Some USB devices are blocked by host policy

[Fred Brier]

I'm using Spice and want to share a USB device on workstation with a VM 
running on another physical host.  The filters are all set up for the VM 
in its domain XML.  The Spice "Select USB devices for redirection" 
dialog shows the device I want to redirect.  However, all the USB 
devices are greyed out and Alert text says, "Some USB devices are 
blocked by host policy".  My understanding, from the doc 
<https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/...;,

is that the following XML needs to be configured on the "host physical 
machine's domain XML" which I am interpreting as the workstation, 
although it could be the hypervisor host, to unblock the USB device:

<redirfilter>
   <usbdev class='0x08' vendor='0x0951' product='0x1625'
version='2.0' allow='yes'/>
   <usbdev allow='no'/>
</redirfilter>

Either way, I cannot figure out what the name or location of the file 
where this XML would go, let alone find a complete schema or example of 
what the file would look like.  Has anyone else done this?  Please... 
<gasp> Help!

[Richard W.M. Jones]

On Mon, Jan 05, 2015 at 09:08:15PM -0800, Frederick N. Brier wrote:
>  I'm using Spice and want to share a USB device on workstation
> with a
>  VM running on another physical host.  The filters are all set up for
>  the VM in its domain XML.  The Spice "Select USB devices for
>  redirection" dialog shows the device I want to redirect.  However,
>  all the USB devices are greyed out and Alert text says, "Some USB
>  devices are blocked by host policy".  My understanding, from the doc
> <https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/...;,
>  is that the following XML needs to be configured on the "host
>  physical machine's domain XML" 
^^ This sentence from the access.redhat.com documentation
seems very confusing ...

>  which I am interpreting as the
>  workstation, although it could be the hypervisor host, to unblock
>  the USB device:
>  
>  <redirfilter>
>    <usbdev class='0x08' vendor='0x0951' product='0x1625'
> version='2.0' allow='yes'/>
>    <usbdev allow='no'/>
>  </redirfilter>
>  
>  Either way, I cannot figure out what the name or location of the
>  file where this XML would go, let alone find a complete schema or
>  example of what the file would look like.  Has anyone else done
>  this?  Please... <gasp> Help! 
I've never used this feature either.  However the XML is libvirt XML
and must go into the libvirt guest configuration on the hypervisor.
Use this command to edit it:

  # virsh edit NameOfGuest

The specific XML is documented here:

  https://libvirt.org/formatdomain.html#elementsRedir

There is also an RNG file (ie schema) supplied in the libvirt upstream
sources.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-builder quickly builds VMs from scratch
http://libguestfs.org/virt-builder.1.html

[Cole Robinson]

On 01/06/2015 12:08 AM, Frederick N. Brier wrote:
>  I'm using Spice and want to share a USB device on workstation
> with a VM
>  running on another physical host.  The filters are all set up for the VM in
>  its domain XML.  The Spice "Select USB devices for redirection" dialog shows
>  the device I want to redirect.  However, all the USB devices are greyed out
>  and Alert text says, "Some USB devices are blocked by host policy".  My
>  understanding, from the doc
>
> <https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/...;,
>  is that the following XML needs to be configured on the "host physical
>  machine's domain XML" which I am interpreting as the workstation, although it
>  could be the hypervisor host, to unblock the USB device:
>  
>  <redirfilter>
>    <usbdev class='0x08' vendor='0x0951' product='0x1625'
> version='2.0' allow='yes'/>
>    <usbdev allow='no'/>
>  </redirfilter>
>  
>  Either way, I cannot figure out what the name or location of the file where
>  this XML would go, let alone find a complete schema or example of what the
>  file would look like.  Has anyone else done this?  Please... <gasp> Help!
>   
I've never seen that message before. Can you provide the guest XML you are
using? And maybe upload a screenshot somewhere of what you are seeing in
virt-viewer.

What type of device are you trying to passthrough?

CCing hans who is the usbredir expert

- Cole

[Fred Brier]

On 01/07/2015 06:37 AM, Cole Robinson wrote:
>  On 01/06/2015 12:08 AM, Frederick N. Brier wrote:
> > I'm using Spice and want to share a USB device on workstation with a VM
> > running on another physical host.  The filters are all set up for the VM in
> > its domain XML.  The Spice "Select USB devices for redirection" dialog
> shows
> > the device I want to redirect.  However, all the USB devices are greyed out
> > and Alert text says, "Some USB devices are blocked by host policy".  My
> > understanding, from the doc
> >
> <https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/...;,
> > is that the following XML needs to be configured on the "host physical
> > machine's domain XML" which I am interpreting as the workstation, although
> it
> > could be the hypervisor host, to unblock the USB device:
> >
> > <redirfilter>
> >    <usbdev class='0x08' vendor='0x0951' product='0x1625'
> version='2.0' allow='yes'/>
> >    <usbdev allow='no'/>
> > </redirfilter>
> >
> > Either way, I cannot figure out what the name or location of the file where
> > this XML would go, let alone find a complete schema or example of what the
> > file would look like.  Has anyone else done this?  Please... <gasp> Help!
> >
>  I've never seen that message before. Can you provide the guest XML you are
>  using? And maybe upload a screenshot somewhere of what you are seeing in
>  virt-viewer.
>
>  What type of device are you trying to passthrough?
>
>  CCing hans who is the usbredir expert
>
>  - Cole 
The guest XML is below.  There is an extra <redirdev> element in the 
XML, which got added when I was attempting to use a virt-manager 1.0.1 
on my Fedora 20 workstation remotely connected to the CentOS KVM host, 
but it was doing this before as well.  A snapshot of the dialog can be 
found at http://snag.gy/8UViT.jpg . The Alert message appears to be in 
the spice-gtk project <https://github.com/mathslinux/spice-gtk> in the 
usb-device-manager.c 
<https://github.com/mathslinux/spice-gtk/blob/master/gtk/usb-device-manage... 
file.  Initially, I used remote-viewer with no parameters and specified 
the URI (spice://cyclone:5908) in its dialog, but then I created an INI 
file passed to remote-viewer.  That file's contents are also below.  
There was no difference in the behavior.  Now please don't laugh, but I 
was trying to pass the "Hercules Rocksmith USB Guitar Adapter" to the 
VM.  It would kind of cool and geeky to be able to play Rocksmith 2014 
in a remote VM on my Fedora box. Thank you for the help.

