Merge "Set MySQL slow log to record every query"
diff --git a/AUTHORS b/AUTHORS
index 7ec1f66..35c0a52 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -19,6 +19,7 @@
 Gary Kotton <gkotton@redhat.com>
 Hengqing Hu <hudayou@hotmail.com>
 Hua ZHANG <zhuadl@cn.ibm.com>
+Isaku Yamahata <yamahata@private.email.ne.jp>
 Jake Dahn <admin@jakedahn.com>
 James E. Blair <james.blair@rackspace.com>
 Jason Cannavale <jason.cannavale@rackspace.com>
diff --git a/exercises/sec_groups.sh b/exercises/sec_groups.sh
index f6810e3..fbd9c8e 100755
--- a/exercises/sec_groups.sh
+++ b/exercises/sec_groups.sh
@@ -48,7 +48,7 @@
 RULES_TO_ADD=( 22 3389 5900 )
 
 for RULE in "${RULES_TO_ADD[@]}"; do
-    nova secgroup-add-rule $SEC_GROUP_NAME tcp $RULE $RULE 0.0.0.0/00
+    nova secgroup-add-rule $SEC_GROUP_NAME tcp $RULE $RULE 0.0.0.0/0
 done
 
 # Check to make sure rules were added
@@ -63,7 +63,7 @@
 
 # Delete rules and secgroup
 for RULE in "${RULES_TO_ADD[@]}"; do
-    nova secgroup-delete-rule $SEC_GROUP_NAME tcp $RULE $RULE 0.0.0.0/00
+    nova secgroup-delete-rule $SEC_GROUP_NAME tcp $RULE $RULE 0.0.0.0/0
 done
 nova secgroup-delete $SEC_GROUP_NAME
 
diff --git a/files/apts/nova b/files/apts/nova
index b7d1e92..39b4060 100644
--- a/files/apts/nova
+++ b/files/apts/nova
@@ -31,6 +31,7 @@
 python-libxml2
 python-routes
 python-netaddr
+python-numpy # used by websockify for spice console
 python-pastedeploy
 python-eventlet
 python-cheetah
diff --git a/files/rpms/n-spice b/files/rpms/n-spice
new file mode 100644
index 0000000..24ce15a
--- /dev/null
+++ b/files/rpms/n-spice
@@ -0,0 +1 @@
+numpy
diff --git a/files/rpms/nova b/files/rpms/nova
index 88ad8c3..568ee7f 100644
--- a/files/rpms/nova
+++ b/files/rpms/nova
@@ -10,6 +10,7 @@
 libvirt-bin # NOPRIME
 libvirt-python
 libxml2-python
+numpy # needed by websockify for spice console
 m2crypto
 mysql-server # NOPRIME
 parted
diff --git a/lib/cinder b/lib/cinder
index 8b1ccd7..a730cd6 100644
--- a/lib/cinder
+++ b/lib/cinder
@@ -209,6 +209,8 @@
             iniset $CINDER_CONF DEFAULT xenapi_nfs_server "$CINDER_XENAPI_NFS_SERVER"
             iniset $CINDER_CONF DEFAULT xenapi_nfs_serverpath "$CINDER_XENAPI_NFS_SERVERPATH"
         )
+    elif [ "$CINDER_DRIVER" == "sheepdog" ]; then
+        iniset $CINDER_CONF DEFAULT volume_driver "cinder.volume.drivers.sheepdog.SheepdogDriver"
     fi
 }
 
diff --git a/lib/nova b/lib/nova
index 8135bf1..7e5bb99 100644
--- a/lib/nova
+++ b/lib/nova
@@ -229,7 +229,7 @@
             configure_baremetal_nova_dirs
         fi
 
-        if is_service_enabled quantum && is_quantum_ovs_base_plugin "$Q_PLUGIN" && ! sudo grep -q '^cgroup_device_acl' $QEMU_CONF ; then
+        if is_service_enabled quantum && is_quantum_ovs_base_plugin && ! sudo grep -q '^cgroup_device_acl' $QEMU_CONF ; then
             # Add /dev/net/tun to cgroup_device_acls, needed for type=ethernet interfaces
             cat <<EOF | sudo tee -a $QEMU_CONF
 cgroup_device_acl = [
@@ -247,11 +247,25 @@
             LIBVIRT_DAEMON=libvirtd
         fi
 
-        # For distributions using polkit to authorize access to libvirt,
-        # configure polkit accordingly.
-        # Based on http://wiki.libvirt.org/page/SSHPolicyKitSetup
+
+
         if is_fedora; then
-            sudo bash -c 'cat <<EOF >/etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
+            # Starting with fedora 18 enable stack-user to virsh -c qemu:///system
+            # by creating a policy-kit rule for stack-user
+            if [[ "$os_RELEASE" -ge "18" ]]; then
+                rules_dir=/etc/polkit-1/rules.d
+                sudo mkdir -p $rules_dir
+                sudo bash -c "cat <<EOF > $rules_dir/50-libvirt-$STACK_USER.rules
+polkit.addRule(function(action, subject) {
+     if (action.id == 'org.libvirt.unix.manage' &&
+         subject.user == '"$STACK_USER"') {
+         return polkit.Result.YES;
+     }
+});
+EOF"
+                unset rules_dir
+            else
+                sudo bash -c 'cat <<EOF >/etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla
 [libvirt Management Access]
 Identity=unix-group:libvirtd
 Action=org.libvirt.unix.manage
@@ -259,6 +273,7 @@
 ResultInactive=yes
 ResultActive=yes
 EOF'
+            fi
         elif is_suse; then
             # Work around the fact that polkit-default-privs overrules pklas
             # with 'unix-group:$group'.
@@ -355,6 +370,7 @@
     rm -f $NOVA_CONF
     add_nova_opt "[DEFAULT]"
     iniset $NOVA_CONF DEFAULT verbose "True"
+    iniset $NOVA_CONF DEFAULT debug "True"
     iniset $NOVA_CONF DEFAULT auth_strategy "keystone"
     iniset $NOVA_CONF DEFAULT allow_resize_to_same_host "True"
     iniset $NOVA_CONF DEFAULT api_paste_config "$NOVA_API_PASTE_INI"
@@ -549,15 +565,16 @@
     screen_it n-crt "cd $NOVA_DIR && $NOVA_BIN_DIR/nova-cert"
     screen_it n-net "cd $NOVA_DIR && $NOVA_BIN_DIR/nova-network"
     screen_it n-sch "cd $NOVA_DIR && $NOVA_BIN_DIR/nova-scheduler"
-    screen_it n-novnc "cd $NOVNC_DIR && ./utils/nova-novncproxy --config-file $NOVA_CONF --web ."
+    screen_it n-novnc "cd $NOVA_DIR && $NOVA_BIN_DIR/nova-novncproxy --config-file $NOVA_CONF --web $NOVNC_DIR"
     screen_it n-xvnc "cd $NOVA_DIR && $NOVA_BIN_DIR/nova-xvpvncproxy --config-file $NOVA_CONF"
+    screen_it n-spice "cd $NOVA_DIR && $NOVA_BIN_DIR/nova-spicehtml5proxy --config-file $NOVA_CONF --web $SPICE_DIR"
     screen_it n-cauth "cd $NOVA_DIR && $NOVA_BIN_DIR/nova-consoleauth"
 }
 
 # stop_nova() - Stop running processes (non-screen)
 function stop_nova() {
     # Kill the nova screen windows
-    for serv in n-api n-cpu n-crt n-net n-sch n-novnc n-xvnc n-cauth n-cond; do
+    for serv in n-api n-cpu n-crt n-net n-sch n-novnc n-xvnc n-cauth n-cond n-spice; do
         screen -S $SCREEN_NAME -p $serv -X kill
     done
 }
diff --git a/lib/quantum b/lib/quantum
index 788db53..27b3509 100644
--- a/lib/quantum
+++ b/lib/quantum
@@ -171,6 +171,11 @@
     OVS_ENABLE_TUNNELING=${OVS_ENABLE_TUNNELING:-$ENABLE_TENANT_TUNNELS}
 fi
 
+# Quantum plugin specific functions
+# ---------------------------------
+# Please refer to lib/quantum_plugins/README.md for details.
+source $TOP_DIR/lib/quantum_plugins/$Q_PLUGIN
+
 # Entry Points
 # ------------
 
@@ -210,22 +215,9 @@
     iniset $NOVA_CONF DEFAULT quantum_admin_tenant_name "$SERVICE_TENANT_NAME"
     iniset $NOVA_CONF DEFAULT quantum_url "http://$Q_HOST:$Q_PORT"
 
