grant and revoke another security group access
-        to a security group
-        """
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        rand_string = 'sdiuisudfsdcnpaqwertasd'
-        security_group_name = "".join(random.choice(rand_string)
-                                      for x in range(random.randint(4, 8)))
-        other_security_group_name = "".join(random.choice(rand_string)
-                                      for x in range(random.randint(4, 8)))
-
-        group = self.ec2.create_security_group(security_group_name,
-                                               'test group')
-
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        other_group = self.ec2.create_security_group(other_security_group_name,
-                                                     'some other group')
-
-        self.expect_http()
-        self.mox.ReplayAll()
-        group.connection = self.ec2
-
-        group.authorize(src_group=other_group)
-
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        rv = self.ec2.get_all_security_groups()
-
-        # I don't bother checkng that we actually find it here,
-        # because the create/delete unit test further up should
-        # be good enough for that.
-        for group in rv:
-            if group.name == security_group_name:
-                self.assertEquals(len(group.rules), 3)
-                self.assertEquals(len(group.rules[0].grants), 1)
-                self.assertEquals(str(group.rules[0].grants[0]), '%s-%s' %
-                                  (other_security_group_name, 'fake'))
-
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        rv = self.ec2.get_all_security_groups()
-
-        for group in rv:
-            if group.name == security_group_name:
-                self.expect_http()
-                self.mox.ReplayAll()
-                group.connection = self.ec2
-                group.revoke(src_group=other_group)
-
-        self.expect_http()
-        self.mox.ReplayAll()
-
-        self.ec2.delete_security_group(security_group_name)
-        self.ec2.delete_security_group(other_security_group_name)
 
=== removed directory '.pc/path-to-the-xenhost.conf-fixup.patch'
=== removed directory '.pc/path-to-the-xenhost.conf-fixup.patch/plugins'
=== removed directory '.pc/path-to-the-xenhost.conf-fixup.patch/plugins/xenserver'
=== removed directory '.pc/path-to-the-xenhost.conf-fixup.patch/plugins/xenserver/xenapi'
=== removed directory '.pc/path-to-the-xenhost.conf-fixup.patch/plugins/xenserver/xenapi/etc'
=== removed directory '.pc/path-to-the-xenhost.conf-fixup.patch/plugins/xenserver/xenapi/etc/xapi.d'
=== removed directory '.pc/path-to-the-xenhost.conf-fixup.patch/plugins/xenserver/xenapi/etc/xapi.d/plugins'
=== removed file '.pc/path-to-the-xenhost.conf-fixup.patch/plugins/xenserver/xenapi/etc/xapi.d/plugins/xenhost'
--- .pc/path-to-the-xenhost.conf-fixup.patch/plugins/xenserver/xenapi/etc/xapi.d/plugins/xenhost	2012-08-16 14:04:11 +0000
+++ .pc/path-to-the-xenhost.conf-fixup.patch/plugins/xenserver/xenapi/etc/xapi.d/plugins/xenhost	1970-01-01 00:00:00 +0000
@@ -1,445 +0,0 @@
-#!/usr/bin/env python
-
-# Copyright 2011 OpenStack LLC.
-# Copyright 2011 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-#
-# XenAPI plugin for host operations
-#
-
-try:
-    import json
-except ImportError:
-    import simplejson as json
-import logging
-import os
-import random
-import re
-import subprocess
-import tempfile
-import time
-
-import XenAPI
-import XenAPIPlugin
-import pluginlib_nova as pluginlib
-
-
-pluginlib.configure_logging("xenhost")
-
-host_data_pattern = re.compile(r"\s*(\S+) \([^\)]+\) *: ?(.*)")
-config_file_path = "/usr/etc/xenhost.conf"
-DEFAULT_TRIES = 23
-DEFAULT_SLEEP = 10
-
-
-def jsonify(fnc):
-    def wrapper(*args, **kwargs):
-        return json.dumps(fnc(*args, **kwargs))
-    return wrapper
-
-
-class TimeoutError(StandardError):
-    pass
-
-
-def _run_command(cmd):
-    """Abstracts out the basics of issuing system commands. If the command
-    returns anything in stderr, a PluginError is raised with that information.
-    Otherwise, the output from stdout is returned.
-    """
-    pipe = subprocess.PIPE
-    proc = subprocess.Popen([cmd], shell=True, stdin=pipe, stdout=pipe,
-            stderr=pipe, close_fds=True)
-    proc.wait()
-    err = proc.stderr.read()
-    if err:
-        raise pluginlib.PluginError(err)
-    return proc.stdout.read()
-
-
-# NOTE (salvatore-orlando):
-# Instead of updating run_command a new method has been implemented,
-# in order to avoid risking breaking existing functions calling _run_command
-def _run_command_with_input(cmd, process_input):
-    """Abstracts out the basics of issuing system commands. If the command
-    returns anything in stderr, a PluginError is raised with that information.
-    Otherwise, the output from stdout is returned.
-
-    process_input specificies a variable to use as the process' standard input.
-    """
-    pipe = subprocess.PIPE
-    # cmd can be either a single string with command and arguments,
-    # or a sequence of string
-    if not hasattr(cmd, '__iter__'):
-        cmd = [cmd]  # make it iterable
-
-    #Note(salvatore-orlando): the shell argument has been set to False
-    proc = subprocess.Popen(cmd, shell=False, stdin=pipe, stdout=pipe,
-            stderr=pipe, close_fds=True)
-    if process_input is not None:
-        (output, err) = proc.communicate(process_input)
-    else:
-        (output, err) = proc.communicate()
-    if err:
-        raise pluginlib.PluginError(err)
-    # This is tantamount to proc.stdout.read()
-    return output
-
-
-def _resume_compute(session, compute_ref, compute_uuid):
-    """Resume compute node on slave host after pool join. This has to
-    happen regardless of the success or failure of the join operation."""
-    try:
-        # session is valid if the join operation has failed
-        session.xenapi.VM.start(compute_ref, False, True)
-    except XenAPI.Failure, e:
-        # if session is invalid, e.g. xapi has restarted, then the pool
-        # join has been successful, wait for xapi to become alive again
-        for c in xrange(0, DEFAULT_TRIES):
-            try:
-                _run_command("xe vm-start uuid=%s" % compute_uuid)
-                return
-            except pluginlib.PluginError, e:
-                logging.exception('Waited %d seconds for the slave to '
-                                  'become available.' % (c * DEFAULT_SLEEP))
-                time.sleep(DEFAULT_SLEEP)
-        raise pluginlib.PluginError('Unrecoverable error: the host has '
-                                    'not come back for more than %d seconds'
-                                    % (DEFAULT_SLEEP * (DEFAULT_TRIES + 1)))
-
-
-@jsonify
-def set_host_enabled(self, arg_dict):
-    """Sets this host's ability to accept new instances.
-    It will otherwise continue to operate normally.
-    """
-    enabled = arg_dict.get("enabled")
-    if enabled is None:
-        raise pluginlib.PluginError(
-                _("Missing 'enabled' argument to set_host_enabled"))
-
-    host_uuid = arg_dict['host_uuid']
-    if enabled == "true":
-        result = _run_command("xe host-enable uuid=%s" % host_uuid)
-    elif enabled == "false":
-        result = _run_command("xe host-disable uuid=%s" % host_uuid)
-    else:
-        raise pluginlib.PluginError(_("Illegal enabled status: %s") % enabled)
-    # Should be empty string
-    if result:
-        raise pluginlib.PluginError(result)
-    # Return the current enabled status
-    cmd = "xe host-param-list uuid=%s | grep enabled" % host_uuid
-    resp = _run_command(cmd)
-    # Response should be in the format: "enabled ( RO): true"
-    host_enabled = resp.strip().split()[-1]
-    if host_enabled == "true":
-        status = "enabled"
-    else:
-        status = "disabled"
-    return {"status": status}
-
-
-def _write_config_dict(dct):
-    conf_file = file(config_file_path, "w")
-    json.dump(dct, conf_file)
-    conf_file.close()
-
-
-def _get_config_dict():
-    """Returns a dict containing the key/values in the config file.
-    If the file doesn't exist, it is created, and an empty dict
-    is returned.
-    """
-    try:
-        conf_file = file(config_file_path)
-        config_dct = json.load(conf_file)
-        conf_file.close()
-    except IOError:
-        # File doesn't exist
-        config_dct = {}
-        # Create the file
-        _write_config_dict(config_dct)
-    return config_dct
-
-
-@jsonify
-def get_config(self, arg_dict):
-    """Return the value stored for the specified key, or None if no match."""
-    conf = _get_config_dict()
-    params = arg_dict["params"]
-    try:
-        dct = json.loads(params)
-    except Exception, e:
-        dct = params
-    key = dct["key"]
-    ret = conf.get(key)
-    if ret is None:
-        # Can't jsonify None
-        return "None"
-    return ret
-
-
-@jsonify
-def set_config(self, arg_dict):
-    """Write the specified key/value pair, overwriting any existing value."""
-    conf = _get_config_dict()
-    params = arg_dict["params"]
-    try:
-        dct = json.loads(params)
-    except Exception, e:
-        dct = params
-    key = dct["key"]
-    val = dct["value"]
-    if val is None:
-        # Delete the key, if present
-        conf.pop(key, None)
-    else:
-        conf.update({key: val})
-    _write_config_dict(conf)
-
-
-def iptables_config(session, args):
-    # command should be either save or restore
-    logging.debug("iptables_config:enter")
-    logging.debug("iptables_config: args=%s", args)
-    cmd_args = pluginlib.exists(args, 'cmd_args')
-    logging.debug("iptables_config: cmd_args=%s", cmd_args)
-    process_input = pluginlib.optional(args, 'process_input')
-    logging.debug("iptables_config: process_input=%s", process_input)
-    cmd = json.loads(cmd_args)
-    cmd = map(str, cmd)
-
-    # either execute iptable-save or iptables-restore
-    # command must be only one of these two
-    # process_input must be used only with iptables-restore
-    if len(cmd) > 0 and cmd[0] in ('iptables-save',
-                                   'iptables-restore',
-                                   'ip6tables-save',
-                                   'ip6tables-restore'):
-        result = _run_command_with_input(cmd, process_input)
-        ret_str = json.dumps(dict(out=result,
-                                  err=''))
-        logging.debug("iptables_config:exit")
-        return ret_str
-    else:
-    # else don't do anything and return an error
-        raise pluginlib.PluginError(_("Invalid iptables command"))
-
-
-def _power_action(action, arg_dict):
-    # Host must be disabled first
-    host_uuid = arg_dict['host_uuid']
-    result = _run_command("xe host-disable uuid=%s" % host_uuid)
-    if result:
-        raise pluginlib.PluginError(result)
-    # All running VMs must be shutdown
-    result = _run_command("xe vm-shutdown --multiple "
-                          "resident-on=%s" % host_uuid)
-    if result:
-        raise pluginlib.PluginError(result)
-    cmds = {"reboot": "xe host-reboot uuid=%s",
-            "startup": "xe host-power-on uuid=%s",
-            "shutdown": "xe host-shutdown uuid=%s"}
-    result = _run_command(cmds[action] % host_uuid)
-    # Should be empty string
-    if result:
-        raise pluginlib.PluginError(result)
-    return {"power_action": action}
-
-
-@jsonify
-def host_reboot(self, arg_dict):
-    """Reboots the host."""
-    return _power_action("reboot", arg_dict)
-
-
-@jsonify
-def host_shutdown(self, arg_dict):
-    """Reboots the host."""
-    return _power_action("shutdown", arg_dict)
-
-
-@jsonify
-def host_start(self, arg_dict):
-    """Starts the host. Currently not feasible, since the host
-    runs on the same machine as Xen.
-    """
-    return _power_action("startup", arg_dict)
-
-
-@jsonify
-def host_join(self, arg_dict):
-    """Join a remote host into a pool whose master is the host
-    where the plugin is called from. The following constraints apply:
-
-    - The host must have no VMs running, except nova-compute, which will be
-      shut down (and restarted upon pool-join) automatically,
-    - The host must have no shared storage currently set up,
-    - The host must have the same license of the master,
-    - The host must have the same supplemental packs as the master."""
-    session = XenAPI.Session(arg_dict.get("url"))
-    session.login_with_password(arg_dict.get("user"),
-                                arg_dict.get("password"))
-    compute_ref = session.xenapi.VM.get_by_uuid(arg_dict.get('compute_uuid'))
-    session.xenapi.VM.clean_shutdown(compute_ref)
-    try:
-        if arg_dict.get("force"):
-            session.xenapi.pool.join(arg_dict.get("master_addr"),
-                                     arg_dict.get("master_user"),
-                                     arg_dict.get("master_pass"))
-        else:
-            session.xenapi.pool.join_force(arg_dict.get("master_addr"),
-                                           arg_dict.get("master_user"),
-                                           arg_dict.get("master_pass"))
-    finally:
-        _resume_compute(session, compute_ref, arg_dict.get("compute_uuid"))
-
-
-@jsonify
-def host_data(self, arg_dict):
-    """Runs the commands on the xenstore host to return the current status
-    information.
-    """
-    host_uuid = arg_dict['host_uuid']
-    resp = _run_command("xe host-param-list uuid=%s" % host_uuid)
-    parsed_data = parse_response(resp)
-    # We have the raw dict of values. Extract those that we need,
-    # and convert the data types as needed.
-    ret_dict = cleanup(parsed_data)
-    # Add any config settings
-    config = _get_config_dict()
-    ret_dict.update(config)
-    return ret_dict
-
-
-def parse_response(resp):
-    data = {}
-    for ln in resp.splitlines():
-        if not ln:
-            continue
-        mtch = host_data_pattern.match(ln.strip())
-        try:
-            k, v = mtch.groups()
-            data[k] = v
-        except AttributeError:
-            # Not a valid line; skip it
-            continue
-    return data
-
-
-@jsonify
-def host_uptime(self, arg_dict):
-    """Returns the result of the uptime command on the xenhost."""
-    return {"uptime": _run_command('uptime')}
-
-
-def cleanup(dct):
-    """Take the raw KV pairs returned and translate them into the
-    appropriate types, discarding any we don't need.
-    """
-    def safe_int(val):
-        """Integer values will either be string versions of numbers,
-        or empty strings. Convert the latter to nulls.
