libvirt/src/esx
Eric Blake 282fe1f08c snapshot: prevent stranding snapshot data on domain destruction
Just as leaving managed save metadata behind can cause problems
when creating a new domain that happens to collide with the name
of the just-deleted domain, the same is true of leaving any
snapshot metadata behind.  For safety sake, extend the semantic
change of commit b26a9fa9 to also cover snapshot metadata as a
reason to reject undefining an inactive domain.  A future patch
will make sure that shutdown of a transient domain automatically
deletes snapshot metadata (whether by destroy, shutdown, or
guest-initiated action).  Management apps of transient domains
should take care to capture xml of snapshots, if it is necessary
to recreate the snapshot metadata on a later transient domain
with the same name and uuid.

This also documents a new flag that hypervisors can choose to
support as a shortcut for taking care of the metadata as part of
the undefine process; however, nontrivial driver support for these
flags will be deferred to future patches.

Note that ESX and VBox can never be transient; therefore, they
do not have to worry about automatic cleanup after shutdown
(the persistent domain still remains); likewise they never
store snapshot metadata, so the undefine flag is trivial.
The nontrivial work remaining is thus in the qemu driver.

* include/libvirt/libvirt.h.in
(VIR_DOMAIN_UNDEFINE_SNAPSHOTS_METADATA): New flag.
* src/libvirt.c (virDomainUndefine, virDomainUndefineFlags):
Document new limitations and flag.
* src/esx/esx_driver.c (esxDomainUndefineFlags): Trivial
implementation.
* src/vbox/vbox_tmpl.c (vboxDomainUndefineFlags): Likewise.
* src/qemu/qemu_driver.c (qemuDomainUndefineFlags): Enforce
the limitations.
2011-09-02 21:57:33 -06:00
..
.gitignore esx: Generate most SOAP mapping and improve inheritance handling 2010-03-31 13:36:54 +02:00
esx_device_monitor.c esx: reject unknown flags 2011-07-15 16:30:22 -06:00
esx_device_monitor.h build: consistently indent preprocessor directives 2010-03-09 19:22:28 +01:00
esx_driver.c snapshot: prevent stranding snapshot data on domain destruction 2011-09-02 21:57:33 -06:00
esx_driver.h esx: Cleanup file header comments 2010-03-23 01:28:08 +01:00
esx_interface_driver.c esx: reject unknown flags 2011-07-15 16:30:22 -06:00
esx_interface_driver.h esx: Cleanup file header comments 2010-03-23 01:28:08 +01:00
esx_network_driver.c esx: reject unknown flags 2011-07-15 16:30:22 -06:00
esx_network_driver.h esx: Cleanup file header comments 2010-03-23 01:28:08 +01:00
esx_nwfilter_driver.c esx: reject unknown flags 2011-07-15 16:30:22 -06:00
esx_nwfilter_driver.h esx: Add nwfilter driver stub 2010-04-15 19:52:38 +02:00
esx_private.h esx: Convert autoAnswer from esxVI_Boolean to a simple bool 2011-05-17 13:16:48 +02:00
esx_secret_driver.c esx: reject unknown flags 2011-07-15 16:30:22 -06:00
esx_secret_driver.h esx: Cleanup file header comments 2010-03-23 01:28:08 +01:00
esx_storage_driver.c esx: reject unknown flags 2011-07-15 16:30:22 -06:00
esx_storage_driver.h build: consistently indent preprocessor directives 2010-03-09 19:22:28 +01:00
esx_util.c esx: Remove dead store in esxUtil_ParseDatastorePath 2011-05-04 18:33:14 +02:00
esx_util.h esx: Escape password for XML 2011-03-03 22:18:09 +01:00
esx_vi_generator.input esx: Change some alignments in the input file 2011-05-16 20:22:50 +02:00
esx_vi_generator.py esx: Refactor a repeated string in the generator 2011-08-23 23:15:21 +02:00
esx_vi_methods.c esx: Generate implicit _this macros 2011-05-14 11:45:08 +02:00
esx_vi_methods.h build: fix recent 'make syntax-check' failure 2010-04-14 11:23:09 -06:00
esx_vi_types.c time_t is not a long on FreeBSD, switch internal type to long long 2011-05-25 18:47:33 +02:00
esx_vi_types.h time_t is not a long on FreeBSD, switch internal type to long long 2011-05-25 18:47:33 +02:00
esx_vi.c maint: simplify lots of libxml2 clients 2011-08-19 09:13:55 -06:00
esx_vi.h esx: Simplify some esxVI_Boolean to bool 2011-05-17 13:20:49 +02:00
README esx: Handle name escaping properly 2010-10-14 22:43:16 +02:00