-    if [[ "$Q_PLUGIN" = "openvswitch" ]]; then
-        NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver"}
-        if [ "$VIRT_DRIVER" = 'xenserver' ]; then
-            add_nova_opt "xenapi_vif_driver=nova.virt.xenapi.vif.XenAPIOpenVswitchDriver"
-            add_nova_opt "xenapi_ovs_integration_bridge=$FLAT_NETWORK_BRIDGE"
-        fi
-    elif [[ "$Q_PLUGIN" = "linuxbridge" ]]; then
-        NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.QuantumLinuxBridgeVIFDriver"}
-    elif [[ "$Q_PLUGIN" = "ryu" ]]; then
-        NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"quantum.plugins.ryu.nova.vif.LibvirtOpenVswitchOFPRyuDriver"}
-        iniset $NOVA_CONF DEFAULT libvirt_ovs_integration_bridge "$OVS_BRIDGE"
-        iniset $NOVA_CONF DEFAULT linuxnet_ovs_ryu_api_host "$RYU_API_HOST:$RYU_API_PORT"
-        iniset $NOVA_CONF DEFAULT libvirt_ovs_ryu_api_host "$RYU_API_HOST:$RYU_API_PORT"
-    elif [[ "$Q_PLUGIN" = "bigswitch_floodlight" ]]; then
-        NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver"}
-    fi
+    # set NOVA_VIF_DRIVER and optionally set options in nova_conf
+    quantum_plugin_create_nova_conf
+
     iniset $NOVA_CONF DEFAULT libvirt_vif_driver "$NOVA_VIF_DRIVER"
     iniset $NOVA_CONF DEFAULT linuxnet_interface_driver "$LINUXNET_VIF_DRIVER"
     if is_service_enabled q-meta; then
@@ -297,7 +289,7 @@
         EXT_GW_IP=$(quantum subnet-create --ip_version 4 $EXT_NET_ID $FLOATING_RANGE -- --enable_dhcp=False | grep 'gateway_ip' | get_field 2)
         quantum router-gateway-set $ROUTER_ID $EXT_NET_ID
 
-        if is_quantum_ovs_base_plugin "$Q_PLUGIN" && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
+        if is_quantum_ovs_base_plugin && [[ "$Q_USE_NAMESPACE" = "True" ]]; then
             CIDR_LEN=${FLOATING_RANGE#*/}
             sudo ip addr add $EXT_GW_IP/$CIDR_LEN dev $PUBLIC_BRIDGE
             sudo ip link set $PUBLIC_BRIDGE up
@@ -328,29 +320,8 @@
 
 # install_quantum_agent_packages() - Collect source and prepare
 function install_quantum_agent_packages() {
-    if is_quantum_ovs_base_plugin "$Q_PLUGIN"; then
-        # Install deps
-        # FIXME add to ``files/apts/quantum``, but don't install if not needed!
-        if is_ubuntu; then
-            kernel_version=`cat /proc/version | cut -d " " -f3`
-            install_package make fakeroot dkms openvswitch-switch openvswitch-datapath-dkms linux-headers-$kernel_version
-        else
-            ### FIXME(dtroyer): Find RPMs for OpenVSwitch
-            echo "OpenVSwitch packages need to be located"
-            # Fedora does not started OVS by default
-            restart_service openvswitch
-        fi
-    elif [[ "$Q_PLUGIN" = "linuxbridge" ]]; then
-       install_package bridge-utils
-    fi
-}
-
-function is_quantum_ovs_base_plugin() {
-    local plugin=$1
-    if [[ ",openvswitch,ryu,bigswitch_floodlight," =~ ,${plugin}, ]]; then
-        return 0
-    fi
-    return 1
+    # install packages that is specific to plugin agent
+    quantum_plugin_install_agent_packages
 }
 
 function setup_quantum() {
@@ -407,29 +378,9 @@
 
     cp $QUANTUM_DIR/etc/quantum.conf $QUANTUM_CONF
 
-    if [[ "$Q_PLUGIN" = "openvswitch" ]]; then
-        Q_PLUGIN_CONF_PATH=etc/quantum/plugins/openvswitch
-        Q_PLUGIN_CONF_FILENAME=ovs_quantum_plugin.ini
-        Q_DB_NAME="ovs_quantum"
-        Q_PLUGIN_CLASS="quantum.plugins.openvswitch.ovs_quantum_plugin.OVSQuantumPluginV2"
-    elif [[ "$Q_PLUGIN" = "linuxbridge" ]]; then
-        Q_PLUGIN_CONF_PATH=etc/quantum/plugins/linuxbridge
-        Q_PLUGIN_CONF_FILENAME=linuxbridge_conf.ini
-        Q_DB_NAME="quantum_linux_bridge"
-        Q_PLUGIN_CLASS="quantum.plugins.linuxbridge.lb_quantum_plugin.LinuxBridgePluginV2"
-    elif [[ "$Q_PLUGIN" = "ryu" ]]; then
-        Q_PLUGIN_CONF_PATH=etc/quantum/plugins/ryu
-        Q_PLUGIN_CONF_FILENAME=ryu.ini
-        Q_DB_NAME="ovs_quantum"
-        Q_PLUGIN_CLASS="quantum.plugins.ryu.ryu_quantum_plugin.RyuQuantumPluginV2"
-    elif [[ "$Q_PLUGIN" = "bigswitch_floodlight" ]]; then
-        Q_PLUGIN_CONF_PATH=etc/quantum/plugins/bigswitch
-        Q_PLUGIN_CONF_FILENAME=restproxy.ini
-        Q_DB_NAME="restproxy_quantum"
-        Q_PLUGIN_CLASS="quantum.plugins.bigswitch.plugin.QuantumRestProxyV2"
-        BS_FL_CONTROLLERS_PORT=${BS_FL_CONTROLLERS_PORT:-localhost:80}
-        BS_FL_CONTROLLER_TIMEOUT=${BS_FL_CONTROLLER_TIMEOUT:-10}
-    fi
+    # set plugin-specific variables
+    # Q_PLUGIN_CONF_PATH, Q_PLUGIN_CONF_FILENAME, Q_DB_NAME, Q_PLUGIN_CLASS
+    quantum_plugin_configure_common
 
     if [[ $Q_PLUGIN_CONF_PATH == '' || $Q_PLUGIN_CONF_FILENAME == '' || $Q_PLUGIN_CLASS == '' ]]; then
         echo "Quantum plugin not set.. exiting"
@@ -463,15 +414,7 @@
     _quantum_setup_keystone $QUANTUM_TEST_CONFIG_FILE DEFAULT set_auth_url
     _quantum_setup_interface_driver $QUANTUM_TEST_CONFIG_FILE
 
-    if is_quantum_ovs_base_plugin "$Q_PLUGIN"; then
-        iniset $QUANTUM_TEST_CONFIG_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
-    elif [[ "$Q_PLUGIN" = "linuxbridge" ]]; then
-        iniset $QUANTUM_TEST_CONFIG_FILE DEFAULT external_network_bridge ''
-    fi
-
-    if [[ "$Q_PLUGIN" = "ryu" ]]; then
-        iniset $QUANTUM_TEST_CONFIG_FILE DEFAULT ryu_api_host $RYU_API_HOST:$RYU_API_PORT
-    fi
+    quantum_plugin_configure_debug_command
 }
 
 function _configure_quantum_dhcp_agent() {
@@ -489,9 +432,7 @@
     _quantum_setup_keystone $Q_DHCP_CONF_FILE DEFAULT set_auth_url
     _quantum_setup_interface_driver $Q_DHCP_CONF_FILE
 
-    if [[ "$Q_PLUGIN" = "ryu" ]]; then
-        iniset $Q_DHCP_CONF_FILE DEFAULT ryu_api_host $RYU_API_HOST:$RYU_API_PORT
-    fi
+    quantum_plugin_configure_dhcp_agent
 }
 
 function _configure_quantum_l3_agent() {
@@ -510,16 +451,7 @@
     _quantum_setup_keystone $Q_L3_CONF_FILE DEFAULT set_auth_url
     _quantum_setup_interface_driver $Q_L3_CONF_FILE
 
-    if is_quantum_ovs_base_plugin "$Q_PLUGIN"; then
-        iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
-        _quantum_setup_external_bridge $PUBLIC_BRIDGE
-    elif [[ "$Q_PLUGIN" = "linuxbridge" ]]; then
-        iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge ''
-    fi
-
-    if [[ "$Q_PLUGIN" = "ryu" ]]; then
-        iniset $Q_L3_CONF_FILE DEFAULT ryu_api_host $RYU_API_HOST:$RYU_API_PORT
-    fi
+    quantum_plugin_configure_l3_agent
 }
 
 function _configure_quantum_metadata_agent() {
@@ -546,105 +478,7 @@
     iniset /$Q_PLUGIN_CONF_FILE AGENT root_helper "$Q_RR_COMMAND"
 