-        """
-        try:
-            return int(val)
-        except ValueError:
-            return None
-
-    def strip_kv(ln):
-        return [val.strip() for val in ln.split(":", 1)]
-
-    out = {}
-
-#    sbs = dct.get("supported-bootloaders", "")
-#    out["host_supported-bootloaders"] = sbs.split("; ")
-#    out["host_suspend-image-sr-uuid"] = dct.get("suspend-image-sr-uuid", "")
-#    out["host_crash-dump-sr-uuid"] = dct.get("crash-dump-sr-uuid", "")
-#    out["host_local-cache-sr"] = dct.get("local-cache-sr", "")
-    out["enabled"] = dct.get("enabled", "true") == "true"
-    out["host_memory"] = omm = {}
-    omm["total"] = safe_int(dct.get("memory-total", ""))
-    omm["overhead"] = safe_int(dct.get("memory-overhead", ""))
-    omm["free"] = safe_int(dct.get("memory-free", ""))
-    omm["free-computed"] = safe_int(
-            dct.get("memory-free-computed", ""))
-
-#    out["host_API-version"] = avv = {}
-#    avv["vendor"] = dct.get("API-version-vendor", "")
-#    avv["major"] = safe_int(dct.get("API-version-major", ""))
-#    avv["minor"] = safe_int(dct.get("API-version-minor", ""))
-
-    out["enabled"] = dct.get("enabled", True)
-    out["host_uuid"] = dct.get("uuid", None)
-    out["host_name-label"] = dct.get("name-label", "")
-    out["host_name-description"] = dct.get("name-description", "")
-#    out["host_host-metrics-live"] = dct.get(
-#            "host-metrics-live", "false") == "true"
-    out["host_hostname"] = dct.get("hostname", "")
-    out["host_ip_address"] = dct.get("address", "")
-    oc = dct.get("other-config", "")
-    out["host_other-config"] = ocd = {}
-    if oc:
-        for oc_fld in oc.split("; "):
-            ock, ocv = strip_kv(oc_fld)
-            ocd[ock] = ocv
-#    out["host_capabilities"] = dct.get("capabilities", "").split("; ")
-#    out["host_allowed-operations"] = dct.get(
-#            "allowed-operations", "").split("; ")
-#    lsrv = dct.get("license-server", "")
-#    out["host_license-server"] = ols = {}
-#    if lsrv:
-#        for lspart in lsrv.split("; "):
-#            lsk, lsv = lspart.split(": ")
-#            if lsk == "port":
-#                ols[lsk] = safe_int(lsv)
-#            else:
-#                ols[lsk] = lsv
-#    sv = dct.get("software-version", "")
-#    out["host_software-version"] = osv = {}
-#    if sv:
-#        for svln in sv.split("; "):
-#            svk, svv = strip_kv(svln)
-#            osv[svk] = svv
-    cpuinf = dct.get("cpu_info", "")
-    out["host_cpu_info"] = ocp = {}
-    if cpuinf:
-        for cpln in cpuinf.split("; "):
-            cpk, cpv = strip_kv(cpln)
-            if cpk in ("cpu_count", "family", "model", "stepping"):
-                ocp[cpk] = safe_int(cpv)
-            else:
-                ocp[cpk] = cpv
-#    out["host_edition"] = dct.get("edition", "")
-#    out["host_external-auth-service-name"] = dct.get(
-#            "external-auth-service-name", "")
-    return out
-
-
-if __name__ == "__main__":
-    XenAPIPlugin.dispatch(
-            {"host_data": host_data,
-            "set_host_enabled": set_host_enabled,
-            "host_shutdown": host_shutdown,
-            "host_reboot": host_reboot,
-            "host_start": host_start,
-            "host_join": host_join,
-            "get_config": get_config,
-            "set_config": set_config,
-            "iptables_config": iptables_config,
-            "host_uptime": host_uptime})
 
=== removed directory '.pc/rbd-security.patch'
=== removed directory '.pc/rbd-security.patch/nova'
=== removed directory '.pc/rbd-security.patch/nova/virt'
=== removed directory '.pc/rbd-security.patch/nova/virt/libvirt'
=== removed file '.pc/rbd-security.patch/nova/virt/libvirt/volume.py'
--- .pc/rbd-security.patch/nova/virt/libvirt/volume.py	2012-10-12 12:35:01 +0000
+++ .pc/rbd-security.patch/nova/virt/libvirt/volume.py	1970-01-01 00:00:00 +0000
@@ -1,206 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2011 OpenStack LLC.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-"""Volume drivers for libvirt."""
-
-import os
-import time
-
-from nova import exception
-from nova import flags
-from nova.openstack.common import log as logging
-from nova import utils
-from nova.virt.libvirt import config
-from nova.virt.libvirt import utils as virtutils
-
-LOG = logging.getLogger(__name__)
-FLAGS = flags.FLAGS
-flags.DECLARE('num_iscsi_scan_tries', 'nova.volume.driver')
-
-
-class LibvirtVolumeDriver(object):
-    """Base class for volume drivers."""
-    def __init__(self, connection):
-        self.connection = connection
-
-    def connect_volume(self, connection_info, mount_device):
-        """Connect the volume. Returns xml for libvirt."""
-        conf = config.LibvirtConfigGuestDisk()
-        conf.source_type = "block"
-        conf.driver_name = virtutils.pick_disk_driver_name(is_block_dev=True)
-        conf.driver_format = "raw"
-        conf.driver_cache = "none"
-        conf.source_path = connection_info['data']['device_path']
-        conf.target_dev = mount_device
-        conf.target_bus = "virtio"
-        conf.serial = connection_info.get('serial')
-        return conf
-
-    def disconnect_volume(self, connection_info, mount_device):
-        """Disconnect the volume"""
-        pass
-
-
-class LibvirtFakeVolumeDriver(LibvirtVolumeDriver):
-    """Driver to attach Network volumes to libvirt."""
-
-    def connect_volume(self, connection_info, mount_device):
-        conf = config.LibvirtConfigGuestDisk()
-        conf.source_type = "network"
-        conf.driver_name = "qemu"
-        conf.driver_format = "raw"
-        conf.driver_cache = "none"
-        conf.source_protocol = "fake"
-        conf.source_host = "fake"
-        conf.target_dev = mount_device
-        conf.target_bus = "virtio"
-        conf.serial = connection_info.get('serial')
-        return conf
-
-
-class LibvirtNetVolumeDriver(LibvirtVolumeDriver):
-    """Driver to attach Network volumes to libvirt."""
-
-    def connect_volume(self, connection_info, mount_device):
-        conf = config.LibvirtConfigGuestDisk()
-        conf.source_type = "network"
-        conf.driver_name = virtutils.pick_disk_driver_name(is_block_dev=False)
-        conf.driver_format = "raw"
-        conf.driver_cache = "none"
-        conf.source_protocol = connection_info['driver_volume_type']
-        conf.source_host = connection_info['data']['name']
-        conf.target_dev = mount_device
-        conf.target_bus = "virtio"
-        conf.serial = connection_info.get('serial')
-        netdisk_properties = connection_info['data']
-        if netdisk_properties.get('auth_enabled'):
-            conf.auth_username = netdisk_properties['auth_username']
-            conf.auth_secret_type = netdisk_properties['secret_type']
-            conf.auth_secret_uuid = netdisk_properties['secret_uuid']
-        return conf
-
-
-class LibvirtISCSIVolumeDriver(LibvirtVolumeDriver):
-    """Driver to attach Network volumes to libvirt."""
-
-    def _run_iscsiadm(self, iscsi_properties, iscsi_command, **kwargs):
-        check_exit_code = kwargs.pop('check_exit_code', 0)
-        (out, err) = utils.execute('iscsiadm', '-m', 'node', '-T',
-                                   iscsi_properties['target_iqn'],
-                                   '-p', iscsi_properties['target_portal'],
-                                   *iscsi_command, run_as_root=True,
-                                   check_exit_code=check_exit_code)
-        LOG.debug("iscsiadm %s: stdout=%s stderr=%s" %
-                  (iscsi_command, out, err))
-        return (out, err)
-
-    def _iscsiadm_update(self, iscsi_properties, property_key, property_value,
-                         **kwargs):
-        iscsi_command = ('--op', 'update', '-n', property_key,
-                         '-v', property_value)
-        return self._run_iscsiadm(iscsi_properties, iscsi_command, **kwargs)
-
-    @utils.synchronized('connect_volume')
-    def connect_volume(self, connection_info, mount_device):
-        """Attach the volume to instance_name"""
-        iscsi_properties = connection_info['data']
-        # NOTE(vish): If we are on the same host as nova volume, the
-        #             discovery makes the target so we don't need to
-        #             run --op new. Therefore, we check to see if the
-        #             target exists, and if we get 255 (Not Found), then
-        #             we run --op new. This will also happen if another
-        #             volume is using the same target.
-        try:
-            self._run_iscsiadm(iscsi_properties, ())
-        except exception.ProcessExecutionError as exc:
-            # iscsiadm returns 21 for "No records found" after version 2.0-871
-            if exc.exit_code in [21, 255]:
-                self._run_iscsiadm(iscsi_properties, ('--op', 'new'))
-            else:
-                raise
-
-        if iscsi_properties.get('auth_method'):
-            self._iscsiadm_update(iscsi_properties,
-                                  "node.session.auth.authmethod",
-                                  iscsi_properties['auth_method'])
-            self._iscsiadm_update(iscsi_properties,
-                                  "node.session.auth.username",
-                                  iscsi_properties['auth_username'])
-            self._iscsiadm_update(iscsi_properties,
-                                  "node.session.auth.password",
-                                  iscsi_properties['auth_password'])
-
-        # NOTE(vish): If we have another lun on the same target, we may
-        #             have a duplicate login
-        self._run_iscsiadm(iscsi_properties, ("--login",),
-                           check_exit_code=[0, 255])
-
-        self._iscsiadm_update(iscsi_properties, "node.startup", "automatic")
-
-        host_device = ("/dev/disk/by-path/ip-%s-iscsi-%s-lun-%s" %
-                        (iscsi_properties['target_portal'],
-                         iscsi_properties['target_iqn'],
-                         iscsi_properties.get('target_lun', 0)))
-
-        # The /dev/disk/by-path/... node is not always present immediately
-        # TODO(justinsb): This retry-with-delay is a pattern, move to utils?
-        tries = 0
-        while not os.path.exists(host_device):
-            if tries >= FLAGS.num_iscsi_scan_tries:
-                raise exception.NovaException(_("iSCSI device not found at %s")
-                                              % (host_device))
-
-            LOG.warn(_("ISCSI volume not yet found at: %(mount_device)s. "
-                       "Will rescan & retry.  Try number: %(tries)s") %
-                     locals())
-
-            # The rescan isn't documented as being necessary(?), but it helps
-            self._run_iscsiadm(iscsi_properties, ("--rescan",))
-
-            tries = tries + 1
-            if not os.path.exists(host_device):
-                time.sleep(tries ** 2)
-
-        if tries != 0:
-            LOG.debug(_("Found iSCSI node %(mount_device)s "
-                        "(after %(tries)s rescans)") %
-                      locals())
-
-        connection_info['data']['device_path'] = host_device
-        sup = super(LibvirtISCSIVolumeDriver, self)
-        return sup.connect_volume(connection_info, mount_device)
-
-    @utils.synchronized('connect_volume')
-    def disconnect_volume(self, connection_info, mount_device):
-        """Detach the volume from instance_name"""
-        sup = super(LibvirtISCSIVolumeDriver, self)
-        sup.disconnect_volume(connection_info, mount_device)
-        iscsi_properties = connection_info['data']
-        # NOTE(vish): Only disconnect from the target if no luns from the
-        #             target are in use.
-        device_prefix = ("/dev/disk/by-path/ip-%s-iscsi-%s-lun-" %
-                         (iscsi_properties['target_portal'],
-                          iscsi_properties['target_iqn']))
-        devices = self.connection.get_all_block_devices()
-        devices = [dev for dev in devices if dev.startswith(device_prefix)]
-        if not devices:
-            self._iscsiadm_update(iscsi_properties, "node.startup", "manual",
-                                  check_exit_code=[0, 255])
-            self._run_iscsiadm(iscsi_properties, ("--logout",),
-                               check_exit_code=[0, 255])
-            self._run_iscsiadm(iscsi_properties, ('--op', 'delete'),
-                               check_exit_code=[0, 21, 255])
 
=== removed directory '.pc/ubuntu'
=== removed directory '.pc/ubuntu/fix-ec2-volume-id-mappings.patch'
=== removed directory '.pc/ubuntu/fix-ec2-volume-id-mappings.patch/nova'
=== removed directory '.pc/ubuntu/fix-ec2-volume-id-mappings.patch/nova/db'
=== removed directory '.pc/ubuntu/fix-ec2-volume-id-mappings.patch/nova/db/sqlalchemy'
=== removed file '.pc/ubuntu/fix-ec2-volume-id-mappings.patch/nova/db/sqlalchemy/api.py'
--- .pc/ubuntu/fix-ec2-volume-id-mappings.patch/nova/db/sqlalchemy/api.py	2012-10-12 12:35:01 +0000
+++ .pc/ubuntu/fix-ec2-volume-id-mappings.patch/nova/db/sqlalchemy/api.py	1970-01-01 00:00:00 +0000
@@ -1,5256 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright (c) 2011 X.commerce, a business unit of eBay Inc.
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-"""Implementation of SQLAlchemy backend."""
-
-import collections
-import copy
-import datetime
-import functools
-import warnings
-
-from nova import block_device
-from nova.common.sqlalchemyutils import paginate_query
-from nova.compute import vm_states
-from nova import db
-from nova.db.sqlalchemy import models
-from nova.db.sqlalchemy.session import get_session
-from nova import exception
-from nova import flags
-from nova.openstack.common import log as logging
-from nova.openstack.common import timeutils
-from nova import utils
-from sqlalchemy import and_
-from sqlalchemy.exc import IntegrityError
-from sqlalchemy import or_
-from sqlalchemy.orm import joinedload
-from sqlalchemy.orm import joinedload_all
-from sqlalchemy.sql.expression import asc
-from sqlalchemy.sql.expression import desc
-from sqlalchemy.sql.expression import literal_column
-from sqlalchemy.sql import func
-
-FLAGS = flags.FLAGS
-
-LOG = logging.getLogger(__name__)
-
-
-def is_admin_context(context):
-    """Indicates if the request context is an administrator."""
-    if not context:
-        warnings.warn(_('Use of empty request context is deprecated'),
-                      DeprecationWarning)
-        raise Exception('die')
-    return context.is_admin
-
-
-def is_user_context(context):
-    """Indicates if the request context is a normal user."""
-    if not context:
-        return False
-    if context.is_admin:
-        return False
-    if not context.user_id or not context.project_id:
-        return False
-    return True
-
-
-def authorize_project_context(context, project_id):
-    """Ensures a request has permission to access the given project."""
-    if is_user_context(context):
-        if not context.project_id:
-            raise exception.NotAuthorized()
-        elif context.project_id != project_id:
-            raise exception.NotAuthorized()
-
-
-def authorize_user_context(context, user_id):
-    """Ensures a request has permission to access the given user."""
-    if is_user_context(context):
-        if not context.user_id:
-            raise exception.NotAuthorized()
-        elif context.user_id != user_id:
-            raise exception.NotAuthorized()
-
-
-def authorize_quota_class_context(context, class_name):
-    """Ensures a request has permission to access the given quota class."""
-    if is_user_context(context):
-        if not context.quota_class:
-            raise exception.NotAuthorized()
-        elif context.quota_class != class_name:
-            raise exception.NotAuthorized()
-
-
-def require_admin_context(f):
-    """Decorator to require admin request context.
-
-    The first argument to the wrapped function must be the context.
-
-    """
-
-    def wrapper(*args, **kwargs):
-        if not is_admin_context(args[0]):
-            raise exception.AdminRequired()
-        return f(*args, **kwargs)
-    return wrapper
-
-
-def require_context(f):
-    """Decorator to require *any* user or admin context.
-
-    This does no authorization for user or project access matching, see
-    :py:func:`authorize_project_context` and
-    :py:func:`authorize_user_context`.
-
-    The first argument to the wrapped function must be the context.
-
-    """
-
-    def wrapper(*args, **kwargs):
-        if not is_admin_context(args[0]) and not is_user_context(args[0]):
-            raise exception.NotAuthorized()
-        return f(*args, **kwargs)
-    return wrapper
-
-
-def require_instance_exists(f):
-    """Decorator to require the specified instance to exist.
-
-    Requires the wrapped function to use context and instance_id as
-    their first two arguments.
-    """
-    @functools.wraps(f)
-    def wrapper(context, instance_id, *args, **kwargs):
-        db.instance_get(context, instance_id)
-        return f(context, instance_id, *args, **kwargs)
-
-    return wrapper
-
-
-def require_instance_exists_using_uuid(f):
-    """Decorator to require the specified instance to exist.
-
-    Requires the wrapped function to use context and instance_uuid as
-    their first two arguments.
-    """
-    @functools.wraps(f)
-    def wrapper(context, instance_uuid, *args, **kwargs):
-        db.instance_get_by_uuid(context, instance_uuid)
-        return f(context, instance_uuid, *args, **kwargs)
-
-    return wrapper
-
-
-def require_volume_exists(f):
-    """Decorator to require the specified volume to exist.
-
-    Requires the wrapped function to use context and volume_id as
-    their first two arguments.