Some links to relevant documentation
====================================


VI/vSphere API:
  http://www.vmware.com/support/developer/vc-sdk/visdk25pubs/ReferenceGuide/
  http://www.vmware.com/support/developer/vc-sdk/visdk400pubs/ReferenceGuide/
  http://www.vmware.com/support/developer/vc-sdk/visdk41pubs/ApiReference/

VMX config:
  http://www.sanbarrow.com/vmx.html

CPUID:
  http://www.sandpile.org/ia32/cpuid.htm

Memory model:
  http://www.vmware.com/pdf/esx3_memory.pdf
  http://www.vmware.com/pdf/usenix_resource_mgmt.pdf

Virtual serial port (network backed):
  http://www.vmware.com/support/developer/vc-sdk/visdk41pubs/ApiReference/vim.vm.device.VirtualSerialPort.URIBackingInfo.html
  http://www.vmware.com/support/developer/vc-sdk/visdk41pubs/vsp41_usingproxy_virtual_serial_ports.pdf



Automatic question handling
===========================


What is a question in the ESX context?
--------------------------------------

The VI API contains methods that start tasks, for example PowerOnVM_Task(). Such
tasks may be blocked by questions if the ESX host detects an issue with the
virtual machine that requires user interaction.

An example: If a virtual machine has a serial port that is realized via a file,
the ESX host will ask a question on power-on of this virtual machine whether
new content should be appended to this file or the file should be replaced.
Until this question is answered the power-on task is blocked and the virtual
machine won't get powered on.

The ESX driver cannot prompt the user to answer a question, libvirt doesn't
have an API for something like this. The VI API provides the AnswerVM() method
to programmatically answer such questions. A question comes together with a list
of possible answers. One of this answers is marked as the default one. For all
questions I've seen so far the default answer is always a non-destructive one.

There are two options how to handle a question that is blocking a task: either
answer it automatically or report it as error and try to cancel the blocked
task.

The auto_answer query parameter defines how the driver should handle questions.
Possible values are 0 for the report-error-and-try-to-cancel option and 1 for
the automatic-answer option.


How is automatic question handling implemented?
-----------------------------------------------

Before any new task is started the driver checks if there is a pending task
blocked by a question. If automatic question handling is disabled the driver
reports an error that includes the question and returns from the driver
function. If automatic question handling is enabled the driver answers the
question with the default answer and returns from the driver function.

In both cases the actual desired task is not started. If the question was not
answered the blocked task is still blocked and because task can't be executed
in parallel in general it's of no use to start yet another task. If the
question was answered the blocked task may already perform the desired action
and one must wait for its completion, so it's of no use to start yet another
task.

If there is no question blocking a task or another pending task that had not
finished yet the driver starts the desired task and waits for its completion.
While polling for status updates of the task it also checks for question that
may have been triggered by the current task and handles them according to the
value of the auto_answer query parameter. If automatic question handling is
enabled the driver answers the question with the default answer and continues
polling for status updates. If automatic question handling is disabled the
driver reports an error that includes the question, tries to cancel the blocked
task and returns from the driver function.

It tries to cancel the blocked task, but this may not be possible, because
there are task like the power-on task that is marked as non-cancelable. So the
driver may leave blocked tasks behind if automatic question handling is
disabled.



Different escaping schemes used in different places
===================================================

A domain name in the vSphere API has [%/\] escaped as %XX (percent-encoding),
where XX is the ASCII code of the escaped char in hex.

A domainName entry in a VMX config file is percent-encoded and has [|"] escaped
as |XX (pipe-encoding).

A annotation entry in a VMX config file is pipe-encoded.

A datastore item name has the special Windows path characters ["*<>:|?]
replaced by underscores (_). The result is escaped using percent-encoding and
base64-encoding. This isn't a bijective encoding. Therefore, escaped datastore
item names cannot be unescaped completely.

For base64-encoding sequences of chars that don't match [a-zA-Z0-9'(),. _-]
are replaced by their base64 form (the padding is omitted). An encoded sequence
begins with a plus (+), ends with a minus (-) and can contain a plus (+). The
minus (-) is omitted if the string ends in a base64-encoded sequence. VMware
uses the comma (,) instead of the slash (/) in the base64 alphabet to avoid
conflicts with the slash as path separator.