     # Configure agent for plugin
-    if [[ "$Q_PLUGIN" = "openvswitch" ]]; then
-        _configure_quantum_plugin_agent_openvswitch
-    elif [[ "$Q_PLUGIN" = "linuxbridge" ]]; then
-        _configure_quantum_plugin_agent_linuxbridge
-    elif [[ "$Q_PLUGIN" = "ryu" ]]; then
-        _configure_quantum_plugin_agent_ryu
-    fi
-}
-
-function _configure_quantum_plugin_agent_linuxbridge() {
-    # Setup physical network interface mappings.  Override
-    # ``LB_VLAN_RANGES`` and ``LB_INTERFACE_MAPPINGS`` in ``localrc`` for more
-    # complex physical network configurations.
-    if [[ "$LB_INTERFACE_MAPPINGS" = "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$LB_PHYSICAL_INTERFACE" != "" ]]; then
-        LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
-    fi
-    if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE LINUX_BRIDGE physical_interface_mappings $LB_INTERFACE_MAPPINGS
-    fi
-    AGENT_BINARY="$QUANTUM_DIR/bin/quantum-linuxbridge-agent"
-}
-
-function _configure_quantum_plugin_agent_openvswitch() {
-    # Setup integration bridge
-    OVS_BRIDGE=${OVS_BRIDGE:-br-int}
-    _quantum_setup_ovs_bridge $OVS_BRIDGE
-
-    # Setup agent for tunneling
-    if [[ "$OVS_ENABLE_TUNNELING" = "True" ]]; then
-        # Verify tunnels are supported
-        # REVISIT - also check kernel module support for GRE and patch ports
-        OVS_VERSION=`ovs-vsctl --version | head -n 1 | awk '{print $4;}'`
-        if [ $OVS_VERSION \< "1.4" ] && ! is_service_enabled q-svc ; then
-            echo "You are running OVS version $OVS_VERSION."
-            echo "OVS 1.4+ is required for tunneling between multiple hosts."
-            exit 1
-        fi
-        iniset /$Q_PLUGIN_CONF_FILE OVS enable_tunneling True
-        iniset /$Q_PLUGIN_CONF_FILE OVS local_ip $HOST_IP
-    fi
-
-    # Setup physical network bridge mappings.  Override
-    # ``OVS_VLAN_RANGES`` and ``OVS_BRIDGE_MAPPINGS`` in ``localrc`` for more
-    # complex physical network configurations.
-    if [[ "$OVS_BRIDGE_MAPPINGS" = "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$OVS_PHYSICAL_BRIDGE" != "" ]]; then
-        OVS_BRIDGE_MAPPINGS=$PHYSICAL_NETWORK:$OVS_PHYSICAL_BRIDGE
-
-        # Configure bridge manually with physical interface as port for multi-node
-        sudo ovs-vsctl --no-wait -- --may-exist add-br $OVS_PHYSICAL_BRIDGE
-    fi
-    if [[ "$OVS_BRIDGE_MAPPINGS" != "" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE OVS bridge_mappings $OVS_BRIDGE_MAPPINGS
-    fi
-    AGENT_BINARY="$QUANTUM_DIR/bin/quantum-openvswitch-agent"
-
-    if [ "$VIRT_DRIVER" = 'xenserver' ]; then
-        # Nova will always be installed along with quantum for a domU
-        # devstack install, so it should be safe to rely on nova.conf
-        # for xenapi configuration.
-        Q_RR_DOM0_COMMAND="$QUANTUM_DIR/bin/quantum-rootwrap-dom0 $NOVA_CONF"
-        # Under XS/XCP, the ovs agent needs to target the dom0
-        # integration bridge.  This is enabled by using a root wrapper
-        # that executes commands on dom0 via a XenAPI plugin.
-        iniset /$Q_PLUGIN_CONF_FILE AGENT root_helper "$Q_RR_DOM0_COMMAND"
-
-        # FLAT_NETWORK_BRIDGE is the dom0 integration bridge.  To
-        # ensure the bridge lacks direct connectivity, set
-        # VM_VLAN=-1;VM_DEV=invalid in localrc
-        iniset /$Q_PLUGIN_CONF_FILE OVS integration_bridge $FLAT_NETWORK_BRIDGE
-
-        # The ovs agent needs to ensure that the ports associated with
-        # a given network share the same local vlan tag.  On
-        # single-node XS/XCP, this requires monitoring both the dom0
-        # bridge, where VM's are attached, and the domU bridge, where
-        # dhcp servers are attached.
-        if is_service_enabled q-dhcp; then
-            iniset /$Q_PLUGIN_CONF_FILE OVS domu_integration_bridge $OVS_BRIDGE
-            # DomU will use the regular rootwrap
-            iniset /$Q_PLUGIN_CONF_FILE AGENT domu_root_helper "$Q_RR_COMMAND"
-            # Plug the vm interface into the domU integration bridge.
-            sudo ip addr flush dev $GUEST_INTERFACE_DEFAULT
-            sudo ip link set $OVS_BRIDGE up
-            # Assign the VM IP only if it has been set explicitly
-            if [[ "$VM_IP" != "" ]]; then
-                sudo ip addr add $VM_IP dev $OVS_BRIDGE
-            fi
-            sudo ovs-vsctl add-port $OVS_BRIDGE $GUEST_INTERFACE_DEFAULT
-        fi
-    fi
-}
-
-function _configure_quantum_plugin_agent_ryu() {
-    # Set up integration bridge
-    OVS_BRIDGE=${OVS_BRIDGE:-br-int}
-    _quantum_setup_ovs_bridge $OVS_BRIDGE
-    if [ -n "$RYU_INTERNAL_INTERFACE" ]; then
-        sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_BRIDGE $RYU_INTERNAL_INTERFACE
-    fi
-    AGENT_BINARY="$QUANTUM_DIR/quantum/plugins/ryu/agent/ryu_quantum_agent.py"
+    quantum_plugin_configure_plugin_agent
 }
 
 # _configure_quantum_service() - Set config files for quantum service
@@ -674,57 +508,7 @@
     _quantum_setup_keystone $Q_API_PASTE_FILE filter:authtoken
 
     # Configure plugin
-    if [[ "$Q_PLUGIN" = "openvswitch" ]]; then
-        if [[ "$ENABLE_TENANT_TUNNELS" = "True" ]]; then
-            iniset /$Q_PLUGIN_CONF_FILE OVS tenant_network_type gre
-            iniset /$Q_PLUGIN_CONF_FILE OVS tunnel_id_ranges $TENANT_TUNNEL_RANGES
-        elif [[ "$ENABLE_TENANT_VLANS" = "True" ]]; then
-            iniset /$Q_PLUGIN_CONF_FILE OVS tenant_network_type vlan
-        else
-            echo "WARNING - The openvswitch plugin is using local tenant networks, with no connectivity between hosts."
-        fi
-
-        # Override ``OVS_VLAN_RANGES`` and ``OVS_BRIDGE_MAPPINGS`` in ``localrc``
-        # for more complex physical network configurations.
-        if [[ "$OVS_VLAN_RANGES" = "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]]; then
-            OVS_VLAN_RANGES=$PHYSICAL_NETWORK
-            if [[ "$TENANT_VLAN_RANGE" != "" ]]; then
-                OVS_VLAN_RANGES=$OVS_VLAN_RANGES:$TENANT_VLAN_RANGE
-            fi
-        fi
-        if [[ "$OVS_VLAN_RANGES" != "" ]]; then
-            iniset /$Q_PLUGIN_CONF_FILE OVS network_vlan_ranges $OVS_VLAN_RANGES
-        fi
-
-        # Enable tunnel networks if selected
-        if [[ $OVS_ENABLE_TUNNELING = "True" ]]; then
-            iniset /$Q_PLUGIN_CONF_FILE OVS enable_tunneling True
-        fi
-    elif [[ "$Q_PLUGIN" = "linuxbridge" ]]; then
-        if [[ "$ENABLE_TENANT_VLANS" = "True" ]]; then
-            iniset /$Q_PLUGIN_CONF_FILE VLANS tenant_network_type vlan
-        else
-            echo "WARNING - The linuxbridge plugin is using local tenant networks, with no connectivity between hosts."
-        fi
-
-        # Override ``LB_VLAN_RANGES`` and ``LB_INTERFACE_MAPPINGS`` in ``localrc``
-        # for more complex physical network configurations.
-        if [[ "$LB_VLAN_RANGES" = "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]]; then
-            LB_VLAN_RANGES=$PHYSICAL_NETWORK
-            if [[ "$TENANT_VLAN_RANGE" != "" ]]; then
-                LB_VLAN_RANGES=$LB_VLAN_RANGES:$TENANT_VLAN_RANGE
-            fi
-        fi
-        if [[ "$LB_VLAN_RANGES" != "" ]]; then
-            iniset /$Q_PLUGIN_CONF_FILE VLANS network_vlan_ranges $LB_VLAN_RANGES
-        fi
-    elif [[ "$Q_PLUGIN" = "ryu" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE OVS openflow_controller $RYU_OFP_HOST:$RYU_OFP_PORT
-        iniset /$Q_PLUGIN_CONF_FILE OVS openflow_rest_api $RYU_API_HOST:$RYU_API_PORT
-    elif [[ "$Q_PLUGIN" = "bigswitch_floodlight" ]]; then
-        iniset /$Q_PLUGIN_CONF_FILE RESTPROXY servers $BS_FL_CONTROLLERS_PORT
-        iniset /$Q_PLUGIN_CONF_FILE RESTPROXY servertimeout $BS_FL_CONTROLLER_TIMEOUT
-    fi
+    quantum_plugin_configure_service
 }
 