-    """
-
-    def wrapper(context, volume_id, *args, **kwargs):
-        db.volume_get(context, volume_id)
-        return f(context, volume_id, *args, **kwargs)
-    wrapper.__name__ = f.__name__
-    return wrapper
-
-
-def require_aggregate_exists(f):
-    """Decorator to require the specified aggregate to exist.
-
-    Requires the wrapped function to use context and aggregate_id as
-    their first two arguments.
-    """
-
-    @functools.wraps(f)
-    def wrapper(context, aggregate_id, *args, **kwargs):
-        db.aggregate_get(context, aggregate_id)
-        return f(context, aggregate_id, *args, **kwargs)
-    return wrapper
-
-
-def model_query(context, model, *args, **kwargs):
-    """Query helper that accounts for context's `read_deleted` field.
-
-    :param context: context to query under
-    :param session: if present, the session to use
-    :param read_deleted: if present, overrides context's read_deleted field.
-    :param project_only: if present and context is user-type, then restrict
-            query to match the context's project_id. If set to 'allow_none',
-            restriction includes project_id = None.
-    """
-    session = kwargs.get('session') or get_session()
-    read_deleted = kwargs.get('read_deleted') or context.read_deleted
-    project_only = kwargs.get('project_only', False)
-
-    query = session.query(model, *args)
-
-    if read_deleted == 'no':
-        query = query.filter_by(deleted=False)
-    elif read_deleted == 'yes':
-        pass  # omit the filter to include deleted and active
-    elif read_deleted == 'only':
-        query = query.filter_by(deleted=True)
-    else:
-        raise Exception(
-                _("Unrecognized read_deleted value '%s'") % read_deleted)
-
-    if is_user_context(context) and project_only:
-        if project_only == 'allow_none':
-            query = query.filter(or_(model.project_id == context.project_id,
-                                     model.project_id == None))
-        else:
-            query = query.filter_by(project_id=context.project_id)
-
-    return query
-
-
-def exact_filter(query, model, filters, legal_keys):
-    """Applies exact match filtering to a query.
-
-    Returns the updated query.  Modifies filters argument to remove
-    filters consumed.
-
-    :param query: query to apply filters to
-    :param model: model object the query applies to, for IN-style
-                  filtering
-    :param filters: dictionary of filters; values that are lists,
-                    tuples, sets, or frozensets cause an 'IN' test to
-                    be performed, while exact matching ('==' operator)
-                    is used for other values
-    :param legal_keys: list of keys to apply exact filtering to
-    """
-
-    filter_dict = {}
-
-    # Walk through all the keys
-    for key in legal_keys:
-        # Skip ones we're not filtering on
-        if key not in filters:
-            continue
-
-        # OK, filtering on this key; what value do we search for?
-        value = filters.pop(key)
-
-        if key == 'metadata':
-            column_attr = getattr(model, key)
-            if isinstance(value, list):
-                for item in value:
-                    for k, v in item.iteritems():
-                        query = query.filter(column_attr.any(key=k))
-                        query = query.filter(column_attr.any(value=v))
-
-            else:
-                for k, v in value.iteritems():
-                    query = query.filter(column_attr.any(key=k))
-                    query = query.filter(column_attr.any(value=v))
-        elif isinstance(value, (list, tuple, set, frozenset)):
-            # Looking for values in a list; apply to query directly
-            column_attr = getattr(model, key)
-            query = query.filter(column_attr.in_(value))
-        else:
-            # OK, simple exact match; save for later
-            filter_dict[key] = value
-
-    # Apply simple exact matches
-    if filter_dict:
-        query = query.filter_by(**filter_dict)
-
-    return query
-
-
-###################
-
-
-def constraint(**conditions):
-    return Constraint(conditions)
-
-
-def equal_any(*values):
-    return EqualityCondition(values)
-
-
-def not_equal(*values):
-    return InequalityCondition(values)
-
-
-class Constraint(object):
-
-    def __init__(self, conditions):
-        self.conditions = conditions
-
-    def apply(self, model, query):
-        for key, condition in self.conditions.iteritems():
-            for clause in condition.clauses(getattr(model, key)):
-                query = query.filter(clause)
-        return query
-
-
-class EqualityCondition(object):
-
-    def __init__(self, values):
-        self.values = values
-
-    def clauses(self, field):
-        return or_([field == value for value in self.values])
-
-
-class InequalityCondition(object):
-
-    def __init__(self, values):
-        self.values = values
-
-    def clauses(self, field):
-        return [field != value for value in self.values]
-
-
-###################
-
-
-@require_admin_context
-def service_destroy(context, service_id):
-    session = get_session()
-    with session.begin():
-        service_ref = service_get(context, service_id, session=session)
-        service_ref.delete(session=session)
-
-        if service_ref.topic == 'compute' and service_ref.compute_node:
-            for c in service_ref.compute_node:
-                c.delete(session=session)
-
-
-@require_admin_context
-def service_get(context, service_id, session=None):
-    result = model_query(context, models.Service, session=session).\
-                     options(joinedload('compute_node')).\
-                     filter_by(id=service_id).\
-                     first()
-    if not result:
-        raise exception.ServiceNotFound(service_id=service_id)
-
-    return result
-
-
-@require_admin_context
-def service_get_all(context, disabled=None):
-    query = model_query(context, models.Service)
-
-    if disabled is not None:
-        query = query.filter_by(disabled=disabled)
-
-    return query.all()
-
-
-@require_admin_context
-def service_get_all_by_topic(context, topic):
-    return model_query(context, models.Service, read_deleted="no").\
-                filter_by(disabled=False).\
-                filter_by(topic=topic).\
-                all()
-
-
-@require_admin_context
-def service_get_by_host_and_topic(context, host, topic):
-    return model_query(context, models.Service, read_deleted="no").\
-                filter_by(disabled=False).\
-                filter_by(host=host).\
-                filter_by(topic=topic).\
-                first()
-
-
-@require_admin_context
-def service_get_all_by_host(context, host):
-    return model_query(context, models.Service, read_deleted="no").\
-                filter_by(host=host).\
-                all()
-
-
-@require_admin_context
-def service_get_all_compute_by_host(context, host):
-    result = model_query(context, models.Service, read_deleted="no").\
-                options(joinedload('compute_node')).\
-                filter_by(host=host).\
-                filter_by(topic="compute").\
-                all()
-
-    if not result:
-        raise exception.ComputeHostNotFound(host=host)
-
-    return result
-
-
-@require_admin_context
-def _service_get_all_topic_subquery(context, session, topic, subq, label):
-    sort_value = getattr(subq.c, label)
-    return model_query(context, models.Service,
-                       func.coalesce(sort_value, 0),
-                       session=session, read_deleted="no").\
-                filter_by(topic=topic).\
-                filter_by(disabled=False).\
-                outerjoin((subq, models.Service.host == subq.c.host)).\
-                order_by(sort_value).\
-                all()
-
-
-@require_admin_context
-def service_get_all_compute_sorted(context):
-    session = get_session()
-    with session.begin():
-        # NOTE(vish): The intended query is below
-        #             SELECT services.*, COALESCE(inst_cores.instance_cores,
-        #                                         0)
-        #             FROM services LEFT OUTER JOIN
-        #             (SELECT host, SUM(instances.vcpus) AS instance_cores
-        #              FROM instances GROUP BY host) AS inst_cores
-        #             ON services.host = inst_cores.host
-        topic = 'compute'
-        label = 'instance_cores'
-        subq = model_query(context, models.Instance.host,
-                           func.sum(models.Instance.vcpus).label(label),
-                           session=session, read_deleted="no").\
-                       group_by(models.Instance.host).\
-                       subquery()
-        return _service_get_all_topic_subquery(context,
-                                               session,
-                                               topic,
-                                               subq,
-                                               label)
-
-
-@require_admin_context
-def service_get_all_volume_sorted(context):
-    session = get_session()
-    with session.begin():
-        topic = 'volume'
-        label = 'volume_gigabytes'
-        subq = model_query(context, models.Volume.host,
-                           func.sum(models.Volume.size).label(label),
-                           session=session, read_deleted="no").\
-                       group_by(models.Volume.host).\
-                       subquery()
-        return _service_get_all_topic_subquery(context,
-                                               session,
-                                               topic,
-                                               subq,
-                                               label)
-
-
-@require_admin_context
-def service_get_by_args(context, host, binary):
-    result = model_query(context, models.Service).\
-                     filter_by(host=host).\
-                     filter_by(binary=binary).\
-                     first()
-
-    if not result:
-        raise exception.HostBinaryNotFound(host=host, binary=binary)
-
-    return result
-
-
-@require_admin_context
-def service_create(context, values):
-    service_ref = models.Service()
-    service_ref.update(values)
-    if not FLAGS.enable_new_services:
-        service_ref.disabled = True
-    service_ref.save()
-    return service_ref
-
-
-@require_admin_context
-def service_update(context, service_id, values):
-    session = get_session()
-    with session.begin():
-        service_ref = service_get(context, service_id, session=session)
-        service_ref.update(values)
-        service_ref.save(session=session)
-
-
-###################
-
-def compute_node_get(context, compute_id, session=None):
-    result = model_query(context, models.ComputeNode, session=session).\
-            filter_by(id=compute_id).\
-            options(joinedload('service')).\
-            options(joinedload('stats')).\
-            first()
-
-    if not result:
-        raise exception.ComputeHostNotFound(host=compute_id)
-
-    return result
-
-
-@require_admin_context
-def compute_node_get_all(context, session=None):
-    return model_query(context, models.ComputeNode, session=session).\
-            options(joinedload('service')).\
-            options(joinedload('stats')).\
-            all()
-
-
-@require_admin_context
-def compute_node_search_by_hypervisor(context, hypervisor_match):
-    field = models.ComputeNode.hypervisor_hostname
-    return model_query(context, models.ComputeNode).\
-            options(joinedload('service')).\
-            filter(field.like('%%%s%%' % hypervisor_match)).\
-            all()
-
-
-def _prep_stats_dict(values):
-    """Make list of ComputeNodeStats"""
-    stats = []
-    d = values.get('stats', {})
-    for k, v in d.iteritems():
-        stat = models.ComputeNodeStat()
-        stat['key'] = k
-        stat['value'] = v
-        stats.append(stat)
-    values['stats'] = stats
-
-
-@require_admin_context
-def compute_node_create(context, values, session=None):
-    """Creates a new ComputeNode and populates the capacity fields
-    with the most recent data."""
-    _prep_stats_dict(values)
-
-    if not session:
-        session = get_session()
-
-    with session.begin(subtransactions=True):
-        compute_node_ref = models.ComputeNode()
-        session.add(compute_node_ref)
-        compute_node_ref.update(values)
-    return compute_node_ref
-
-
-def _update_stats(context, new_stats, compute_id, session, prune_stats=False):
-
-    existing = model_query(context, models.ComputeNodeStat, session=session,
-            read_deleted="no").filter_by(compute_node_id=compute_id).all()
-    statmap = {}
-    for stat in existing:
-        key = stat['key']
-        statmap[key] = stat
-
-    stats = []
-    for k, v in new_stats.iteritems():
-        old_stat = statmap.pop(k, None)
-        if old_stat:
-            # update existing value:
-            old_stat.update({'value': v})
-            stats.append(old_stat)
-        else:
-            # add new stat:
-            stat = models.ComputeNodeStat()
-            stat['compute_node_id'] = compute_id
-            stat['key'] = k
-            stat['value'] = v
-            stats.append(stat)
-
-    if prune_stats:
-        # prune un-touched old stats:
-        for stat in statmap.values():
-            session.add(stat)
-            stat.update({'deleted': True})
-
-    # add new and updated stats
-    for stat in stats:
-        session.add(stat)
-
-
-@require_admin_context
-def compute_node_update(context, compute_id, values, prune_stats=False):
-    """Updates the ComputeNode record with the most recent data"""
-    stats = values.pop('stats', {})
-
-    session = get_session()
-    with session.begin(subtransactions=True):
-        _update_stats(context, stats, compute_id, session, prune_stats)
-        compute_ref = compute_node_get(context, compute_id, session=session)
-        compute_ref.update(values)
-    return compute_ref
-
-
-def compute_node_get_by_host(context, host):
-    """Get all capacity entries for the given host."""
-    session = get_session()
-    with session.begin():
-        node = session.query(models.ComputeNode).\
-                             join('service').\
-                             filter(models.Service.host == host).\
-                             filter_by(deleted=False)
-        return node.first()
-
-
-def compute_node_statistics(context):
-    """Compute statistics over all compute nodes."""
-    result = model_query(context,
-                         func.count(models.ComputeNode.id),
-                         func.sum(models.ComputeNode.vcpus),
-                         func.sum(models.ComputeNode.memory_mb),
-                         func.sum(models.ComputeNode.local_gb),
-                         func.sum(models.ComputeNode.vcpus_used),
-                         func.sum(models.ComputeNode.memory_mb_used),
-                         func.sum(models.ComputeNode.local_gb_used),
-                         func.sum(models.ComputeNode.free_ram_mb),
-                         func.sum(models.ComputeNode.free_disk_gb),
-                         func.sum(models.ComputeNode.current_workload),
-                         func.sum(models.ComputeNode.running_vms),
-                         func.sum(models.ComputeNode.disk_available_least),
-                         read_deleted="no").first()
-
-    # Build a dict of the info--making no assumptions about result
-    fields = ('count', 'vcpus', 'memory_mb', 'local_gb', 'vcpus_used',
-              'memory_mb_used', 'local_gb_used', 'free_ram_mb', 'free_disk_gb',
-              'current_workload', 'running_vms', 'disk_available_least')
-    return dict((field, int(result[idx] or 0))
-                for idx, field in enumerate(fields))
-
-
-###################
-
-
-@require_admin_context
-def certificate_get(context, certificate_id, session=None):
-    result = model_query(context, models.Certificate, session=session).\
-                     filter_by(id=certificate_id).\
-                     first()
-
-    if not result:
-        raise exception.CertificateNotFound(certificate_id=certificate_id)
-
-    return result
-
-
-@require_admin_context
-def certificate_create(context, values):
-    certificate_ref = models.Certificate()
-    for (key, value) in values.iteritems():
-        certificate_ref[key] = value
-    certificate_ref.save()
-    return certificate_ref
-
-
-@require_admin_context
-def certificate_get_all_by_project(context, project_id):
-    return model_query(context, models.Certificate, read_deleted="no").\
-                   filter_by(project_id=project_id).\
-                   all()
-
-
-@require_admin_context
-def certificate_get_all_by_user(context, user_id):
-    return model_query(context, models.Certificate, read_deleted="no").\
-                   filter_by(user_id=user_id).\
-                   all()
-
-
-@require_admin_context
-def certificate_get_all_by_user_and_project(context, user_id, project_id):
-    return model_query(context, models.Certificate, read_deleted="no").\
-                   filter_by(user_id=user_id).\
-                   filter_by(project_id=project_id).\
-                   all()
-
-
-###################
-
-
-@require_context
-def floating_ip_get(context, id):
-    result = model_query(context, models.FloatingIp, project_only=True).\
-                 filter_by(id=id).\
-                 first()
-
-    if not result:
-        raise exception.FloatingIpNotFound(id=id)
-
-    return result
-
-
-@require_context
-def floating_ip_get_pools(context):
-    pools = []
-    for result in model_query(context, models.FloatingIp.pool).distinct():
-        pools.append({'name': result[0]})
-    return pools
-
-
-@require_context
-def floating_ip_allocate_address(context, project_id, pool):
-    authorize_project_context(context, project_id)
-    session = get_session()
-    with session.begin():
-        floating_ip_ref = model_query(context, models.FloatingIp,
-                                      session=session, read_deleted="no").\
-                                  filter_by(fixed_ip_id=None).\
-                                  filter_by(project_id=None).\
-                                  filter_by(pool=pool).\
-                                  with_lockmode('update').\
-                                  first()
-        # NOTE(vish): if with_lockmode isn't supported, as in sqlite,
-        #             then this has concurrency issues
-        if not floating_ip_ref:
-            raise exception.NoMoreFloatingIps()
-        floating_ip_ref['project_id'] = project_id
-        session.add(floating_ip_ref)
-    return floating_ip_ref['address']
-
-
-@require_context
-def floating_ip_bulk_create(context, ips):
-    existing_ips = {}
-    for floating in _floating_ip_get_all(context).all():
-        existing_ips[floating['address']] = floating
-
-    session = get_session()
-    with session.begin():
-        for ip in ips:
-            addr = ip['address']
-            if (addr in existing_ips and
-                ip.get('id') != existing_ips[addr]['id']):
-                raise exception.FloatingIpExists(**dict(existing_ips[addr]))
-
-            model = models.FloatingIp()
-            model.update(ip)
-            session.add(model)
-
-
-def _ip_range_splitter(ips, block_size=256):
-    """Yields blocks of IPs no more than block_size elements long."""