 # Utility Functions
@@ -784,32 +568,8 @@
     rm -f $QUANTUM_AUTH_CACHE_DIR/*
 }
 
-function _quantum_setup_ovs_bridge() {
-    local bridge=$1
-    quantum-ovs-cleanup --ovs_integration_bridge $bridge
-    sudo ovs-vsctl --no-wait -- --may-exist add-br $bridge
-    sudo ovs-vsctl --no-wait br-set-external-id $bridge bridge-id $bridge
-}
-
 function _quantum_setup_interface_driver() {
-    local conf_file=$1
-    if [[ "$Q_PLUGIN" == "openvswitch" ]]; then
-        iniset $conf_file DEFAULT interface_driver quantum.agent.linux.interface.OVSInterfaceDriver
-    elif [[ "$Q_PLUGIN" = "linuxbridge" ]]; then
-        iniset $conf_file DEFAULT interface_driver quantum.agent.linux.interface.BridgeInterfaceDriver
-    elif [[ "$Q_PLUGIN" = "ryu" ]]; then
-        iniset $conf_file DEFAULT interface_driver quantum.agent.linux.interface.RyuInterfaceDriver
-    elif [[ "$Q_PLUGIN" = "bigswitch_floodlight" ]]; then
-        iniset $conf_file DEFAULT interface_driver quantum.agent.linux.interface.OVSInterfaceDriver
-    fi
-}
-
-function _quantum_setup_external_bridge() {
-    local bridge=$1
-    quantum-ovs-cleanup --external_network_bridge $bridge
-    sudo ovs-vsctl --no-wait -- --may-exist add-br $bridge
-    # ensure no IP is configured on the public bridge
-    sudo ip addr flush dev $bridge
+    quantum_plugin_setup_interface_driver $1
 }
 
 # Functions for Quantum Exercises
@@ -886,55 +646,45 @@
 
 # Quantum 3rd party programs
 #---------------------------
-# A comma-separated list of 3rd party programs
-QUANTUM_THIRD_PARTIES="ryu,bigswitch_floodlight"
-for third_party in ${QUANTUM_THIRD_PARTIES//,/ }; do
-    source lib/$third_party
+# please refer to lib/quantum_thirdparty/README.md for details
+QUANTUM_THIRD_PARTIES=""
+for f in $TOP_DIR/lib/quantum_thirdparty/*; do
+     third_party=$(basename $f)
+     if is_service_enabled $third_party; then
+         source $TOP_DIR/lib/quantum_thirdparty/$third_party
+         QUANTUM_THIRD_PARTIES="$QUANTUM_THIRD_PARTIES,$third_party"
+     fi
 done
 
+function _quantum_third_party_do() {
+    for third_party in ${QUANTUM_THIRD_PARTIES//,/ }; do
+        ${1}_${third_party}
+    done
+}
+
 # configure_quantum_third_party() - Set config files, create data dirs, etc
 function configure_quantum_third_party() {
-    for third_party in ${QUANTUM_THIRD_PARTIES//,/ }; do
-        if is_service_enabled $third_party; then
-            configure_${third_party}
-        fi
-    done
+    _quantum_third_party_do configure
 }
 
 # init_quantum_third_party() - Initialize databases, etc.
 function init_quantum_third_party() {
-    for third_party in ${QUANTUM_THIRD_PARTIES//,/ }; do
-        if is_service_enabled $third_party; then
-            init_${third_party}
-        fi
-    done
+    _quantum_third_party_do init
 }
 
 # install_quantum_third_party() - Collect source and prepare
 function install_quantum_third_party() {
-    for third_party in ${QUANTUM_THIRD_PARTIES//,/ }; do
-        if is_service_enabled $third_party; then
-            install_${third_party}
-        fi
-    done
+    _quantum_third_party_do install
 }
 
 # start_quantum_third_party() - Start running processes, including screen
 function start_quantum_third_party() {
-    for third_party in ${QUANTUM_THIRD_PARTIES//,/ }; do
-        if is_service_enabled $third_party; then
-            start_${third_party}
-        fi
-    done
+    _quantum_third_party_do start
 }
 
 # stop_quantum_third_party - Stop running processes (non-screen)
 function stop_quantum_third_party() {
-    for third_party in ${QUANTUM_THIRD_PARTIES//,/ }; do
-        if is_service_enabled $third_party; then
-            stop_${third_party}
-        fi
-    done
+    _quantum_third_party_do stop
 }
 
 
diff --git a/lib/quantum_plugins/README.md b/lib/quantum_plugins/README.md
new file mode 100644
index 0000000..a66d35a
--- /dev/null
+++ b/lib/quantum_plugins/README.md
@@ -0,0 +1,34 @@
+Quantum plugin specific files
+=============================
+Quantum plugins require plugin specific behavior.
+The files under the directory, ``lib/quantum_plugins/``, will be used
+when their service is enabled.
+Each plugin has ``lib/quantum_plugins/$Q_PLUGIN`` and define the following
+functions.
+Plugin specific configuration variables should be in this file.
+
+* filename: ``$Q_PLUGIN``
+  * The corresponding file name MUST be the same to plugin name ``$Q_PLUGIN``.
+    Plugin specific configuration variables should be in this file.
+
+functions
+---------
+``lib/quantum`` calls the following functions when the ``$Q_PLUGIN`` is enabled
+
+* ``quantum_plugin_create_nova_conf`` :
+  set ``NOVA_VIF_DRIVER`` and optionally set options in nova_conf
+  e.g.
+  NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver"}
+* ``quantum_plugin_install_agent_packages`` :
+  install packages that is specific to plugin agent
+  e.g.
+  install_package bridge-utils
+* ``quantum_plugin_configure_common`` :
+  set plugin-specific variables, ``Q_PLUGIN_CONF_PATH``, ``Q_PLUGIN_CONF_FILENAME``,
+  ``Q_DB_NAME``, ``Q_PLUGIN_CLASS``
+* ``quantum_plugin_configure_debug_command``
+* ``quantum_plugin_configure_dhcp_agent``
+* ``quantum_plugin_configure_l3_agent``
+* ``quantum_plugin_configure_plugin_agent``
+* ``quantum_plugin_configure_service``
+* ``quantum_plugin_setup_interface_driver``
diff --git a/lib/quantum_plugins/bigswitch_floodlight b/lib/quantum_plugins/bigswitch_floodlight
new file mode 100644
index 0000000..35276a5
--- /dev/null
+++ b/lib/quantum_plugins/bigswitch_floodlight
@@ -0,0 +1,55 @@
+# Quantum Big Switch/FloodLight plugin
+# ------------------------------------
+
+# Save trace setting
+XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+source $TOP_DIR/lib/quantum_plugins/ovs_base
+source $TOP_DIR/lib/quantum_thirdparty/bigswitch_floodlight     # for third party service specific configuration values
+
+function quantum_plugin_create_nova_conf() {
+    NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver"}
+}
+
+function quantum_plugin_install_agent_packages() {
+    _quantum_ovs_base_install_agent_packages
+}
+
+function quantum_plugin_configure_common() {
+    Q_PLUGIN_CONF_PATH=etc/quantum/plugins/bigswitch
+    Q_PLUGIN_CONF_FILENAME=restproxy.ini
+    Q_DB_NAME="restproxy_quantum"
+    Q_PLUGIN_CLASS="quantum.plugins.bigswitch.plugin.QuantumRestProxyV2"
+    BS_FL_CONTROLLERS_PORT=${BS_FL_CONTROLLERS_PORT:-localhost:80}
+    BS_FL_CONTROLLER_TIMEOUT=${BS_FL_CONTROLLER_TIMEOUT:-10}
+}
+
+function quantum_plugin_configure_debug_command() {
+    _quantum_ovs_base_configure_debug_command
+}
+
+function quantum_plugin_configure_dhcp_agent() {
+    :
+}
+
+function quantum_plugin_configure_l3_agent() {
+    _quantum_ovs_base_configure_l3_agent
+}
+
+function quantum_plugin_configure_plugin_agent() {
+    :
+}
+
+function quantum_plugin_configure_service() {
+    iniset /$Q_PLUGIN_CONF_FILE RESTPROXY servers $BS_FL_CONTROLLERS_PORT
+    iniset /$Q_PLUGIN_CONF_FILE RESTPROXY servertimeout $BS_FL_CONTROLLER_TIMEOUT
+}
+
+function quantum_plugin_setup_interface_driver() {
+    local conf_file=$1
+    iniset $conf_file DEFAULT interface_driver quantum.agent.linux.interface.OVSInterfaceDriver
+}
+
+# Restore xtrace
+$XTRACE
diff --git a/lib/quantum_plugins/linuxbridge b/lib/quantum_plugins/linuxbridge
new file mode 100644
index 0000000..e8ba68c
--- /dev/null
+++ b/lib/quantum_plugins/linuxbridge
@@ -0,0 +1,79 @@
+# Quantum Linux Bridge plugin
+# ---------------------------
+
+# Save trace setting
+XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+function is_quantum_ovs_base_plugin() {
+    # linuxbridge doesn't use OVS
+    return 1
+}
+
+function quantum_plugin_create_nova_conf() {
+    NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.QuantumLinuxBridgeVIFDriver"}
+}
+
+function quantum_plugin_install_agent_packages() {
+    install_package bridge-utils
+}
+
+function quantum_plugin_configure_common() {
+    Q_PLUGIN_CONF_PATH=etc/quantum/plugins/linuxbridge
+    Q_PLUGIN_CONF_FILENAME=linuxbridge_conf.ini
+    Q_DB_NAME="quantum_linux_bridge"
+    Q_PLUGIN_CLASS="quantum.plugins.linuxbridge.lb_quantum_plugin.LinuxBridgePluginV2"
+}
+
+function quantum_plugin_configure_debug_command() {
+    iniset $QUANTUM_TEST_CONFIG_FILE DEFAULT external_network_bridge
+}
+
+function quantum_plugin_configure_dhcp_agent() {
+    :
+}
+
+function quantum_plugin_configure_l3_agent() {
+    iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge
+}
+
+function quantum_plugin_configure_plugin_agent() {
+    # Setup physical network interface mappings.  Override
+    # ``LB_VLAN_RANGES`` and ``LB_INTERFACE_MAPPINGS`` in ``localrc`` for more
+    # complex physical network configurations.
+    if [[ "$LB_INTERFACE_MAPPINGS" = "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$LB_PHYSICAL_INTERFACE" != "" ]]; then
+        LB_INTERFACE_MAPPINGS=$PHYSICAL_NETWORK:$LB_PHYSICAL_INTERFACE
+    fi
+    if [[ "$LB_INTERFACE_MAPPINGS" != "" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE LINUX_BRIDGE physical_interface_mappings $LB_INTERFACE_MAPPINGS
+    fi
+    AGENT_BINARY="$QUANTUM_DIR/bin/quantum-linuxbridge-agent"
+}
+
+function quantum_plugin_configure_service() {
+    if [[ "$ENABLE_TENANT_VLANS" = "True" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE VLANS tenant_network_type vlan
+    else
+        echo "WARNING - The linuxbridge plugin is using local tenant networks, with no connectivity between hosts."
+    fi
+
+    # Override ``LB_VLAN_RANGES`` and ``LB_INTERFACE_MAPPINGS`` in ``localrc``
+    # for more complex physical network configurations.
+    if [[ "$LB_VLAN_RANGES" = "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]]; then
+        LB_VLAN_RANGES=$PHYSICAL_NETWORK
+        if [[ "$TENANT_VLAN_RANGE" != "" ]]; then
+            LB_VLAN_RANGES=$LB_VLAN_RANGES:$TENANT_VLAN_RANGE
+        fi
+    fi
+    if [[ "$LB_VLAN_RANGES" != "" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE VLANS network_vlan_ranges $LB_VLAN_RANGES
+    fi
+}
+
+function quantum_plugin_setup_interface_driver() {
+    local conf_file=$1
+    iniset $conf_file DEFAULT interface_driver quantum.agent.linux.interface.BridgeInterfaceDriver
+}
+
+# Restore xtrace
+$XTRACE
diff --git a/lib/quantum_plugins/openvswitch b/lib/quantum_plugins/openvswitch
new file mode 100644
index 0000000..5415e86
--- /dev/null
+++ b/lib/quantum_plugins/openvswitch
@@ -0,0 +1,144 @@
+# Quantum Open vSwtich plugin
+# ---------------------------
+
+# Save trace setting
+XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+source $TOP_DIR/lib/quantum_plugins/ovs_base
+
+function quantum_plugin_create_nova_conf() {
+    NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver"}
+    if [ "$VIRT_DRIVER" = 'xenserver' ]; then
+        iniset $NOVA_CONF DEFAULT xenapi_vif_driver nova.virt.xenapi.vif.XenAPIOpenVswitchDriver
+        iniset $NOVA_CONF DEFAULT xenapi_ovs_integration_bridge $FLAT_NETWORK_BRIDGE
+    fi
+}
+
+function quantum_plugin_install_agent_packages() {
+    _quantum_ovs_base_install_agent_packages
+}
+
+function quantum_plugin_configure_common() {
+    Q_PLUGIN_CONF_PATH=etc/quantum/plugins/openvswitch
+    Q_PLUGIN_CONF_FILENAME=ovs_quantum_plugin.ini
+    Q_DB_NAME="ovs_quantum"
+    Q_PLUGIN_CLASS="quantum.plugins.openvswitch.ovs_quantum_plugin.OVSQuantumPluginV2"
+}
+
+function quantum_plugin_configure_debug_command() {
+    _quantum_ovs_base_configure_debug_command
+}
+
+function quantum_plugin_configure_dhcp_agent() {
+    :
+}
+
+function quantum_plugin_configure_l3_agent() {
+    _quantum_ovs_base_configure_l3_agent
+}
+
+function quantum_plugin_configure_plugin_agent() {
+    # Setup integration bridge
+    OVS_BRIDGE=${OVS_BRIDGE:-br-int}
+    _quantum_ovs_base_setup_bridge $OVS_BRIDGE
+
+    # Setup agent for tunneling
+    if [[ "$OVS_ENABLE_TUNNELING" = "True" ]]; then
+        # Verify tunnels are supported
+        # REVISIT - also check kernel module support for GRE and patch ports
+        OVS_VERSION=`ovs-vsctl --version | head -n 1 | awk '{print $4;}'`
+        if [ $OVS_VERSION \< "1.4" ] && ! is_service_enabled q-svc ; then
+            echo "You are running OVS version $OVS_VERSION."
+            echo "OVS 1.4+ is required for tunneling between multiple hosts."
+            exit 1
+        fi
+        iniset /$Q_PLUGIN_CONF_FILE OVS enable_tunneling True
+        iniset /$Q_PLUGIN_CONF_FILE OVS local_ip $HOST_IP
+    fi
+
+    # Setup physical network bridge mappings.  Override
+    # ``OVS_VLAN_RANGES`` and ``OVS_BRIDGE_MAPPINGS`` in ``localrc`` for more
+    # complex physical network configurations.
+    if [[ "$OVS_BRIDGE_MAPPINGS" = "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]] && [[ "$OVS_PHYSICAL_BRIDGE" != "" ]]; then
+        OVS_BRIDGE_MAPPINGS=$PHYSICAL_NETWORK:$OVS_PHYSICAL_BRIDGE
+
+        # Configure bridge manually with physical interface as port for multi-node
+        sudo ovs-vsctl --no-wait -- --may-exist add-br $OVS_PHYSICAL_BRIDGE
+    fi
+    if [[ "$OVS_BRIDGE_MAPPINGS" != "" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE OVS bridge_mappings $OVS_BRIDGE_MAPPINGS
+    fi
+    AGENT_BINARY="$QUANTUM_DIR/bin/quantum-openvswitch-agent"
+
+    if [ "$VIRT_DRIVER" = 'xenserver' ]; then
+        # Nova will always be installed along with quantum for a domU
+        # devstack install, so it should be safe to rely on nova.conf