-    out = []
-    count = 0
-    for ip in ips:
-        out.append(ip['address'])
-        count += 1
-
-        if count > block_size - 1:
-            yield out
-            out = []
-            count = 0
-
-    if out:
-        yield out
-
-
-@require_context
-def floating_ip_bulk_destroy(context, ips):
-    session = get_session()
-    with session.begin():
-        for ip_block in _ip_range_splitter(ips):
-            model_query(context, models.FloatingIp).\
-                filter(models.FloatingIp.address.in_(ip_block)).\
-                update({'deleted': True,
-                        'deleted_at': timeutils.utcnow()},
-                       synchronize_session='fetch')
-
-
-@require_context
-def floating_ip_create(context, values, session=None):
-    if not session:
-        session = get_session()
-
-    floating_ip_ref = models.FloatingIp()
-    floating_ip_ref.update(values)
-
-    # check uniqueness for not deleted addresses
-    if not floating_ip_ref.deleted:
-        try:
-            floating_ip = floating_ip_get_by_address(context,
-                                                     floating_ip_ref.address,
-                                                     session)
-        except exception.FloatingIpNotFoundForAddress:
-            pass
-        else:
-            if floating_ip.id != floating_ip_ref.id:
-                raise exception.FloatingIpExists(**dict(floating_ip_ref))
-
-    floating_ip_ref.save(session=session)
-    return floating_ip_ref['address']
-
-
-@require_context
-def floating_ip_count_by_project(context, project_id, session=None):
-    authorize_project_context(context, project_id)
-    # TODO(tr3buchet): why leave auto_assigned floating IPs out?
-    return model_query(context, models.FloatingIp, read_deleted="no",
-                       session=session).\
-                   filter_by(project_id=project_id).\
-                   filter_by(auto_assigned=False).\
-                   count()
-
-
-@require_context
-def floating_ip_fixed_ip_associate(context, floating_address,
-                                   fixed_address, host):
-    session = get_session()
-    with session.begin():
-        floating_ip_ref = floating_ip_get_by_address(context,
-                                                     floating_address,
-                                                     session=session)
-        fixed_ip_ref = fixed_ip_get_by_address(context,
-                                               fixed_address,
-                                               session=session)
-        floating_ip_ref.fixed_ip_id = fixed_ip_ref["id"]
-        floating_ip_ref.host = host
-        floating_ip_ref.save(session=session)
-
-
-@require_context
-def floating_ip_deallocate(context, address):
-    session = get_session()
-    with session.begin():
-        floating_ip_ref = floating_ip_get_by_address(context,
-                                                     address,
-                                                     session=session)
-        floating_ip_ref['project_id'] = None
-        floating_ip_ref['host'] = None
-        floating_ip_ref['auto_assigned'] = False
-        floating_ip_ref.save(session=session)
-
-
-@require_context
-def floating_ip_destroy(context, address):
-    session = get_session()
-    with session.begin():
-        floating_ip_ref = floating_ip_get_by_address(context,
-                                                     address,
-                                                     session=session)
-        floating_ip_ref.delete(session=session)
-
-
-@require_context
-def floating_ip_disassociate(context, address):
-    session = get_session()
-    with session.begin():
-        floating_ip_ref = floating_ip_get_by_address(context,
-                                                     address,
-                                                     session=session)
-        fixed_ip_ref = fixed_ip_get(context,
-                                    floating_ip_ref['fixed_ip_id'])
-        if fixed_ip_ref:
-            fixed_ip_address = fixed_ip_ref['address']
-        else:
-            fixed_ip_address = None
-        floating_ip_ref.fixed_ip_id = None
-        floating_ip_ref.host = None
-        floating_ip_ref.save(session=session)
-    return fixed_ip_address
-
-
-@require_context
-def floating_ip_set_auto_assigned(context, address):
-    session = get_session()
-    with session.begin():
-        floating_ip_ref = floating_ip_get_by_address(context,
-                                                     address,
-                                                     session=session)
-        floating_ip_ref.auto_assigned = True
-        floating_ip_ref.save(session=session)
-
-
-def _floating_ip_get_all(context, session=None):
-    return model_query(context, models.FloatingIp, read_deleted="no",
-                       session=session)
-
-
-@require_admin_context
-def floating_ip_get_all(context):
-    floating_ip_refs = _floating_ip_get_all(context).all()
-    if not floating_ip_refs:
-        raise exception.NoFloatingIpsDefined()
-    return floating_ip_refs
-
-
-@require_admin_context
-def floating_ip_get_all_by_host(context, host):
-    floating_ip_refs = _floating_ip_get_all(context).\
-                            filter_by(host=host).\
-                            all()
-    if not floating_ip_refs:
-        raise exception.FloatingIpNotFoundForHost(host=host)
-    return floating_ip_refs
-
-
-@require_context
-def floating_ip_get_all_by_project(context, project_id):
-    authorize_project_context(context, project_id)
-    # TODO(tr3buchet): why do we not want auto_assigned floating IPs here?
-    return _floating_ip_get_all(context).\
-                         filter_by(project_id=project_id).\
-                         filter_by(auto_assigned=False).\
-                         all()
-
-
-@require_context
-def floating_ip_get_by_address(context, address, session=None):
-    result = model_query(context, models.FloatingIp, session=session).\
-                filter_by(address=address).\
-                first()
-
-    if not result:
-        raise exception.FloatingIpNotFoundForAddress(address=address)
-
-    # If the floating IP has a project ID set, check to make sure
-    # the non-admin user has access.
-    if result.project_id and is_user_context(context):
-        authorize_project_context(context, result.project_id)
-
-    return result
-
-
-@require_context
-def floating_ip_get_by_fixed_address(context, fixed_address, session=None):
-    if not session:
-        session = get_session()
-
-    fixed_ip = fixed_ip_get_by_address(context, fixed_address, session)
-    fixed_ip_id = fixed_ip['id']
-
-    return model_query(context, models.FloatingIp, session=session).\
-                   filter_by(fixed_ip_id=fixed_ip_id).\
-                   all()
-
-    # NOTE(tr3buchet) please don't invent an exception here, empty list is fine
-
-
-@require_context
-def floating_ip_get_by_fixed_ip_id(context, fixed_ip_id, session=None):
-    if not session:
-        session = get_session()
-
-    return model_query(context, models.FloatingIp, session=session).\
-                   filter_by(fixed_ip_id=fixed_ip_id).\
-                   all()
-
-
-@require_context
-def floating_ip_update(context, address, values):
-    session = get_session()
-    with session.begin():
-        floating_ip_ref = floating_ip_get_by_address(context, address, session)
-        for (key, value) in values.iteritems():
-            floating_ip_ref[key] = value
-        floating_ip_ref.save(session=session)
-
-
-@require_context
-def _dnsdomain_get(context, session, fqdomain):
-    return model_query(context, models.DNSDomain,
-                       session=session, read_deleted="no").\
-               filter_by(domain=fqdomain).\
-               with_lockmode('update').\
-               first()
-
-
-@require_context
-def dnsdomain_get(context, fqdomain):
-    session = get_session()
-    with session.begin():
-        return _dnsdomain_get(context, session, fqdomain)
-
-
-@require_admin_context
-def _dnsdomain_get_or_create(context, session, fqdomain):
-    domain_ref = _dnsdomain_get(context, session, fqdomain)
-    if not domain_ref:
-        dns_ref = models.DNSDomain()
-        dns_ref.update({'domain': fqdomain,
-                        'availability_zone': None,
-                        'project_id': None})
-        return dns_ref
-
-    return domain_ref
-
-
-@require_admin_context
-def dnsdomain_register_for_zone(context, fqdomain, zone):
-    session = get_session()
-    with session.begin():
-        domain_ref = _dnsdomain_get_or_create(context, session, fqdomain)
-        domain_ref.scope = 'private'
-        domain_ref.availability_zone = zone
-        domain_ref.save(session=session)
-
-
-@require_admin_context
-def dnsdomain_register_for_project(context, fqdomain, project):
-    session = get_session()
-    with session.begin():
-        domain_ref = _dnsdomain_get_or_create(context, session, fqdomain)
-        domain_ref.scope = 'public'
-        domain_ref.project_id = project
-        domain_ref.save(session=session)
-
-
-@require_admin_context
-def dnsdomain_unregister(context, fqdomain):
-    session = get_session()
-    with session.begin():
-        session.query(models.DNSDomain).\
-                     filter_by(domain=fqdomain).\
-                     delete()
-
-
-@require_context
-def dnsdomain_list(context):
-    session = get_session()
-    records = model_query(context, models.DNSDomain,
-                  session=session, read_deleted="no").\
-                  all()
-    domains = []
-    for record in records:
-        domains.append(record.domain)
-
-    return domains
-
-
-###################
-
-
-@require_admin_context
-def fixed_ip_associate(context, address, instance_uuid, network_id=None,
-                       reserved=False):
-    """Keyword arguments:
-    reserved -- should be a boolean value(True or False), exact value will be
-    used to filter on the fixed ip address
-    """
-    if not utils.is_uuid_like(instance_uuid):
-        raise exception.InvalidUUID(uuid=instance_uuid)
-
-    session = get_session()
-    with session.begin():
-        network_or_none = or_(models.FixedIp.network_id == network_id,
-                              models.FixedIp.network_id == None)
-        fixed_ip_ref = model_query(context, models.FixedIp, session=session,
-                                   read_deleted="no").\
-                               filter(network_or_none).\
-                               filter_by(reserved=reserved).\
-                               filter_by(address=address).\
-                               with_lockmode('update').\
-                               first()
-        # NOTE(vish): if with_lockmode isn't supported, as in sqlite,
-        #             then this has concurrency issues
-        if fixed_ip_ref is None:
-            raise exception.FixedIpNotFoundForNetwork(address=address,
-                                            network_id=network_id)
-        if fixed_ip_ref.instance_uuid:
-            raise exception.FixedIpAlreadyInUse(address=address)
-
-        if not fixed_ip_ref.network_id:
-            fixed_ip_ref.network_id = network_id
-        fixed_ip_ref.instance_uuid = instance_uuid
-        session.add(fixed_ip_ref)
-    return fixed_ip_ref['address']
-
-
-@require_admin_context
-def fixed_ip_associate_pool(context, network_id, instance_uuid=None,
-                            host=None):
-    if instance_uuid and not utils.is_uuid_like(instance_uuid):
-        raise exception.InvalidUUID(uuid=instance_uuid)
-
-    session = get_session()
-    with session.begin():
-        network_or_none = or_(models.FixedIp.network_id == network_id,
-                              models.FixedIp.network_id == None)
-        fixed_ip_ref = model_query(context, models.FixedIp, session=session,
-                                   read_deleted="no").\
-                               filter(network_or_none).\
-                               filter_by(reserved=False).\
-                               filter_by(instance_uuid=None).\
-                               filter_by(host=None).\
-                               with_lockmode('update').\
-                               first()
-        # NOTE(vish): if with_lockmode isn't supported, as in sqlite,
-        #             then this has concurrency issues
-        if not fixed_ip_ref:
-            raise exception.NoMoreFixedIps()
-
-        if fixed_ip_ref['network_id'] is None:
-            fixed_ip_ref['network'] = network_id
-
-        if instance_uuid:
-            fixed_ip_ref['instance_uuid'] = instance_uuid
-
-        if host:
-            fixed_ip_ref['host'] = host
-        session.add(fixed_ip_ref)
-    return fixed_ip_ref['address']
-
-
-@require_context
-def fixed_ip_create(context, values):
-    fixed_ip_ref = models.FixedIp()
-    fixed_ip_ref.update(values)
-    fixed_ip_ref.save()
-    return fixed_ip_ref['address']
-
-
-@require_context
-def fixed_ip_bulk_create(context, ips):
-    session = get_session()
-    with session.begin():
-        for ip in ips:
-            model = models.FixedIp()
-            model.update(ip)
-            session.add(model)
-
-
-@require_context
-def fixed_ip_disassociate(context, address):
-    session = get_session()
-    with session.begin():
-        fixed_ip_ref = fixed_ip_get_by_address(context,
-                                               address,
-                                               session=session)
-        fixed_ip_ref['instance_uuid'] = None
-        fixed_ip_ref.save(session=session)
-
-
-@require_admin_context
-def fixed_ip_disassociate_all_by_timeout(context, host, time):
-    session = get_session()
-    # NOTE(vish): only update fixed ips that "belong" to this
-    #             host; i.e. the network host or the instance
-    #             host matches. Two queries necessary because
-    #             join with update doesn't work.
-    host_filter = or_(and_(models.Instance.host == host,
-                           models.Network.multi_host == True),
-                      models.Network.host == host)
-    result = session.query(models.FixedIp.id).\
-                     filter(models.FixedIp.deleted == False).\
-                     filter(models.FixedIp.allocated == False).\
-                     filter(models.FixedIp.updated_at < time).\
-                     join((models.Network,
-                           models.Network.id == models.FixedIp.network_id)).\
-                     join((models.Instance,
-                           models.Instance.uuid == \
-                               models.FixedIp.instance_uuid)).\
-                     filter(host_filter).\
-                     all()
-    fixed_ip_ids = [fip[0] for fip in result]
-    if not fixed_ip_ids:
-        return 0
-    result = model_query(context, models.FixedIp, session=session).\
-                     filter(models.FixedIp.id.in_(fixed_ip_ids)).\
-                     update({'instance_uuid': None,
-                             'leased': False,
-                             'updated_at': timeutils.utcnow()},
-                             synchronize_session='fetch')
-    return result
-
-
-@require_context
-def fixed_ip_get(context, id, session=None):
-    result = model_query(context, models.FixedIp, session=session).\
-                     filter_by(id=id).\
-                     first()
-    if not result:
-        raise exception.FixedIpNotFound(id=id)
-
-    # FIXME(sirp): shouldn't we just use project_only here to restrict the
-    # results?
-    if is_user_context(context) and result['instance_uuid'] is not None:
-        instance = instance_get_by_uuid(context.elevated(read_deleted='yes'),
-                                        result['instance_uuid'],
-                                        session)
-        authorize_project_context(context, instance.project_id)
-
-    return result
-
-
-@require_admin_context
-def fixed_ip_get_all(context, session=None):
-    result = model_query(context, models.FixedIp, session=session,
-                         read_deleted="yes").\
-                     all()
-    if not result:
-        raise exception.NoFixedIpsDefined()
-
-    return result
-
-
-@require_context
-def fixed_ip_get_by_address(context, address, session=None):
-    result = model_query(context, models.FixedIp, session=session).\
-                     filter_by(address=address).\
-                     first()
-    if not result:
-        raise exception.FixedIpNotFoundForAddress(address=address)
-
-    # NOTE(sirp): shouldn't we just use project_only here to restrict the
-    # results?