+        # for xenapi configuration.
+        Q_RR_DOM0_COMMAND="$QUANTUM_DIR/bin/quantum-rootwrap-dom0 $NOVA_CONF"
+        # Under XS/XCP, the ovs agent needs to target the dom0
+        # integration bridge.  This is enabled by using a root wrapper
+        # that executes commands on dom0 via a XenAPI plugin.
+        iniset /$Q_PLUGIN_CONF_FILE AGENT root_helper "$Q_RR_DOM0_COMMAND"
+
+        # FLAT_NETWORK_BRIDGE is the dom0 integration bridge.  To
+        # ensure the bridge lacks direct connectivity, set
+        # VM_VLAN=-1;VM_DEV=invalid in localrc
+        iniset /$Q_PLUGIN_CONF_FILE OVS integration_bridge $FLAT_NETWORK_BRIDGE
+
+        # The ovs agent needs to ensure that the ports associated with
+        # a given network share the same local vlan tag.  On
+        # single-node XS/XCP, this requires monitoring both the dom0
+        # bridge, where VM's are attached, and the domU bridge, where
+        # dhcp servers are attached.
+        if is_service_enabled q-dhcp; then
+            iniset /$Q_PLUGIN_CONF_FILE OVS domu_integration_bridge $OVS_BRIDGE
+            # DomU will use the regular rootwrap
+            iniset /$Q_PLUGIN_CONF_FILE AGENT domu_root_helper "$Q_RR_COMMAND"
+            # Plug the vm interface into the domU integration bridge.
+            sudo ip addr flush dev $GUEST_INTERFACE_DEFAULT
+            sudo ip link set $OVS_BRIDGE up
+            # Assign the VM IP only if it has been set explicitly
+            if [[ "$VM_IP" != "" ]]; then
+                sudo ip addr add $VM_IP dev $OVS_BRIDGE
+            fi
+            sudo ovs-vsctl add-port $OVS_BRIDGE $GUEST_INTERFACE_DEFAULT
+        fi
+    fi
+}
+
+function quantum_plugin_configure_service() {
+    if [[ "$ENABLE_TENANT_TUNNELS" = "True" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE OVS tenant_network_type gre
+        iniset /$Q_PLUGIN_CONF_FILE OVS tunnel_id_ranges $TENANT_TUNNEL_RANGES
+    elif [[ "$ENABLE_TENANT_VLANS" = "True" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE OVS tenant_network_type vlan
+    else
+        echo "WARNING - The openvswitch plugin is using local tenant networks, with no connectivity between hosts."
+    fi
+
+    # Override ``OVS_VLAN_RANGES`` and ``OVS_BRIDGE_MAPPINGS`` in ``localrc``
+    # for more complex physical network configurations.
+    if [[ "$OVS_VLAN_RANGES" = "" ]] && [[ "$PHYSICAL_NETWORK" != "" ]]; then
+        OVS_VLAN_RANGES=$PHYSICAL_NETWORK
+        if [[ "$TENANT_VLAN_RANGE" != "" ]]; then
+            OVS_VLAN_RANGES=$OVS_VLAN_RANGES:$TENANT_VLAN_RANGE
+        fi
+    fi
+    if [[ "$OVS_VLAN_RANGES" != "" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE OVS network_vlan_ranges $OVS_VLAN_RANGES
+    fi
+
+    # Enable tunnel networks if selected
+    if [[ $OVS_ENABLE_TUNNELING = "True" ]]; then
+        iniset /$Q_PLUGIN_CONF_FILE OVS enable_tunneling True
+    fi
+}
+
+function quantum_plugin_setup_interface_driver() {
+    local conf_file=$1
+    iniset $conf_file DEFAULT interface_driver quantum.agent.linux.interface.OVSInterfaceDriver
+}
+
+# Restore xtrace
+$XTRACE
diff --git a/lib/quantum_plugins/ovs_base b/lib/quantum_plugins/ovs_base
new file mode 100644
index 0000000..d9f6fd0
--- /dev/null
+++ b/lib/quantum_plugins/ovs_base
@@ -0,0 +1,49 @@
+# common functions for ovs based plugin
+# -------------------------------------
+
+# Save trace setting
+XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+function is_quantum_ovs_base_plugin() {
+    # Yes, we use OVS.
+    return 0
+}
+
+function _quantum_ovs_base_setup_bridge() {
+    local bridge=$1
+    quantum-ovs-cleanup --ovs_integration_bridge $bridge
+    sudo ovs-vsctl --no-wait -- --may-exist add-br $bridge
+    sudo ovs-vsctl --no-wait br-set-external-id $bridge bridge-id $bridge
+}
+
+function _quantum_ovs_base_install_agent_packages() {
+    local kernel_version
+    # Install deps
+    # FIXME add to ``files/apts/quantum``, but don't install if not needed!
+    if is_ubuntu; then
+        kernel_version=`cat /proc/version | cut -d " " -f3`
+        install_package make fakeroot dkms openvswitch-switch openvswitch-datapath-dkms linux-headers-$kernel_version
+    else
+        ### FIXME(dtroyer): Find RPMs for OpenVSwitch
+        echo "OpenVSwitch packages need to be located"
+        # Fedora does not started OVS by default
+        restart_service openvswitch
+    fi
+}
+
+function _quantum_ovs_base_configure_debug_command() {
+    iniset $QUANTUM_TEST_CONFIG_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
+}
+
+function _quantum_ovs_base_configure_l3_agent() {
+    iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
+
+    quantum-ovs-cleanup --external_network_bridge $PUBLIC_BRIDGE
+    sudo ovs-vsctl --no-wait -- --may-exist add-br $PUBLIC_BRIDGE
+    # ensure no IP is configured on the public bridge
+    sudo ip addr flush dev $PUBLIC_BRIDGE
+}
+
+# Restore xtrace
+$XTRACE
diff --git a/lib/quantum_plugins/ryu b/lib/quantum_plugins/ryu
new file mode 100644
index 0000000..86105bc
--- /dev/null
+++ b/lib/quantum_plugins/ryu
@@ -0,0 +1,63 @@
+# Quantum Ryu plugin
+# ------------------
+
+# Save trace setting
+XTRACE=$(set +o | grep xtrace)
+set +o xtrace
+
+source $TOP_DIR/lib/quantum_plugins/ovs_base
+source $TOP_DIR/lib/quantum_thirdparty/ryu      # for configuration value
+
+function quantum_plugin_create_nova_conf() {
+    NOVA_VIF_DRIVER=${NOVA_VIF_DRIVER:-"nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver"}
+    iniset $NOVA_CONF DEFAULT libvirt_ovs_integration_bridge "$OVS_BRIDGE"
+}
+
+function quantum_plugin_install_agent_packages() {
+    _quantum_ovs_base_install_agent_packages
+}
+
+function quantum_plugin_configure_common() {
+    Q_PLUGIN_CONF_PATH=etc/quantum/plugins/ryu
+    Q_PLUGIN_CONF_FILENAME=ryu.ini
+    Q_DB_NAME="ovs_quantum"
+    Q_PLUGIN_CLASS="quantum.plugins.ryu.ryu_quantum_plugin.RyuQuantumPluginV2"
+}
+
+function quantum_plugin_configure_debug_command() {
+    _quantum_ovs_base_configure_debug_command
+    iniset $QUANTUM_TEST_CONFIG_FILE DEFAULT ryu_api_host $RYU_API_HOST:$RYU_API_PORT
+}
+
+function quantum_plugin_configure_dhcp_agent() {
+    iniset $Q_DHCP_CONF_FILE DEFAULT ryu_api_host $RYU_API_HOST:$RYU_API_PORT
+}
+
+function quantum_plugin_configure_l3_agent() {
+    iniset $Q_L3_CONF_FILE DEFAULT ryu_api_host $RYU_API_HOST:$RYU_API_PORT
+    _quantum_ovs_base_configure_l3_agent
+}
+
+function quantum_plugin_configure_plugin_agent() {
+    # Set up integration bridge
+    OVS_BRIDGE=${OVS_BRIDGE:-br-int}
+    _quantum_ovs_base_setup_bridge $OVS_BRIDGE
+    if [ -n "$RYU_INTERNAL_INTERFACE" ]; then
+        sudo ovs-vsctl --no-wait -- --may-exist add-port $OVS_BRIDGE $RYU_INTERNAL_INTERFACE
+    fi
+    iniset /$Q_PLUGIN_CONF_FILE OVS integration_bridge $OVS_BRIDGE
+    AGENT_BINARY="$QUANTUM_DIR/quantum/plugins/ryu/agent/ryu_quantum_agent.py"
+}
+
+function quantum_plugin_configure_service() {
+    iniset /$Q_PLUGIN_CONF_FILE OVS openflow_rest_api $RYU_API_HOST:$RYU_API_PORT
+}
+
+function quantum_plugin_setup_interface_driver() {
+    local conf_file=$1
+    iniset $conf_file DEFAULT interface_driver quantum.agent.linux.interface.OVSInterfaceDriver
+    iniset $conf_file DEFAULT ovs_use_veth True
+}
+
+# Restore xtrace
+$XTRACE
diff --git a/lib/quantum_thirdparty/README.md b/lib/quantum_thirdparty/README.md
new file mode 100644
index 0000000..3b5837d
--- /dev/null
+++ b/lib/quantum_thirdparty/README.md
@@ -0,0 +1,36 @@
+Quantum third party specific files
+==================================
+Some Quantum plugins require third party programs to function.
+The files under the directory, ``lib/quantum_thirdparty/``, will be used
+when their service are enabled.
+Third party program specific configuration variables should be in this file.
+
+* filename: ``<third_party>``
+  * The corresponding file name should be same to service name, ``<third_party>``.
+
+functions
+---------
+``lib/quantum`` calls the following functions when the ``<third_party>`` is enabled
+
+functions to be implemented
+* ``configure_<third_party>``:
+  set config files, create data dirs, etc
+  e.g.
+  sudo python setup.py deploy
+  iniset $XXXX_CONF...
+
+* ``init_<third_party>``:
+  initialize databases, etc
+
+* ``install_<third_party>``:
+  collect source and prepare
+  e.g.
+  git clone xxx
+
+* ``start_<third_party>``:
+  start running processes, including screen
+  e.g.
+  screen_it XXXX "cd $XXXXY_DIR && $XXXX_DIR/bin/XXXX-bin"
+
+* ``stop_<third_party>``:
+  stop running processes (non-screen)
diff --git a/lib/bigswitch_floodlight b/lib/quantum_thirdparty/bigswitch_floodlight
similarity index 100%
rename from lib/bigswitch_floodlight
rename to lib/quantum_thirdparty/bigswitch_floodlight
diff --git a/lib/ryu b/lib/quantum_thirdparty/ryu
similarity index 69%
rename from lib/ryu
rename to lib/quantum_thirdparty/ryu
index 1292313..f11951a 100644
--- a/lib/ryu
+++ b/lib/quantum_thirdparty/ryu
@@ -17,6 +17,21 @@
 RYU_OFP_PORT=${RYU_OFP_PORT:-6633}
 # Ryu Applications
 RYU_APPS=${RYU_APPS:-ryu.app.simple_isolation,ryu.app.rest}
+# Ryu configuration
+RYU_CONF_CONTENTS=${RYU_CONF_CONTENTS:-"
+--app_lists=$RYU_APPS
+--wsapi_host=$RYU_API_HOST
+--wsapi_port=$RYU_API_PORT
+--ofp_listen_host=$RYU_OFP_HOST
+--ofp_tcp_listen_port=$RYU_OFP_PORT
+--quantum_url=http://$Q_HOST:$Q_PORT
+--quantum_admin_username=$Q_ADMIN_USERNAME
+--quantum_admin_password=$SERVICE_PASSWORD
+--quantum_admin_tenant_name=$SERVICE_TENANT_NAME
+--quantum_admin_auth_url=$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_AUTH_PORT/v2.0
+--quantum_auth_strategy=$Q_AUTH_STRATEGY
+--quantum_controller_addr=tcp:$RYU_OFP_HOST:$RYU_OFP_PORT
+"}
 
 function configure_ryu() {
     setup_develop $RYU_DIR
@@ -31,26 +46,13 @@
     RYU_CONF=$RYU_CONF_DIR/ryu.conf
     sudo rm -rf $RYU_CONF
 
-    cat <<EOF > $RYU_CONF
---app_lists=$RYU_APPS
---wsapi_host=$RYU_API_HOST
---wsapi_port=$RYU_API_PORT
---ofp_listen_host=$RYU_OFP_HOST
---ofp_tcp_listen_port=$RYU_OFP_PORT
-EOF
+    echo "${RYU_CONF_CONTENTS}" > $RYU_CONF
 }
 
 function install_ryu() {
     git_clone $RYU_REPO $RYU_DIR $RYU_BRANCH
 }
 
-function is_ryu_required() {
-    if is_service_enabled ryu || (is_service_enabled quantum && [[ "$Q_PLUGIN" = "ryu" ]]); then
-        return 0
-    fi
-    return 1
-}
-
 function start_ryu() {
     screen_it ryu "cd $RYU_DIR && $RYU_DIR/bin/ryu-manager --flagfile $RYU_CONF"
 }
diff --git a/lib/tempest b/lib/tempest
index c08a430..4d91d90 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -5,7 +5,7 @@
 # ``functions`` file
 # ``lib/nova`` service is runing
 # <list other global vars that are assumed to be defined>
-# - ``DEST``
+# - ``DEST``, ``FILES``
 # - ``ADMIN_PASSWORD``
 # - ``DEFAULT_IMAGE_NAME``
 # - ``S3_SERVICE_PORT``
@@ -16,10 +16,9 @@
 # - ``Q_ROUTER_NAME``
 # - ``VIRT_DRIVER``
 # - ``LIBVIRT_TYPE``
+# - ``KEYSTONE_SERVICE_PROTOCOL``, ``KEYSTONE_SERVICE_HOST`` from lib/keystone
 # Optional Dependencies:
-# IDENTITY_USE_SSL, IDENTITY_HOST, IDENTITY_PORT, IDENTITY_PATH
 # ALT_* (similar vars exists in keystone_data.sh)
-# ``IMAGE_PORT``, ``IMAGE_HOST``
 # ``LIVE_MIGRATION_AVAILABLE``
 # ``USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION``
 # ``DEFAULT_INSTANCE_TYPE``
@@ -49,7 +48,7 @@
 BUILD_TIMEOUT=400
 
 
-BOTO_MATERIALS_PATH="$DEST/devstack/files/images/s3-materials/cirros-0.3.0"
+BOTO_MATERIALS_PATH="$FILES/images/s3-materials/cirros-0.3.0"
 
 # Entry Points
 # ------------
@@ -124,13 +123,6 @@
     # copy every time, because the image UUIDS are going to change
     cp $TEMPEST_CONF.sample $TEMPEST_CONF
 
-    IDENTITY_USE_SSL=${IDENTITY_USE_SSL:-False}
-    IDENTITY_HOST=${IDENTITY_HOST:-127.0.0.1}
-    IDENTITY_PORT=${IDENTITY_PORT:-5000}
-    # TODO(jaypipes): This is dumb and needs to be removed
-    # from the Tempest configuration file entirely...
-    IDENTITY_PATH=${IDENTITY_PATH:-tokens}
-
     password=${ADMIN_PASSWORD:-secrete}
 
     # See files/keystone_data.sh where alt_demo user
@@ -203,15 +195,19 @@
     iniset $TEMPEST_CONF boto build_interval $BUILD_INTERVAL
     iniset $TEMPEST_CONF boto http_socket_timeout 5
 
-    iniset $TEMPEST_CONF identity use_ssl $IDENTITY_USE_SSL
-    iniset $TEMPEST_CONF identity host $IDENTITY_HOST
-    iniset $TEMPEST_CONF identity port $IDENTITY_PORT
-    iniset $TEMPEST_CONF identity path $IDENTITY_PATH
+    # Identity
+    iniset $TEMPEST_CONF identity uri "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:5000/v2.0/"
+    iniset $TEMPEST_CONF identity password "$password"
+    iniset $TEMPEST_CONF identity alt_username $ALT_USERNAME
+    iniset $TEMPEST_CONF identity alt_password "$password"
+    iniset $TEMPEST_CONF identity alt_tenant_name $ALT_TENANT_NAME
+    iniset $TEMPEST_CONF identity admin_password "$password"
 
-    iniset $TEMPEST_CONF compute password "$password"
-    iniset $TEMPEST_CONF compute alt_username $ALT_USERNAME
-    iniset $TEMPEST_CONF compute alt_password "$password"
-    iniset $TEMPEST_CONF compute alt_tenant_name $ALT_TENANT_NAME
+    # Compute
+    iniset $TEMPEST_CONF compute password "$password" # DEPRECATED
+    iniset $TEMPEST_CONF compute alt_username $ALT_USERNAME # DEPRECATED
+    iniset $TEMPEST_CONF compute alt_password "$password" # DEPRECATED
+    iniset $TEMPEST_CONF compute alt_tenant_name $ALT_TENANT_NAME # DEPRECATED
     iniset $TEMPEST_CONF compute resize_available False
     iniset $TEMPEST_CONF compute change_password_available False
     iniset $TEMPEST_CONF compute compute_log_level ERROR
@@ -223,41 +219,47 @@
     iniset $TEMPEST_CONF compute allow_tenant_isolation ${TEMPEST_ALLOW_TENANT_ISOLATION:-True}
     #Skip until #1074039 is fixed
     iniset $TEMPEST_CONF compute run_ssh False
-    iniset $TEMPEST_CONF compute ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
+    iniset $TEMPEST_CONF compute ssh_user ${DEFAULT_INSTANCE_USER:-cirros} # DEPRECATED
     iniset $TEMPEST_CONF compute network_for_ssh $PRIVATE_NETWORK_NAME
     iniset $TEMPEST_CONF compute ip_version_for_ssh 4
     iniset $TEMPEST_CONF compute ssh_timeout $BUILD_TIMEOUT
     iniset $TEMPEST_CONF compute image_ref $image_uuid
+    iniset $TEMPEST_CONF compute image_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
     iniset $TEMPEST_CONF compute image_ref_alt $image_uuid_alt
+    iniset $TEMPEST_CONF compute image_alt_ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
     iniset $TEMPEST_CONF compute flavor_ref $flavor_ref
     iniset $TEMPEST_CONF compute flavor_ref_alt $flavor_ref_alt
-    iniset $TEMPEST_CONF compute source_dir $NOVA_SOURCE_DIR
     iniset $TEMPEST_CONF compute live_migration_available ${LIVE_MIGRATION_AVAILABLE:-False}
     iniset $TEMPEST_CONF compute use_block_migration_for_live_migration ${USE_BLOCK_MIGRATION_FOR_LIVE_MIGRATION:-False}
-    # Inherited behavior, might be wrong
-    iniset $TEMPEST_CONF compute bin_dir $NOVA_BIN_DIR
+    iniset $TEMPEST_CONF compute source_dir $NOVA_SOURCE_DIR # DEPRECATED
+    iniset $TEMPEST_CONF compute bin_dir $NOVA_BIN_DIR # DEPRECATED
+    iniset $TEMPEST_CONF compute path_to_private_key $TEMPEST_DIR/id_rsa # DEPRECATED
+    iniset $TEMPEST_CONF compute db_uri $BASE_SQL_CONN/nova # DEPRECATED
+
+    # Whitebox
+    iniset $TEMPEST_CONF whitebox source_dir $NOVA_SOURCE_DIR
+    iniset $TEMPEST_CONF whitebox bin_dir $NOVA_BIN_DIR
     # TODO(jaypipes): Create the key file here... right now, no whitebox
     # tests actually use a key.
-    iniset $TEMPEST_CONF compute path_to_private_key $TEMPEST_DIR/id_rsa
-    iniset $TEMPEST_CONF compute db_uri $BASE_SQL_CONN/nova
+    iniset $TEMPEST_CONF whitebox path_to_private_key $TEMPEST_DIR/id_rsa
+    iniset $TEMPEST_CONF whitebox db_uri $BASE_SQL_CONN/nova
+
 