-    if is_user_context(context) and result['instance_uuid'] is not None:
-        instance = instance_get_by_uuid(context.elevated(read_deleted='yes'),
-                                        result['instance_uuid'],
-                                        session)
-        authorize_project_context(context, instance.project_id)
-
-    return result
-
-
-@require_context
-def fixed_ip_get_by_instance(context, instance_uuid):
-    if not utils.is_uuid_like(instance_uuid):
-        raise exception.InvalidUUID(uuid=instance_uuid)
-
-    result = model_query(context, models.FixedIp, read_deleted="no").\
-                 filter_by(instance_uuid=instance_uuid).\
-                 all()
-
-    if not result:
-        raise exception.FixedIpNotFoundForInstance(instance_uuid=instance_uuid)
-
-    return result
-
-
-@require_context
-def fixed_ip_get_by_network_host(context, network_id, host):
-    result = model_query(context, models.FixedIp, read_deleted="no").\
-                 filter_by(network_id=network_id).\
-                 filter_by(host=host).\
-                 first()
-
-    if not result:
-        raise exception.FixedIpNotFoundForNetworkHost(network_id=network_id,
-                                                      host=host)
-    return result
-
-
-@require_context
-def fixed_ips_by_virtual_interface(context, vif_id):
-    result = model_query(context, models.FixedIp, read_deleted="no").\
-                 filter_by(virtual_interface_id=vif_id).\
-                 all()
-
-    return result
-
-
-@require_admin_context
-def fixed_ip_get_network(context, address):
-    fixed_ip_ref = fixed_ip_get_by_address(context, address)
-    return fixed_ip_ref.network
-
-
-@require_context
-def fixed_ip_update(context, address, values):
-    session = get_session()
-    with session.begin():
-        fixed_ip_ref = fixed_ip_get_by_address(context,
-                                               address,
-                                               session=session)
-        fixed_ip_ref.update(values)
-        fixed_ip_ref.save(session=session)
-
-
-###################
-
-
-@require_context
-def virtual_interface_create(context, values):
-    """Create a new virtual interface record in the database.
-
-    :param values: = dict containing column values
-    """
-    try:
-        vif_ref = models.VirtualInterface()
-        vif_ref.update(values)
-        vif_ref.save()
-    except IntegrityError:
-        raise exception.VirtualInterfaceCreateException()
-
-    return vif_ref
-
-
-@require_context
-def _virtual_interface_query(context, session=None):
-    return model_query(context, models.VirtualInterface, session=session,
-                       read_deleted="yes")
-
-
-@require_context
-def virtual_interface_get(context, vif_id, session=None):
-    """Gets a virtual interface from the table.
-
-    :param vif_id: = id of the virtual interface
-    """
-    vif_ref = _virtual_interface_query(context, session=session).\
-                      filter_by(id=vif_id).\
-                      first()
-    return vif_ref
-
-
-@require_context
-def virtual_interface_get_by_address(context, address):
-    """Gets a virtual interface from the table.
-
-    :param address: = the address of the interface you're looking to get
-    """
-    vif_ref = _virtual_interface_query(context).\
-                      filter_by(address=address).\
-                      first()
-    return vif_ref
-
-
-@require_context
-def virtual_interface_get_by_uuid(context, vif_uuid):
-    """Gets a virtual interface from the table.
-
-    :param vif_uuid: the uuid of the interface you're looking to get
-    """
-    vif_ref = _virtual_interface_query(context).\
-                      filter_by(uuid=vif_uuid).\
-                      first()
-    return vif_ref
-
-
-@require_context
-@require_instance_exists_using_uuid
-def virtual_interface_get_by_instance(context, instance_uuid):
-    """Gets all virtual interfaces for instance.
-
-    :param instance_uuid: = uuid of the instance to retrieve vifs for
-    """
-    vif_refs = _virtual_interface_query(context).\
-                       filter_by(instance_uuid=instance_uuid).\
-                       all()
-    return vif_refs
-
-
-@require_context
-def virtual_interface_get_by_instance_and_network(context, instance_uuid,
-                                                  network_id):
-    """Gets virtual interface for instance that's associated with network."""
-    vif_ref = _virtual_interface_query(context).\
-                      filter_by(instance_uuid=instance_uuid).\
-                      filter_by(network_id=network_id).\
-                      first()
-    return vif_ref
-
-
-@require_context
-def virtual_interface_delete(context, vif_id):
-    """Delete virtual interface record from the database.
-
-    :param vif_id: = id of vif to delete
-    """
-    session = get_session()
-    vif_ref = virtual_interface_get(context, vif_id, session)
-    with session.begin():
-        session.delete(vif_ref)
-
-
-@require_context
-def virtual_interface_delete_by_instance(context, instance_uuid):
-    """Delete virtual interface records that are associated
-    with the instance given by instance_id.
-
-    :param instance_uuid: = uuid of instance
-    """
-    vif_refs = virtual_interface_get_by_instance(context, instance_uuid)
-    for vif_ref in vif_refs:
-        virtual_interface_delete(context, vif_ref['id'])
-
-
-@require_context
-def virtual_interface_get_all(context):
-    """Get all vifs"""
-    vif_refs = _virtual_interface_query(context).all()
-    return vif_refs
-
-
-###################
-
-
-def _metadata_refs(metadata_dict, meta_class):
-    metadata_refs = []
-    if metadata_dict:
-        for k, v in metadata_dict.iteritems():
-            metadata_ref = meta_class()
-            metadata_ref['key'] = k
-            metadata_ref['value'] = v
-            metadata_refs.append(metadata_ref)
-    return metadata_refs
-
-
-@require_context
-def instance_create(context, values):
-    """Create a new Instance record in the database.
-
-    context - request context object
-    values - dict containing column values.
-    """
-    values = values.copy()
-    values['metadata'] = _metadata_refs(
-            values.get('metadata'), models.InstanceMetadata)
-
-    values['system_metadata'] = _metadata_refs(
-            values.get('system_metadata'), models.InstanceSystemMetadata)
-
-    instance_ref = models.Instance()
-    if not values.get('uuid'):
-        values['uuid'] = str(utils.gen_uuid())
-    instance_ref['info_cache'] = models.InstanceInfoCache()
-    info_cache = values.pop('info_cache', None)
-    if info_cache is not None:
-        instance_ref['info_cache'].update(info_cache)
-    security_groups = values.pop('security_groups', [])
-    instance_ref.update(values)
-
-    def _get_sec_group_models(session, security_groups):
-        models = []
-        _existed, default_group = security_group_ensure_default(context,
-            session=session)
-        if 'default' in security_groups:
-            models.append(default_group)
-            # Generate a new list, so we don't modify the original
-            security_groups = [x for x in security_groups if x != 'default']
-        if security_groups:
-            models.extend(_security_group_get_by_names(context,
-                    session, context.project_id, security_groups))
-        return models
-
-    session = get_session()
-    with session.begin():
-        instance_ref.security_groups = _get_sec_group_models(session,
-                security_groups)
-        instance_ref.save(session=session)
-        # NOTE(comstud): This forces instance_type to be loaded so it
-        # exists in the ref when we return.  Fixes lazy loading issues.
-        instance_ref.instance_type
-
-    # create the instance uuid to ec2_id mapping entry for instance
-    ec2_instance_create(context, instance_ref['uuid'])
-
-    return instance_ref
-
-
-@require_admin_context
-def instance_data_get_for_project(context, project_id, session=None):
-    result = model_query(context,
-                         func.count(models.Instance.id),
-                         func.sum(models.Instance.vcpus),
-                         func.sum(models.Instance.memory_mb),
-                         read_deleted="no",
-                         session=session).\
-                     filter_by(project_id=project_id).\
-                     first()
-    # NOTE(vish): convert None to 0
-    return (result[0] or 0, result[1] or 0, result[2] or 0)
-
-
-@require_context
-def instance_destroy(context, instance_uuid, constraint=None):
-    session = get_session()
-    with session.begin():
-        if utils.is_uuid_like(instance_uuid):
-            instance_ref = instance_get_by_uuid(context, instance_uuid,
-                    session=session)
-        else:
-            raise exception.InvalidUUID(instance_uuid)
-
-        query = session.query(models.Instance).\
-                        filter_by(uuid=instance_ref['uuid'])
-        if constraint is not None:
-            query = constraint.apply(models.Instance, query)
-        count = query.update({'deleted': True,
-                              'deleted_at': timeutils.utcnow(),
-                              'updated_at': literal_column('updated_at')})
-        if count == 0:
-            raise exception.ConstraintNotMet()
-        session.query(models.SecurityGroupInstanceAssociation).\
-                filter_by(instance_uuid=instance_ref['uuid']).\
-                update({'deleted': True,
-                        'deleted_at': timeutils.utcnow(),
-                        'updated_at': literal_column('updated_at')})
-
-        instance_info_cache_delete(context, instance_ref['uuid'],
-                                   session=session)
-    return instance_ref
-
-
-@require_context
-def instance_get_by_uuid(context, uuid, session=None):
-    result = _build_instance_get(context, session=session).\
-                filter_by(uuid=uuid).\
-                first()
-
-    if not result:
-        raise exception.InstanceNotFound(instance_id=uuid)
-
-    return result
-
-
-@require_context
-def instance_get(context, instance_id, session=None):
-    result = _build_instance_get(context, session=session).\
-                filter_by(id=instance_id).\
-                first()
-
-    if not result:
-        raise exception.InstanceNotFound(instance_id=instance_id)
-
-    return result
-
-
-@require_context
-def _build_instance_get(context, session=None):
-    return model_query(context, models.Instance, session=session,
-                        project_only=True).\
-            options(joinedload_all('security_groups.rules')).\
-            options(joinedload('info_cache')).\
-            options(joinedload('metadata')).\
-            options(joinedload('instance_type'))
-
-
-@require_admin_context
-def instance_get_all(context, columns_to_join=None):
-    if columns_to_join is None:
-        columns_to_join = ['info_cache', 'security_groups',
-                           'metadata', 'instance_type']
-    query = model_query(context, models.Instance)
-    for column in columns_to_join:
-        query = query.options(joinedload(column))
-    return query.all()
-
-
-@require_context
-def instance_get_all_by_filters(context, filters, sort_key, sort_dir,
-                                limit=None, marker=None):
-    """Return instances that match all filters.  Deleted instances
-    will be returned by default, unless there's a filter that says
-    otherwise"""
-
-    sort_fn = {'desc': desc, 'asc': asc}
-
-    session = get_session()
-    query_prefix = session.query(models.Instance).\
-            options(joinedload('info_cache')).\
-            options(joinedload('security_groups')).\
-            options(joinedload('metadata')).\
-            options(joinedload('instance_type')).\
-            order_by(sort_fn[sort_dir](getattr(models.Instance, sort_key)))
-
-    # Make a copy of the filters dictionary to use going forward, as we'll
-    # be modifying it and we shouldn't affect the caller's use of it.
-    filters = filters.copy()
-
-    if 'changes-since' in filters:
-        changes_since = timeutils.normalize_time(filters['changes-since'])
-        query_prefix = query_prefix.\
-                            filter(models.Instance.updated_at > changes_since)
-
-    if 'deleted' in filters:
-        # Instances can be soft or hard deleted and the query needs to
-        # include or exclude both
-        if filters.pop('deleted'):
-            deleted = or_(models.Instance.deleted == True,
-                          models.Instance.vm_state == vm_states.SOFT_DELETED)
-            query_prefix = query_prefix.filter(deleted)
-        else:
-            query_prefix = query_prefix.\
-                    filter_by(deleted=False).\
-                    filter(models.Instance.vm_state != vm_states.SOFT_DELETED)
-
-    if not context.is_admin:
-        # If we're not admin context, add appropriate filter..
-        if context.project_id:
-            filters['project_id'] = context.project_id
-        else:
-            filters['user_id'] = context.user_id
-
-    # Filters for exact matches that we can do along with the SQL query...
-    # For other filters that don't match this, we will do regexp matching
-    exact_match_filter_names = ['project_id', 'user_id', 'image_ref',
-                                'vm_state', 'instance_type_id', 'uuid',
-                                'metadata']
-
-    # Filter the query
-    query_prefix = exact_filter(query_prefix, models.Instance,
-                                filters, exact_match_filter_names)
-
-    query_prefix = regex_filter(query_prefix, models.Instance, filters)
-
-    # paginate query
-    if marker is not None:
-        try:
-            marker = instance_get_by_uuid(context, marker, session=session)
-        except exception.InstanceNotFound as e:
-            raise exception.MarkerNotFound(marker)
-    query_prefix = paginate_query(query_prefix, models.Instance, limit,
-                           [sort_key, 'created_at', 'id'],
-                           marker=marker,
-                           sort_dir=sort_dir)
-
-    instances = query_prefix.all()
-    return instances
-
-
-def regex_filter(query, model, filters):
-    """Applies regular expression filtering to a query.
-
-    Returns the updated query.
-
-    :param query: query to apply filters to
-    :param model: model object the query applies to
-    :param filters: dictionary of filters with regex values
-    """
-
-    regexp_op_map = {
-        'postgresql': '~',
-        'mysql': 'REGEXP',
-        'oracle': 'REGEXP_LIKE',
-        'sqlite': 'REGEXP'
-    }
-    db_string = FLAGS.sql_connection.split(':')[0].split('+')[0]
-    db_regexp_op = regexp_op_map.get(db_string, 'LIKE')
-    for filter_name in filters.iterkeys():
-        try:
-            column_attr = getattr(model, filter_name)
-        except AttributeError:
-            continue
-        if 'property' == type(column_attr).__name__:
-            continue
-        query = query.filter(column_attr.op(db_regexp_op)(
-                                    str(filters[filter_name])))
-    return query
-
-
-@require_context
-def instance_get_active_by_window(context, begin, end=None,
-                                  project_id=None, host=None):
-    """Return instances that were active during window."""
-    session = get_session()
-    query = session.query(models.Instance)
-
-    query = query.filter(or_(models.Instance.terminated_at == None,
-                             models.Instance.terminated_at > begin))
-    if end:
-        query = query.filter(models.Instance.launched_at < end)
-    if project_id:
-        query = query.filter_by(project_id=project_id)
-    if host:
-        query = query.filter_by(host=host)
-
-    return query.all()
-
-
-@require_admin_context
-def instance_get_active_by_window_joined(context, begin, end=None,
-                                         project_id=None, host=None):
-    """Return instances and joins that were active during window."""
-    session = get_session()
-    query = session.query(models.Instance)
-
-    query = query.options(joinedload('info_cache')).\
-                  options(joinedload('security_groups')).\
-                  options(joinedload('metadata')).\
-                  options(joinedload('instance_type')).\
-                  filter(or_(models.Instance.terminated_at == None,
-                             models.Instance.terminated_at > begin))
-    if end:
-        query = query.filter(models.Instance.launched_at < end)
-    if project_id:
-        query = query.filter_by(project_id=project_id)
-    if host:
-        query = query.filter_by(host=host)
-
-    return query.all()
-
-
-@require_admin_context
-def _instance_get_all_query(context, project_only=False):
-    return model_query(context, models.Instance, project_only=project_only).\
-                   options(joinedload('info_cache')).\
-                   options(joinedload('security_groups')).\
-                   options(joinedload('metadata')).\
-                   options(joinedload('instance_type'))
-
-
-@require_admin_context
-def instance_get_all_by_host(context, host):
-    return _instance_get_all_query(context).filter_by(host=host).all()
-
-
-@require_admin_context
-def instance_get_all_by_host_and_not_type(context, host, type_id=None):
-    return _instance_get_all_query(context).filter_by(host=host).\
-                   filter(models.Instance.instance_type_id != type_id).all()
-
-
-@require_context
-def instance_get_all_by_project(context, project_id):
-    authorize_project_context(context, project_id)
-    return _instance_get_all_query(context).\
-                    filter_by(project_id=project_id).\
-                    all()
-
-
-@require_context
-def instance_get_all_by_reservation(context, reservation_id):
-    return _instance_get_all_query(context, project_only=True).\
-                    filter_by(reservation_id=reservation_id).\
-                    all()
-
-
-# NOTE(jkoelker) This is only being left here for compat with floating
-#                ips. Currently the network_api doesn't return floaters
-#                in network_info. Once it starts return the model. This
-#                function and its call in compute/manager.py on 1829 can
-#                go away
-@require_context
-def instance_get_floating_address(context, instance_id):
-    instance = instance_get(context, instance_id)
-    fixed_ips = fixed_ip_get_by_instance(context, instance['uuid'])
-
-    if not fixed_ips:
-        return None
-
-    # NOTE(tr3buchet): this only gets the first fixed_ip
-    # won't find floating ips associated with other fixed_ips
-    floating_ips = floating_ip_get_by_fixed_address(context,
-                                                    fixed_ips[0]['address'])
-    if not floating_ips:
-        return None
-    # NOTE(vish): this just returns the first floating ip
-    return floating_ips[0]['address']
-
-
-@require_admin_context
-def instance_get_all_hung_in_rebooting(context, reboot_window, session=None):
-    reboot_window = (timeutils.utcnow() -
-                     datetime.timedelta(seconds=reboot_window))
-
-    if not session:
-        session = get_session()
-
-    results = session.query(models.Instance).\
-            filter(models.Instance.updated_at <= reboot_window).\
-            filter_by(task_state="rebooting").all()
-
-    return results
-
-
-@require_context
-def instance_test_and_set(context, instance_uuid, attr, ok_states,
-                          new_state, session=None):
-    """Atomically check if an instance is in a valid state, and if it is, set
-    the instance into a new state.