     # image
-    iniset $TEMPEST_CONF image host ${IMAGE_HOST:-127.0.0.1}
-    iniset $TEMPEST_CONF image port ${IMAGE_PORT:-9292}
-    iniset $TEMPEST_CONF image password "$password"
+    iniset $TEMPEST_CONF image password "$password" # DEPRECATED
 
     # identity-admin
-    iniset $TEMPEST_CONF "identity-admin" password "$password"
+    iniset $TEMPEST_CONF "identity-admin" password "$password" # DEPRECATED
 
     # compute admin
-    iniset $TEMPEST_CONF "compute-admin" password "$password"
+    iniset $TEMPEST_CONF "compute-admin" password "$password" # DEPRECATED
 
     # network admin
-    iniset $TEMPEST_CONF "network-admin" password "$password"
+    iniset $TEMPEST_CONF "network-admin" password "$password" # DEPRECATED
 
     # network
     iniset $TEMPEST_CONF network api_version 2.0
-    iniset $TEMPEST_CONF network password "$password"
+    iniset $TEMPEST_CONF network password "$password" # DEPRECATED
     iniset $TEMPEST_CONF network tenant_networks_reachable "$tenant_networks_reachable"
     iniset $TEMPEST_CONF network public_network_id "$public_network_id"
     iniset $TEMPEST_CONF network public_router_id "$public_router_id"
@@ -268,6 +270,7 @@
     iniset $TEMPEST_CONF boto s3_materials_path "$BOTO_MATERIALS_PATH"
     iniset $TEMPEST_CONF boto instance_type "$boto_instance_type"
     iniset $TEMPEST_CONF boto http_socket_timeout 30
+    iniset $TEMPEST_CONF boto ssh_user ${DEFAULT_INSTANCE_USER:-cirros}
 
     echo "Created tempest configuration file:"
     cat $TEMPEST_CONF
@@ -291,8 +294,7 @@
 function init_tempest() {
     local base_image_name=cirros-0.3.0-x86_64
     # /opt/stack/devstack/files/images/cirros-0.3.0-x86_64-uec
-    local devstack_dir="$DEST/devstack"
-    local image_dir="$devstack_dir/files/images/${base_image_name}-uec"
+    local image_dir="$FILES/images/${base_image_name}-uec"
     local kernel="$image_dir/${base_image_name}-vmlinuz"
     local ramdisk="$image_dir/${base_image_name}-initrd"
     local disk_image="$image_dir/${base_image_name}-blank.img"
diff --git a/stack.sh b/stack.sh
index bf473ca..005d88e 100755
--- a/stack.sh
+++ b/stack.sh
@@ -313,6 +313,7 @@
 HORIZON_DIR=$DEST/horizon
 OPENSTACKCLIENT_DIR=$DEST/python-openstackclient
 NOVNC_DIR=$DEST/noVNC
+SPICE_DIR=$DEST/spice-html5
 SWIFT3_DIR=$DEST/swift3
 
 # Should cinder perform secure deletion of volumes?
@@ -716,6 +717,10 @@
     # a websockets/html5 or flash powered VNC console for vm instances
     git_clone $NOVNC_REPO $NOVNC_DIR $NOVNC_BRANCH
 fi
+if is_service_enabled n-spice; then
+    # a websockets/html5 or flash powered SPICE console for vm instances
+    git_clone $SPICE_REPO $SPICE_DIR $SPICE_BRANCH
+fi
 if is_service_enabled horizon; then
     # dashboard
     install_horizon
@@ -1008,17 +1013,38 @@
         iniset $NOVA_CONF DEFAULT novncproxy_base_url "$NOVNCPROXY_URL"
         XVPVNCPROXY_URL=${XVPVNCPROXY_URL:-"http://$SERVICE_HOST:6081/console"}
         iniset $NOVA_CONF DEFAULT xvpvncproxy_base_url "$XVPVNCPROXY_URL"
+        SPICEHTML5PROXY_URL=${SPICEHTML5PROXY_URL:-"http://$SERVICE_HOST:6082/spice_auto.html"}
+        iniset $NOVA_CONF spice html5proxy_base_url "$SPICEHTML5PROXY_URL"
     fi
     if [ "$VIRT_DRIVER" = 'xenserver' ]; then
         VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=169.254.0.1}
     else
         VNCSERVER_PROXYCLIENT_ADDRESS=${VNCSERVER_PROXYCLIENT_ADDRESS=127.0.0.1}
     fi
-    # Address on which instance vncservers will listen on compute hosts.
-    # For multi-host, this should be the management ip of the compute host.
-    VNCSERVER_LISTEN=${VNCSERVER_LISTEN=127.0.0.1}
-    iniset $NOVA_CONF DEFAULT vncserver_listen "$VNCSERVER_LISTEN"
-    iniset $NOVA_CONF DEFAULT vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+
+    if is_service_enabled n-novnc || is_service_enabled n-xvnc ; then
+      # Address on which instance vncservers will listen on compute hosts.
+      # For multi-host, this should be the management ip of the compute host.
+      VNCSERVER_LISTEN=${VNCSERVER_LISTEN=127.0.0.1}
+      iniset $NOVA_CONF DEFAULT vnc_enabled true
+      iniset $NOVA_CONF DEFAULT vncserver_listen "$VNCSERVER_LISTEN"
+      iniset $NOVA_CONF DEFAULT vncserver_proxyclient_address "$VNCSERVER_PROXYCLIENT_ADDRESS"
+    else
+      iniset $NOVA_CONF DEFAULT vnc_enabled false
+    fi
+
+    if is_service_enabled n-spice; then
+      # Address on which instance spiceservers will listen on compute hosts.
+      # For multi-host, this should be the management ip of the compute host.
+      SPICESERVER_PROXYCLIENT_ADDRESS=${SPICESERVER_PROXYCLIENT_ADDRESS=127.0.0.1}
+      SPICESERVER_LISTEN=${SPICESERVER_LISTEN=127.0.0.1}
+      iniset $NOVA_CONF spice enabled true
+      iniset $NOVA_CONF spice server_listen "$SPICESERVER_LISTEN"
+      iniset $NOVA_CONF spice server_proxyclient_address "$SPICESERVER_PROXYCLIENT_ADDRESS"
+    else
+      iniset $NOVA_CONF spice enabled false
+    fi
+
     iniset $NOVA_CONF DEFAULT ec2_dmz_host "$EC2_DMZ_HOST"
     iniset_rpc_backend nova $NOVA_CONF DEFAULT
     iniset $NOVA_CONF DEFAULT glance_api_servers "$GLANCE_HOSTPORT"
diff --git a/stackrc b/stackrc
index 8d19440..cfc4d1f 100644
--- a/stackrc
+++ b/stackrc
@@ -78,6 +78,10 @@
 NOVNC_REPO=https://github.com/kanaka/noVNC.git
 NOVNC_BRANCH=master
 
+# a websockets/html5 or flash powered SPICE console for vm instances
+SPICE_REPO=http://anongit.freedesktop.org/git/spice/spice-html5.git
+SPICE_BRANCH=master
+
 # django powered web control panel for openstack
 HORIZON_REPO=${GIT_BASE}/openstack/horizon.git
 HORIZON_BRANCH=master