-    """
-    if not session:
-        session = get_session()
-
-    with session.begin():
-        query = model_query(context, models.Instance, session=session,
-                            project_only=True)
-
-        if utils.is_uuid_like(instance_uuid):
-            query = query.filter_by(uuid=instance_uuid)
-        else:
-            raise exception.InvalidUUID(instance_uuid)
-
-        # NOTE(vish): if with_lockmode isn't supported, as in sqlite,
-        #             then this has concurrency issues
-        instance = query.with_lockmode('update').first()
-
-        state = instance[attr]
-        if state not in ok_states:
-            raise exception.InstanceInvalidState(
-                attr=attr,
-                instance_uuid=instance['uuid'],
-                state=state,
-                method='instance_test_and_set')
-
-        instance[attr] = new_state
-        instance.save(session=session)
-
-
-@require_context
-def instance_update(context, instance_uuid, values):
-    instance_ref = _instance_update(context, instance_uuid, values)[1]
-    return instance_ref
-
-
-@require_context
-def instance_update_and_get_original(context, instance_uuid, values):
-    """Set the given properties on an instance and update it. Return
-    a shallow copy of the original instance reference, as well as the
-    updated one.
-
-    :param context: = request context object
-    :param instance_uuid: = instance uuid
-    :param values: = dict containing column values
-
-    If "expected_task_state" exists in values, the update can only happen
-    when the task state before update matches expected_task_state. Otherwise
-    a UnexpectedTaskStateError is thrown.
-
-    :returns: a tuple of the form (old_instance_ref, new_instance_ref)
-
-    Raises NotFound if instance does not exist.
-    """
-    return _instance_update(context, instance_uuid, values,
-                            copy_old_instance=True)
-
-
-def _instance_update(context, instance_uuid, values, copy_old_instance=False):
-    session = get_session()
-
-    if not utils.is_uuid_like(instance_uuid):
-        raise exception.InvalidUUID(instance_uuid)
-
-    with session.begin():
-        instance_ref = instance_get_by_uuid(context, instance_uuid,
-                                            session=session)
-        if "expected_task_state" in values:
-            # it is not a db column so always pop out
-            expected = values.pop("expected_task_state")
-            if not isinstance(expected, (tuple, list, set)):
-                expected = (expected,)
-            actual_state = instance_ref["task_state"]
-            if actual_state not in expected:
-                raise exception.UnexpectedTaskStateError(actual=actual_state,
-                                                         expected=expected)
-
-        if copy_old_instance:
-            old_instance_ref = copy.copy(instance_ref)
-        else:
-            old_instance_ref = None
-
-        metadata = values.get('metadata')
-        if metadata is not None:
-            instance_metadata_update(context, instance_ref['uuid'],
-                                     values.pop('metadata'), True,
-                                     session=session)
-
-        system_metadata = values.get('system_metadata')
-        if system_metadata is not None:
-            instance_system_metadata_update(
-                 context, instance_ref['uuid'], values.pop('system_metadata'),
-                 delete=True, session=session)
-
-        instance_ref.update(values)
-        instance_ref.save(session=session)
-
-    return (old_instance_ref, instance_ref)
-
-
-def instance_add_security_group(context, instance_uuid, security_group_id):
-    """Associate the given security group with the given instance"""
-    session = get_session()
-    with session.begin():
-        instance_ref = instance_get_by_uuid(context, instance_uuid,
-                                            session=session)
-        security_group_ref = security_group_get(context,
-                                                security_group_id,
-                                                session=session)
-        instance_ref.security_groups += [security_group_ref]
-        instance_ref.save(session=session)
-
-
-@require_context
-def instance_remove_security_group(context, instance_uuid, security_group_id):
-    """Disassociate the given security group from the given instance"""
-    session = get_session()
-    instance_ref = instance_get_by_uuid(context, instance_uuid,
-                                        session=session)
-    session.query(models.SecurityGroupInstanceAssociation).\
-                filter_by(instance_uuid=instance_ref['uuid']).\
-                filter_by(security_group_id=security_group_id).\
-                update({'deleted': True,
-                        'deleted_at': timeutils.utcnow(),
-                        'updated_at': literal_column('updated_at')})
-
-
-###################
-
-
-@require_context
-def instance_info_cache_create(context, values):
-    """Create a new instance cache record in the table.
-
-    :param context: = request context object
-    :param values: = dict containing column values
-    """
-    info_cache = models.InstanceInfoCache()
-    info_cache.update(values)
-
-    session = get_session()
-    with session.begin():
-        info_cache.save(session=session)
-    return info_cache
-
-
-@require_context
-def instance_info_cache_get(context, instance_uuid, session=None):
-    """Gets an instance info cache from the table.
-
-    :param instance_uuid: = uuid of the info cache's instance
-    :param session: = optional session object
-    """
-    session = session or get_session()
-
-    info_cache = session.query(models.InstanceInfoCache).\
-                         filter_by(instance_uuid=instance_uuid).\
-                         first()
-    return info_cache
-
-
-@require_context
-def instance_info_cache_update(context, instance_uuid, values,
-                               session=None):
-    """Update an instance info cache record in the table.
-
-    :param instance_uuid: = uuid of info cache's instance
-    :param values: = dict containing column values to update
-    :param session: = optional session object
-    """
-    session = session or get_session()
-    info_cache = instance_info_cache_get(context, instance_uuid,
-                                         session=session)
-    if info_cache:
-        # NOTE(tr3buchet): let's leave it alone if it's already deleted
-        if info_cache['deleted']:
-            return info_cache
-
-        info_cache.update(values)
-        info_cache.save(session=session)
-    else:
-        # NOTE(tr3buchet): just in case someone blows away an instance's
-        #                  cache entry
-        values['instance_uuid'] = instance_uuid
-        info_cache = instance_info_cache_create(context, values)
-
-    return info_cache
-
-
-@require_context
-def instance_info_cache_delete(context, instance_uuid, session=None):
-    """Deletes an existing instance_info_cache record
-
-    :param instance_uuid: = uuid of the instance tied to the cache record
-    :param session: = optional session object
-    """
-    values = {'deleted': True,
-              'deleted_at': timeutils.utcnow()}
-    instance_info_cache_update(context, instance_uuid, values, session)
-
-
-###################
-
-
-@require_context
-def key_pair_create(context, values):
-    key_pair_ref = models.KeyPair()
-    key_pair_ref.update(values)
-    key_pair_ref.save()
-    return key_pair_ref
-
-
-@require_context
-def key_pair_destroy(context, user_id, name):
-    authorize_user_context(context, user_id)
-    session = get_session()
-    with session.begin():
-        key_pair_ref = key_pair_get(context, user_id, name, session=session)
-        key_pair_ref.delete(session=session)
-
-
-@require_context
-def key_pair_destroy_all_by_user(context, user_id):
-    authorize_user_context(context, user_id)
-    session = get_session()
-    with session.begin():
-        session.query(models.KeyPair).\
-                filter_by(user_id=user_id).\
-                update({'deleted': True,
-                        'deleted_at': timeutils.utcnow(),
-                        'updated_at': literal_column('updated_at')})
-
-
-@require_context
-def key_pair_get(context, user_id, name, session=None):
-    authorize_user_context(context, user_id)
-    result = model_query(context, models.KeyPair, session=session).\
-                     filter_by(user_id=user_id).\
-                     filter_by(name=name).\
-                     first()
-
-    if not result:
-        raise exception.KeypairNotFound(user_id=user_id, name=name)
-
-    return result
-
-
-@require_context
-def key_pair_get_all_by_user(context, user_id):
-    authorize_user_context(context, user_id)
-    return model_query(context, models.KeyPair, read_deleted="no").\
-                   filter_by(user_id=user_id).\
-                   all()
-
-
-def key_pair_count_by_user(context, user_id):
-    authorize_user_context(context, user_id)
-    return model_query(context, models.KeyPair, read_deleted="no").\
-                   filter_by(user_id=user_id).\
-                   count()
-
-
-###################
-
-
-@require_admin_context
-def network_associate(context, project_id, network_id=None, force=False):
-    """Associate a project with a network.
-
-    called by project_get_networks under certain conditions
-    and network manager add_network_to_project()
-
-    only associate if the project doesn't already have a network
-    or if force is True
-
-    force solves race condition where a fresh project has multiple instance
-    builds simultaneously picked up by multiple network hosts which attempt
-    to associate the project with multiple networks
-    force should only be used as a direct consequence of user request
-    all automated requests should not use force
-    """
-    session = get_session()
-    with session.begin():
-
-        def network_query(project_filter, id=None):
-            filter_kwargs = {'project_id': project_filter}
-            if id is not None:
-                filter_kwargs['id'] = id
-            return model_query(context, models.Network, session=session,
-                              read_deleted="no").\
-                           filter_by(**filter_kwargs).\
-                           with_lockmode('update').\
-                           first()
-
-        if not force:
-            # find out if project has a network
-            network_ref = network_query(project_id)
-
-        if force or not network_ref:
-            # in force mode or project doesn't have a network so associate
-            # with a new network
-
-            # get new network
-            network_ref = network_query(None, network_id)
-            if not network_ref:
-                raise db.NoMoreNetworks()
-
-            # associate with network
-            # NOTE(vish): if with_lockmode isn't supported, as in sqlite,
-            #             then this has concurrency issues
-            network_ref['project_id'] = project_id
-            session.add(network_ref)
-    return network_ref
-
-
-@require_admin_context
-def network_count(context):
-    return model_query(context, models.Network).count()
-
-
-@require_admin_context
-def _network_ips_query(context, network_id):
-    return model_query(context, models.FixedIp, read_deleted="no").\
-                   filter_by(network_id=network_id)
-
-
-@require_admin_context
-def network_count_reserved_ips(context, network_id):
-    return _network_ips_query(context, network_id).\
-                    filter_by(reserved=True).\
-                    count()
-
-
-@require_admin_context
-def network_create_safe(context, values):
-    if values.get('vlan'):
-        if model_query(context, models.Network, read_deleted="no")\
-                      .filter_by(vlan=values['vlan'])\
-                      .first():
-            raise exception.DuplicateVlan(vlan=values['vlan'])
-
-    network_ref = models.Network()
-    network_ref['uuid'] = str(utils.gen_uuid())
-    network_ref.update(values)
-
-    try:
-        network_ref.save()
-        return network_ref
-    except IntegrityError:
-        return None
-
-
-@require_admin_context
-def network_delete_safe(context, network_id):
-    session = get_session()
-    with session.begin():
-        result = session.query(models.FixedIp).\
-                         filter_by(network_id=network_id).\
-                         filter_by(deleted=False).\
-                         filter_by(allocated=True).\
-                         all()
-        if result:
-            raise exception.NetworkInUse(network_id=network_id)
-        network_ref = network_get(context, network_id=network_id,
-                                  session=session)
-        session.query(models.FixedIp).\
-                filter_by(network_id=network_id).\
-                filter_by(deleted=False).\
-                update({'deleted': True,
-                        'updated_at': literal_column('updated_at'),
-                        'deleted_at': timeutils.utcnow()})
-        session.delete(network_ref)
-
-
-@require_admin_context
-def network_disassociate(context, network_id):
-    network_update(context, network_id, {'project_id': None,
-                                         'host': None})
-
-
-@require_context
-def network_get(context, network_id, session=None, project_only='allow_none'):
-    result = model_query(context, models.Network, session=session,
-                         project_only=project_only).\
-                    filter_by(id=network_id).\
-                    first()
-
-    if not result:
-        raise exception.NetworkNotFound(network_id=network_id)
-
-    return result
-
-
-@require_context
-def network_get_all(context):
-    result = model_query(context, models.Network, read_deleted="no").all()
-
-    if not result:
-        raise exception.NoNetworksFound()
-
-    return result
-
-
-@require_context
-def network_get_all_by_uuids(context, network_uuids,
-                             project_only="allow_none"):
-    result = model_query(context, models.Network, read_deleted="no",
-                         project_only=project_only).\
-                filter(models.Network.uuid.in_(network_uuids)).\
-                all()
-
-    if not result:
-        raise exception.NoNetworksFound()
-
-    #check if the result contains all the networks
-    #we are looking for
-    for network_uuid in network_uuids:
-        found = False
-        for network in result:
-            if network['uuid'] == network_uuid:
-                found = True
-                break
-        if not found:
-            if project_only:
-                raise exception.NetworkNotFoundForProject(
-                      network_uuid=network_uuid, project_id=context.project_id)
-            raise exception.NetworkNotFound(network_id=network_uuid)
-
-    return result
-
-# NOTE(vish): pylint complains because of the long method name, but
-#             it fits with the names of the rest of the methods
-# pylint: disable=C0103
-
-
-@require_admin_context
-def network_get_associated_fixed_ips(context, network_id, host=None):
-    # FIXME(sirp): since this returns fixed_ips, this would be better named
-    # fixed_ip_get_all_by_network.
-    # NOTE(vish): The ugly joins here are to solve a performance issue and
-    #             should be removed once we can add and remove leases
-    #             without regenerating the whole list
-    vif_and = and_(models.VirtualInterface.id ==
-                   models.FixedIp.virtual_interface_id,
-                   models.VirtualInterface.deleted == False)
-    inst_and = and_(models.Instance.uuid == models.FixedIp.instance_uuid,
-                    models.Instance.deleted == False)
-    session = get_session()
-    query = session.query(models.FixedIp.address,
-                          models.FixedIp.instance_uuid,
-                          models.FixedIp.network_id,
-                          models.FixedIp.virtual_interface_id,
-                          models.VirtualInterface.address,
-                          models.Instance.hostname,
-                          models.Instance.updated_at,
-                          models.Instance.created_at).\
-                          filter(models.FixedIp.deleted == False).\
-                          filter(models.FixedIp.network_id == network_id).\
-                          filter(models.FixedIp.allocated == True).\
-                          join((models.VirtualInterface, vif_and)).\
-                          join((models.Instance, inst_and)).\
-                          filter(models.FixedIp.instance_uuid != None).\
-                          filter(models.FixedIp.virtual_interface_id != None)
-    if host:
-        query = query.filter(models.Instance.host == host)
-    result = query.all()
-    data = []
-    for datum in result:
-        cleaned = {}
-        cleaned['address'] = datum[0]
-        cleaned['instance_uuid'] = datum[1]
-        cleaned['network_id'] = datum[2]
-        cleaned['vif_id'] = datum[3]
-        cleaned['vif_address'] = datum[4]
-        cleaned['instance_hostname'] = datum[5]
-        cleaned['instance_updated'] = datum[6]
-        cleaned['instance_created'] = datum[7]
-        data.append(cleaned)
-    return data
-
-
-@require_admin_context
-def _network_get_query(context, session=None):
-    return model_query(context, models.Network, session=session,
-                       read_deleted="no")
-
-
-@require_admin_context
-def network_get_by_bridge(context, bridge):
-    result = _network_get_query(context).filter_by(bridge=bridge).first()
-
-    if not result:
-        raise exception.NetworkNotFoundForBridge(bridge=bridge)
-
-    return result
-
-
-@require_admin_context
-def network_get_by_uuid(context, uuid):
-    result = _network_get_query(context).filter_by(uuid=uuid).first()
-
-    if not result:
-        raise exception.NetworkNotFoundForUUID(uuid=uuid)
-
-    return result
-
-
-@require_admin_context
-def network_get_by_cidr(context, cidr):
-    result = _network_get_query(context).\
-                filter(or_(models.Network.cidr == cidr,
-                           models.Network.cidr_v6 == cidr)).\
-                first()
-
-    if not result:
-        raise exception.NetworkNotFoundForCidr(cidr=cidr)
-
-    return result
-
-
-@require_admin_context
-def network_get_by_instance(context, instance_id):
-    # note this uses fixed IP to get to instance
-    # only works for networks the instance has an IP from
-    result = _network_get_query(context).\
-                 filter_by(instance_id=instance_id).\
-                 first()
-
-    if not result:
-        raise exception.NetworkNotFoundForInstance(instance_id=instance_id)
-
-    return result
-
-
-@require_admin_context
-def network_get_all_by_instance(context, instance_id):
-    result = _network_get_query(context).\
-                 filter_by(instance_id=instance_id).\
-                 all()
-
-    if not result:
-        raise exception.NetworkNotFoundForInstance(instance_id=instance_id)
-
-    return result
-
-
-@require_admin_context
-def network_get_all_by_host(context, host):
-    session = get_session()
-    fixed_ip_query = model_query(context, models.FixedIp.network_id,
-                                 session=session).\
-                        filter(models.FixedIp.host == host)
-    # NOTE(vish): return networks that have host set
-    #             or that have a fixed ip with host set
-    host_filter = or_(models.Network.host == host,
-                      models.Network.id.in_(fixed_ip_query.subquery()))
-    return _network_get_query(context, session=session).\
-                       filter(host_filter).\
-                       all()
-
-
-@require_admin_context
-def network_set_host(context, network_id, host_id):
-    session = get_session()
-    with session.begin():
-        network_ref = _network_get_query(context, session=session).\
-                              filter_by(id=network_id).\
-                              with_lockmode('update').\
-                              first()
-
-        if not network_ref:
-            raise exception.NetworkNotFound(network_id=network_id)
-
-        # NOTE(vish): if with_lockmode isn't supported, as in sqlite,
-        #             then this has concurrency issues
-        if not network_ref['host']:
-            network_ref['host'] = host_id
-            session.add(network_ref)
-
-    return network_ref['host']
-
-
-@require_context
-def network_update(context, network_id, values):
-    session = get_session()
-    with session.begin():
-        network_ref = network_get(context, network_id, session=session)
-        network_ref.update(values)
-        network_ref.save(session=session)
-        return network_ref
-
-
-###################
-
-
-@require_admin_context
-def iscsi_target_count_by_host(context, host):
-    return model_query(context, models.IscsiTarget).\
-                   filter_by(host=host).\
-                   count()
-
-
-@require_admin_context
-def iscsi_target_create_safe(context, values):
-    iscsi_target_ref = models.IscsiTarget()
-
-    for (key, value) in values.iteritems():
-        iscsi_target_ref[key] = value
-    try:
-        iscsi_target_ref.save()
-        return iscsi_target_ref
-    except IntegrityError:
-        return None
-
-
-###################
-
-
-@require_context
-def quota_get(context, project_id, resource, session=None):
-    result = model_query(context, models.Quota, session=session,
-                         read_deleted="no").\
-                     filter_by(project_id=project_id).\
-                     filter_by(resource=resource).\
-                     first()
-
-    if not result:
-        raise exception.ProjectQuotaNotFound(project_id=project_id)
-
-    return result
-
-
-@require_context
-def quota_get_all_by_project(context, project_id):
-    authorize_project_context(context, project_id)
-
-    rows = model_query(context, models.Quota, read_deleted="no").\
-                   filter_by(project_id=project_id).\
-                   all()
-
-    result = {'project_id': project_id}
-    for row in rows:
-        result[row.resource] = row.hard_limit
-
-    return result
-
-
-@require_admin_context
-def quota_create(context, project_id, resource, limit):
-    quota_ref = models.Quota()
-    quota_ref.project_id = project_id
-    quota_ref.resource = resource
-    quota_ref.hard_limit = limit
-    quota_ref.save()
-    return quota_ref
-
-
-@require_admin_context
-def quota_update(context, project_id, resource, limit):
-    session = get_session()
-    with session.begin():
-        quota_ref = quota_get(context, project_id, resource, session=session)
-        quota_ref.hard_limit = limit
-        quota_ref.save(session=session)
-
-
-@require_admin_context
-def quota_destroy(context, project_id, resource):
-    session = get_session()
-    with session.begin():
-        quota_ref = quota_get(context, project_id, resource, session=session)
-        quota_ref.delete(session=session)
-
-
-###################
-
-
-@require_context
-def quota_class_get(context, class_name, resource, session=None):
-    result = model_query(context, models.QuotaClass, session=session,
-                         read_deleted="no").\
-                     filter_by(class_name=class_name).\
-                     filter_by(resource=resource).\
-                     first()
-
-    if not result:
-        raise exception.QuotaClassNotFound(class_name=class_name)
-
-    return result
-
-
-@require_context
-def quota_class_get_all_by_name(context, class_name):
-    authorize_quota_class_context(context, class_name)
-
-    rows = model_query(context, models.QuotaClass, read_deleted="no").\
-                   filter_by(class_name=class_name).\
-                   all()
-
-    result = {'class_name': class_name}
-    for row in rows:
-        result[row.resource] = row.hard_limit
-
-    return result
-
-
-@require_admin_context
-def quota_class_create(context, class_name, resource, limit):
-    quota_class_ref = models.QuotaClass()
-    quota_class_ref.class_name = class_name
-    quota_class_ref.resource = resource
-    quota_class_ref.hard_limit = limit
-    quota_class_ref.save()
-    return quota_class_ref
-
-
-@require_admin_context
-def quota_class_update(context, class_name, resource, limit):
-    session = get_session()
-    with session.begin():
-        quota_class_ref = quota_class_get(context, class_name, resource,
-                                          session=session)
-        quota_class_ref.hard_limit = limit
-        quota_class_ref.save(session=session)
-
-
-@require_admin_context
-def quota_class_destroy(context, class_name, resource):
-    session = get_session()
-    with session.begin():
-        quota_class_ref = quota_class_get(context, class_name, resource,
-                                          session=session)
-        quota_class_ref.delete(session=session)
-
-
-@require_admin_context
-def quota_class_destroy_all_by_name(context, class_name):
-    session = get_session()
-    with session.begin():
-        quota_classes = model_query(context, models.QuotaClass,
-                                    session=session, read_deleted="no").\
-                                filter_by(class_name=class_name).\
-                                all()
-
-        for quota_class_ref in quota_classes:
-            quota_class_ref.delete(session=session)
-
-
-###################
-
-
-@require_context
-def quota_usage_get(context, project_id, resource, session=None):
-    result = model_query(context, models.QuotaUsage, session=session,
-                         read_deleted="no").\
-                     filter_by(project_id=project_id).\
-                     filter_by(resource=resource).\
-                     first()
-
-    if not result:
-        raise exception.QuotaUsageNotFound(project_id=project_id)
-
-    return result
-
-
-@require_context
-def quota_usage_get_all_by_project(context, project_id):
-    authorize_project_context(context, project_id)
-
-    rows = model_query(context, models.QuotaUsage, read_deleted="no").\
-                   filter_by(project_id=project_id).\
-                   all()
-
-    result = {'project_id': project_id}
-    for row in rows:
-        result[row.resource] = dict(in_use=row.in_use, reserved=row.reserved)
-
-    return result
-
-
-@require_admin_context
-def quota_usage_create(context, project_id, resource, in_use, reserved,
-                       until_refresh, session=None):
-    quota_usage_ref = models.QuotaUsage()
-    quota_usage_ref.project_id = project_id
-    quota_usage_ref.resource = resource
-    quota_usage_ref.in_use = in_use
-    quota_usage_ref.reserved = reserved
-    quota_usage_ref.until_refresh = until_refresh
-    quota_usage_ref.save(session=session)
-
-    return quota_usage_ref
-
-
-@require_admin_context
-def quota_usage_update(context, project_id, resource, in_use, reserved,
-                       until_refresh, session=None):
-    def do_update(session):
-        quota_usage_ref = quota_usage_get(context, project_id, resource,
-                                          session=session)
-        quota_usage_ref.in_use = in_use
-        quota_usage_ref.reserved = reserved
-        quota_usage_ref.until_refresh = until_refresh
-        quota_usage_ref.save(session=session)
-
-    if session:
-        # Assume caller started a transaction
-        do_update(session)
-    else:
-        session = get_session()
-        with session.begin():
-            do_update(session)
-
-
-@require_admin_context
-def quota_usage_destroy(context, project_id, resource):
-    session = get_session()
-    with session.begin():
-        quota_usage_ref = quota_usage_get(context, project_id, resource,
-                                          session=session)
-        quota_usage_ref.delete(session=session)
-
-
-###################
-
-
-@require_context
-def reservation_get(context, uuid, session=None):
-    result = model_query(context, models.Reservation, session=session,
-                         read_deleted="no").\
-                     filter_by(uuid=uuid).\
-                     first()
-
-    if not result:
-        raise exception.ReservationNotFound(uuid=uuid)
-
-    return result
-
-
-@require_context
-def reservation_get_all_by_project(context, project_id):
-    authorize_project_context(context, project_id)
-
-    rows = model_query(context, models.QuotaUsage, read_deleted="no").\
-                   filter_by(project_id=project_id).\
-                   all()
-
-    result = {'project_id': project_id}
-    for row in rows:
-        result.setdefault(row.resource, {})
-        result[row.resource][row.uuid] = row.delta
-
-    return result
-
-
-@require_admin_context
-def reservation_create(context, uuid, usage, project_id, resource, delta,
-                       expire, session=None):
-    reservation_ref = models.Reservation()
-    reservation_ref.uuid = uuid
-    reservation_ref.usage_id = usage['id']
-    reservation_ref.project_id = project_id
-    reservation_ref.resource = resource
-    reservation_ref.delta = delta
-    reservation_ref.expire = expire
-    reservation_ref.save(session=session)
-    return reservation_ref
-
-
-@require_admin_context
-def reservation_destroy(context, uuid):
-    session = get_session()
-    with session.begin():
-        reservation_ref = reservation_get(context, uuid, session=session)
-        reservation_ref.delete(session=session)
-
-
-###################
-
-
-# NOTE(johannes): The quota code uses SQL locking to ensure races don't
-# cause under or over counting of resources. To avoid deadlocks, this
-# code always acquires the lock on quota_usages before acquiring the lock
-# on reservations.
-
-def _get_quota_usages(context, session):
-    # Broken out for testability
-    rows = model_query(context, models.QuotaUsage,
-                       read_deleted="no",
-                       session=session).\
-                   filter_by(project_id=context.project_id).\
-                   with_lockmode('update').\
-                   all()
-    return dict((row.resource, row) for row in rows)
-
-
-@require_context
-def quota_reserve(context, resources, quotas, deltas, expire,
-                  until_refresh, max_age):
-    elevated = context.elevated()
-    session = get_session()
-    with session.begin():
-        # Get the current usages
-        usages = _get_quota_usages(context, session)
-
-        # Handle usage refresh
-        work = set(deltas.keys())
-        while work:
-            resource = work.pop()
-
-            # Do we need to refresh the usage?
-            refresh = False
-            if resource not in usages:
-                usages[resource] = quota_usage_create(elevated,
-                                                      context.project_id,
-                                                      resource,
-                                                      0, 0,
-                                                      until_refresh or None,
-                                                      session=session)
-                refresh = True
-            elif usages[resource].in_use < 0:
-                # Negative in_use count indicates a desync, so try to
-                # heal from that...
-                refresh = True
-            elif usages[resource].until_refresh is not None:
-                usages[resource].until_refresh -= 1
-                if usages[resource].until_refresh <= 0:
-                    refresh = True
-            elif max_age and (usages[resource].updated_at -
-                              timeutils.utcnow()).seconds >= max_age:
-                refresh = True
-
-            # OK, refresh the usage
-            if refresh:
-                # Grab the sync routine
-                sync = resources[resource].sync
-
-                updates = sync(elevated, context.project_id, session)
-                for res, in_use in updates.items():
-                    # Make sure we have a destination for the usage!
-                    if res not in usages:
-                        usages[res] = quota_usage_create(elevated,
-                                                         context.project_id,
-                                                         res,
-                                                         0, 0,
-                                                         until_refresh or None,
-                                                         session=session)
-
-                    # Update the usage
-                    usages[res].in_use = in_use
-                    usages[res].until_refresh = until_refresh or None
-
-                    # Because more than one resource may be refreshed
-                    # by the call to the sync routine, and we don't
-                    # want to double-sync, we make sure all refreshed
-                    # resources are dropped from the work set.
-                    work.discard(res)
-
-                    # NOTE(Vek): We make the assumption that the sync
-                    #            routine actually refreshes the
-                    #            resources that it is the sync routine
-                    #            for.  We don't check, because this is
-                    #            a best-effort mechanism.
-
-        # Check for deltas that would go negative
-        unders = [resource for resource, delta in deltas.items()
-                  if delta < 0 and
-                  delta + usages[resource].in_use < 0]
-
-        # Now, let's check the quotas
-        # NOTE(Vek): We're only concerned about positive increments.
-        #            If a project has gone over quota, we want them to
-        #            be able to reduce their usage without any
-        #            problems.
-        overs = [resource for resource, delta in deltas.items()
-                 if quotas[resource] >= 0 and delta >= 0 and
-                 quotas[resource] < delta + usages[resource].total]
-
-        # NOTE(Vek): The quota check needs to be in the transaction,
-        #            but the transaction doesn't fail just because
-        #            we're over quota, so the OverQuota raise is
-        #            outside the transaction.  If we did the raise
-        #            here, our usage updates would be discarded, but
-        #            they're not invalidated by being over-quota.
-
-        # Create the reservations
-        if not overs:
-            reservations = []
-            for resource, delta in deltas.items():
-                reservation = reservation_create(elevated,
-                                                 str(utils.gen_uuid()),
-                                                 usages[resource],
-                                                 context.project_id,
-                                                 resource, delta, expire,
-                                                 session=session)
-                reservations.append(reservation.uuid)
-
-                # Also update the reserved quantity
-                # NOTE(Vek): Again, we are only concerned here about
-                #            positive increments.  Here, though, we're
-                #            worried about the following scenario:
-                #
-                #            1) User initiates resize down.
-                #            2) User allocates a new instance.
-                #            3) Resize down fails or is reverted.
-                #            4) User is now over quota.
-                #
-                #            To prevent this, we only update the
-                #            reserved value if the delta is positive.
-                if delta > 0:
-                    usages[resource].reserved += delta
-
-        # Apply updates to the usages table
-        for usage_ref in usages.values():
-            usage_ref.save(session=session)
-
-    if unders:
-        LOG.warning(_("Change will make usage less than 0 for the following "
-                      "resources: %(unders)s") % locals())
-    if overs:
-        usages = dict((k, dict(in_use=v['in_use'], reserved=v['reserved']))
-                      for k, v in usages.items())
-        raise exception.OverQuota(overs=sorted(overs), quotas=quotas,
-                                  usages=usages)
-
-    return reservations
-
-
-def _quota_reservations(session, context, reservations):
-    """Return the relevant reservations."""
-
-    # Get the listed reservations
-    return model_query(context, models.Reservation,
-                       read_deleted="no",
-                       session=session).\
-                   filter(models.Reservation.uuid.in_(reservations)).\
-                   with_lockmode('update').\
-                   all()
-
-
-@require_context
-def reservation_commit(context, reservations):
-    session = get_session()
-    with session.begin():
-        usages = _get_quota_usages(context, session)
-
-        for reservation in _quota_reservations(session, context, reservations):
-            usage = usages[reservation.resource]
-            if reservation.delta >= 0:
-                usage.reserved -= reservation.delta
-            usage.in_use += reservation.delta
-
-            reservation.delete(session=session)
-
-        for usage in usages.values():
-            usage.save(session=session)
-
-
-@require_context
-def reservation_rollback(context, reservations):
-    session = get_session()
-    with session.begin():
-        usages = _get_quota_usages(context, session)
-
-        for reservation in _quota_reservations(session, context, reservations):
-            usage = usages[reservation.resource]
-            if reservation.delta >= 0:
-                usage.reserved -= reservation.delta
-
-            reservation.delete(session=session)
-
-        for usage in usages.values():
-            usage.save(session=session)
-
-
-@require_admin_context
-def quota_destroy_all_by_project(context, project_id):
-    session = get_session()
-    with session.begin():
-        quotas = model_query(context, models.Quota, session=session,
-                             read_deleted="no").\
-                         filter_by(project_id=project_id).\
-                         all()
-
-        for quota_ref in quotas:
-            quota_ref.delete(session=session)
-
-        quota_usages = model_query(context, models.QuotaUsage,
-                                   session=session, read_deleted="no").\
-                               filter_by(project_id=project_id).\
-                               all()
-
-        for quota_usage_ref in quota_usages:
-            quota_usage_ref.delete(session=session)
-
-        reservations = model_query(context, models.Reservation,
-                                   session=session, read_deleted="no").\
-                               filter_by(project_id=project_id).\
-                               all()
-
-        for reservation_ref in reservations:
-            reservation_ref.delete(session=session)
-
-
-@require_admin_context
-def reservation_expire(context):
-    session = get_session()
-    with session.begin():
-        current_time = timeutils.utcnow()
-        results = model_query(context, models.Reservation, session=session,
-                              read_deleted="no").\
-                          filter(models.Reservation.expire < current_time).\
-                          all()
-
-        if results:
-            for reservation in results:
-                if reservation.delta >= 0:
-                    reservation.usage.reserved -= reservation.delta
-                    reservation.usage.save(session=session)
-
-                reservation.delete(session=session)
-
-
-###################
-
-
-@require_admin_context
-def volume_allocate_iscsi_target(context, volume_id, host):
-    session = get_session()
-    with session.begin():
-        iscsi_target_ref = model_query(context, models.IscsiTarget,
-                                       session=session, read_deleted="no").\
-                                filter_by(volume=None).\
-                                filter_by(host=host).\
-                                with_lockmode('update').\
-                                first()
-
-        # NOTE(vish): if with_lockmode isn't supported, as in sqlite,
-        #             then this has concurrency issues
-        if not iscsi_target_ref:
-            raise db.NoMoreTargets()
-
-        iscsi_target_ref.volume_id = volume_id
-        session.add(iscsi_target_ref)
-
-    return iscsi_target_ref.target_num
-
-
-@require_admin_context
-def volume_attached(context, volume_id, instance_uuid, mountpoint):
-    if not utils.is_uuid_like(instance_uuid):
-        raise exception.InvalidUUID(instance_uuid)
-
-    session = get_session()
-    with session.begin():
-        volume_ref = volume_get(context, volume_id, session=session)
-        volume_ref['status'] = 'in-use'
-        volume_ref['mountpoint'] = mountpoint
-        volume_ref['attach_status'] = 'attached'
-        volume_ref['instance_uuid'] = instance_uuid
-        volume_ref['attach_time'] = timeutils.utcnow()
-        volume_ref.save(session=session)
-
-
-@require_context
-def volume_create(context, values):
-    values['volume_metadata'] = _metadata_refs(values.get('metadata'),
-                                               models.VolumeMetadata)
-    volume_ref = models.Volume()
-    if not values.get('id'):
-        values['id'] = str(utils.gen_uuid())
-    volume_ref.update(values)
-
-    session = get_session()
-    with session.begin():
-        volume_ref.save(session=session)
-
-    return volume_get(context, values['id'], session=session)
-
-
-@require_admin_context
-def volume_data_get_for_project(context, project_id, session=None):
-    result = model_query(context,
-                         func.count(models.Volume.id),
-                         func.sum(models.Volume.size),
-                         read_deleted="no",
-                         session=session).\
-                     filter_by(project_id=project_id).\
-                     first()
-
-    # NOTE(vish): convert None to 0
-    return (result[0] or 0, result[1] or 0)
-
-
-@require_admin_context
-def volume_destroy(context, volume_id):
-    session = get_session()
-    with session.begin():
-        volume_ref = volume_get(context, volume_id, session=session)
-        session.query(models.Volume).\
-                filter_by(id=volume_id).\
-                update({'deleted': True,
-                        'deleted_at': timeutils.utcnow(),
-                        'updated_at': literal_column('updated_at')})
-        session.query(models.IscsiTarget).\
-                filter_by(volume_id=volume_id).\
-                update({'volume_id': None})
-        session.query(models.VolumeMetadata).\
-                filter_by(volume_id=volume_id).\
-                update({'deleted': True,
-                        'deleted_at': timeutils.utcnow(),
-                        'updated_at': literal_column('updated_at')})
-    return volume_ref
-
-
-@require_admin_context
-def volume_detached(context, volume_id):
-    session = get_session()
-    with session.begin():
-        volume_ref = volume_get(context, volume_id, session=session)
-        volume_ref['status'] = 'available'
-        volume_ref['mountpoint'] = None
-        volume_ref['attach_status'] = 'detached'
-        volume_ref['instance_uuid'] = None
-        volume_ref.save(session=session)
-
-
-@require_context
-def _volume_get_query(context, session=None, project_only=False):
-    return model_query(context, models.Volume, session=session,
-                       project_only=project_only).\
-                       options(joinedload('volume_metadata')).\
-                       options(joinedload('volume_type'))
-
-
-@require_context
-def _ec2_volume_get_query(context, session=None):
-    return model_query(context, models.VolumeIdMapping, session=session)
-
-
-@require_context
-def _ec2_snapshot_get_query(context, session=None):
-    return model_query(context, models.SnapshotIdMapping, session=session)
-
-
-@require_context
-def volume_get(context, volume_id, session=None):
-    result = _volume_get_query(context, session=session, project_only=True).\
-                    filter_by(id=volume_id).\
-                    first()
-
-    if not result:
-        raise exception.VolumeNotFound(volume_id=volume_id)
-
-    return result
-
-
-@require_admin_context
-def volume_get_all(context):
-    return _volume_get_query(context).all()
-
-
-@require_admin_context
-def volume_get_all_by_host(context, host):
-    return _volume_get_query(context).filter_by(host=host).all()
-
-
-@require_admin_context
-def volume_get_all_by_instance_uuid(context, instance_uuid):
-    result = model_query(context, models.Volume, read_deleted="no").\
-                     options(joinedload('volume_metadata')).\
-                     options(joinedload('volume_type')).\
-                     filter_by(instance_uuid=instance_uuid).\
-                     all()
-
-    if not result:
-        return []
-
-    return result
-
-
-@require_context
-def volume_get_all_by_project(context, project_id):
-    authorize_project_context(context, project_id)
-    return _volume_get_query(context).filter_by(project_id=project_id).all()
-
-
-@require_admin_context
-def volume_get_iscsi_target_num(context, volume_id):
-    result = model_query(context, models.IscsiTarget, read_deleted="yes").\
-                     filter_by(volume_id=volume_id).\
-                     first()
-
-    if not result:
-        raise exception.ISCSITargetNotFoundForVolume(volume_id=volume_id)
-
-    return result.target_num
-
-
-@require_context
-def volume_update(context, volume_id, values):
-    session = get_session()
-    volume_ref = volume_get(context, volume_id, session=session)
-    metadata = values.get('metadata')
-    if metadata is not None:
-        volume_metadata_update(context,
-                                volume_id,
-                                values.pop('metadata'),
-                                delete=True)
-    with session.begin():
-        volume_ref.update(values)
-        volume_ref.save(session=session)
-
-    return volume_ref
-
-
-@require_context
-def ec2_volume_create(context, volume_uuid, id=None):
-    """Create ec2 compatable volume by provided uuid"""
-    ec2_volume_ref = models.VolumeIdMapping()
-    ec2_volume_ref.update({'uuid': volume_uuid})
-    if id is not None:
-        ec2_volume_ref.update({'id': id})
-
-    ec2_volume_ref.save()
-
-    return ec2_volume_ref
-
-
-@require_context
-def get_ec2_volume_id_by_uuid(context, volume_id, session=None):
-    result = _ec2_volume_get_query(context, session=session).\
-                    filter_by(uuid=volume_id).\
-                    first()
-
-    if not result:
-        raise exception.VolumeNotFound(volume_id=volume_id)
-
-    return result['id']
-
-
-@require_context
-def get_volume_uuid_by_ec2_id(context, ec2_id, session=None):
-    result = _ec2_volume_get_query(context, session=session).\
-                    filter_by(id=ec2_id).\
-                    first()
-
-    if not result:
-        raise exception.VolumeNotFound(volume_id=ec2_id)
-
-    return result['uuid']
-
-
-@require_context
-def ec2_snapshot_create(context, snapshot_uuid, id=None):
-    """Create ec2 compatable snapshot by provided uuid"""
-    ec2_snapshot_ref = models.SnapshotIdMapping()
-    ec2_snapshot_ref.update({'uuid': snapshot_uuid})
-    if id is not None:
-        ec2_snapshot_ref.update({'id': id})
-
-    ec2_snapshot_ref.save()
-
-    return ec2_snapshot_ref
-
-
-@require_context
-def get_ec2_snapshot_id_by_uuid(context, snapshot_id, session=None):
-    result = _ec2_snapshot_get_query(context, session=session).\
-                    filter_by(uuid=snapshot_id).\
-                    first()
-
-    if not result:
-        raise exception.SnapshotNotFound(snapshot_id=snapshot_id)
-
-    return result['id']
-
-
-@require_context
-def get_snapshot_uuid_by_ec2_id(context, ec2_id, session=None):
-    result = _ec2_snapshot_get_query(context, session=session).\
-                    filter_by(id=ec2_id).\
-                    first()
-
-    if not result:
-        raise exception.SnapshotNotFound(snapshot_id=ec2_id)
-
-    return result['uuid']
-
-
-####################
-
-def _volume_metadata_get_query(context, volume_id, session=None):
-    return model_query(context, models.VolumeMetadata,
-                       session=session, read_deleted="no").\
-                    filter_by(volume_id=volume_id)
-
-
-@require_context
-@require_volume_exists
-def volume_metadata_get(context, volume_id):
-    rows = _volume_metadata_get_query(context, volume_id).all()
-    result = {}
-    for row in rows:
-        result[row['key']] = row['value']
-
-    return result
-
-
-@require_context
-@require_volume_exists
-def volume_metadata_delete(context, volume_id, key):
-    _volume_metadata_get_query(context, volume_id).\
-        filter_by(key=key).\
-        update({'deleted': True,
-                'deleted_at': timeutils.utcnow(),
-                'updated_at': literal_column('updated_at')})
-
-
-@require_context
-@require_volume_exists
-def volume_metadata_get_item(context, volume_id, key, session=None):
-    result = _volume_metadata_get_query(context, volume_id, session=session).\
-                    filter_by(key=key).\
-                    first()
-
-    if not result:
-        raise exception.VolumeMetadataNotFound(metadata_key=key,
-                                               volume_id=volume_id)
-    return result
-
-
-@require_context
-@require_volume_exists
-def volume_metadata_update(context, volume_id, metadata, delete):
-    session = get_session()
-
-    # Set existing metadata to deleted if delete argument is True
-    if delete:
-        original_metadata = volume_metadata_get(context, volume_id)
-        for meta_key, meta_value in original_metadata.iteritems():
-            if meta_key not in metadata:
-                meta_ref = volume_metadata_get_item(context, volume_id,
-                                                    meta_key, session)
-                meta_ref.update({'deleted': True})
-                meta_ref.save(session=session)
-
-    meta_ref = None
-
-    # Now update all existing items with new values, or create new meta objects
-    for meta_key, meta_value in metadata.iteritems():
-
-        # update the value whether it exists or not
-        item = {"value": meta_value}
-
-        try:
-            meta_ref = volume_metadata_get_item(context, volume_id,
-                                                  meta_key, session)
-        except exception.VolumeMetadataNotFound, e:
-            meta_ref = models.VolumeMetadata()
-            item.update({"key": meta_key, "volume_id": volume_id})
-
-        meta_ref.update(item)
-        meta_ref.save(session=session)
-
-    return metadata
-
-
-###################
-
-
-@require_context
-def snapshot_create(context, values):
-    snapshot_ref = models.Snapshot()
-    if not values.get('id'):
-        values['id'] = str(utils.gen_uuid())
-    snapshot_ref.update(values)
-
-    session = get_session()
-    with session.begin():
-        snapshot_ref.save(session=session)
-    return snapshot_ref
-
-
-@require_admin_context
-def snapshot_destroy(context, snapshot_id):
-    session = get_session()
-    with session.begin():
-        session.query(models.Snapshot).\
-                filter_by(id=snapshot_id).\
-                update({'deleted': True,
-                        'deleted_at': timeutils.utcnow(),
-                        'updated_at': literal_column('updated_at')})
-
-
-@require_context
-def snapshot_get(context, snapshot_id, session=None):
-    result = model_query(context, models.Snapshot, session=session,
-                         project_only=True).\
-                filter_by(id=snapshot_id).\
-                first()
-
-    if not result:
-        raise exception.SnapshotNotFound(snapshot_id=snapshot_id)
-
-    return result
-
-
-@require_admin_context
-def snapshot_get_all(context):
-    return model_query(context, models.Snapshot).all()
-
-
-@require_context
-def snapshot_get_all_for_volume(context, volume_id):
-    return model_query(context, models.Snapshot, read_deleted='no',
-                       project_only=True).\
-              filter_by(volume_id=volume_id).all()
-
-
-@require_context
-def snapshot_get_all_by_project(context, project_id):
-    authorize_project_context(context, project_id)
-    return model_query(context, models.Snapshot).\
-                   filter_by(project_id=project_id).\
-                   all()
-
-
-@require_context
-def snapshot_update(context, snapshot_id, values):
-    session = get_session()
-    with session.begin():
-        snapshot_ref = snapshot_get(context, snapshot_id, session=session)
-        snapshot_ref.update(values)
-        snapshot_ref.save(session=session)
-
-
-###################
-
-
-def _block_device_mapping_get_query(context, session=None):
-    return model_query(context, models.BlockDeviceMapping, session=session)
-
-
-@require_context
-def block_device_mapping_create(context, values):
-    bdm_ref = models.BlockDeviceMapping()
-    bdm_ref.update(values)
-
-    session = get_session()
-    with session.begin():
-        bdm_ref.save(session=session)
-
-
-@require_context
-def block_device_mapping_update(context, bdm_id, values):
-    session = get_session()
-    with session.begin():
-        _block_device_mapping_get_query(context, session=session).\
-                filter_by(id=bdm_id).\