- Fred

---------Start----------
[virt-viewer]
type=spice
host=cyclone
port=5908
title=Rain
fullscreen=1
enable-usbredir=1
enable-usb-autoshare=1
usb-filter=-1,12ba,00ff,-1,yes
---------End----------

<domain type='kvm' id='21'>
   <name>Rain</name>
   <uuid>bc456b4a-cc10-4be5-b5a5-92e54be74025</uuid>
   <title>Windows 7 on Cyclone</title>
   <description>This VM is for running non-games applications that only 
run under Windows.  The installed applications include XML Spy 2004 Pro, 
Quickbooks 2012, Chief Architect&apos;s Architectural Home Design, and 
Visual Studio.</description>
   <memory unit='KiB'>4194304</memory>
   <currentMemory unit='KiB'>4194304</currentMemory>
   <vcpu placement='static'>2</vcpu>
   <os>
     <type arch='x86_64' machine='rhel6.5.0'>hvm</type>
     <boot dev='hd'/>
   </os>
   <features>
     <acpi/>
     <apic/>
     <pae/>
   </features>
   <clock offset='localtime'>
     <timer name='rtc' tickpolicy='catchup'/>
     <timer name='pit' tickpolicy='delay'/>
     <timer name='hpet' present='no'/>
   </clock>
   <on_poweroff>destroy</on_poweroff>
   <on_reboot>restart</on_reboot>
   <on_crash>restart</on_crash>
   <devices>
     <emulator>/usr/libexec/qemu-kvm</emulator>
     <disk type='block' device='disk'>
       <driver name='qemu' type='raw' cache='none'
io='native'/>
       <source dev='/dev/vg_data/rain'/>
       <target dev='vda' bus='virtio'/>
       <alias name='virtio-disk0'/>
       <address type='pci' domain='0x0000' bus='0x00'
slot='0x08' 
function='0x0'/>
     </disk>
     <disk type='block' device='disk'>
       <driver name='qemu' type='raw' cache='none'
io='native'/>
       <source dev='/dev/vg_data/windata'/>
       <target dev='vdb' bus='virtio'/>
       <alias name='virtio-disk1'/>
       <address type='pci' domain='0x0000' bus='0x00'
slot='0x09' 
function='0x0'/>
     </disk>
     <disk type='block' device='cdrom'>
       <driver name='qemu' type='raw'/>
       <source dev='/dev/sr0'/>
       <target dev='hdc' bus='ide'/>
       <readonly/>
       <alias name='ide0-1-0'/>
       <address type='drive' controller='0' bus='1'
target='0' unit='0'/>
     </disk>
     <controller type='usb' index='0' model='ich9-ehci1'>
       <alias name='usb0'/>
       <address type='pci' domain='0x0000' bus='0x00'
slot='0x05' 
function='0x7'/>
     </controller>
     <controller type='usb' index='0' model='ich9-uhci1'>
       <alias name='usb0'/>
       <master startport='0'/>
       <address type='pci' domain='0x0000' bus='0x00'
slot='0x05' 
function='0x0' multifunction='on'/>
     </controller>
     <controller type='usb' index='0' model='ich9-uhci2'>
       <alias name='usb0'/>
       <master startport='2'/>
       <address type='pci' domain='0x0000' bus='0x00'
slot='0x05' 
function='0x1'/>
     </controller>
     <controller type='usb' index='0' model='ich9-uhci3'>
       <alias name='usb0'/>
       <master startport='4'/>
       <address type='pci' domain='0x0000' bus='0x00'
slot='0x05' 
function='0x2'/>
     </controller>
     <controller type='scsi' index='0' model='virtio-scsi'>
       <alias name='scsi0'/>
       <address type='pci' domain='0x0000' bus='0x00'
slot='0x0a' 
function='0x0'/>
     </controller>
     <controller type='ide' index='0'>
       <alias name='ide0'/>
       <address type='pci' domain='0x0000' bus='0x00'
slot='0x01' 
function='0x1'/>
     </controller>
     <controller type='virtio-serial' index='0'>
       <alias name='virtio-serial0'/>
       <address type='pci' domain='0x0000' bus='0x00'
slot='0x06' 
function='0x0'/>
     </controller>
     <interface type='bridge'>
       <mac address='52:54:00:9c:35:fc'/>
       <source bridge='br0'/>
       <target dev='vnet8'/>
       <model type='virtio'/>
       <alias name='net0'/>
       <address type='pci' domain='0x0000' bus='0x00'
slot='0x03' 
function='0x0'/>
     </interface>
     <serial type='pty'>
       <source path='/dev/pts/9'/>
       <target port='0'/>
       <alias name='serial0'/>
     </serial>
     <console type='pty' tty='/dev/pts/9'>
       <source path='/dev/pts/9'/>
       <target type='serial' port='0'/>
       <alias name='serial0'/>
     </console>
     <channel type='spicevmc'>
       <target type='virtio' name='com.redhat.spice.0'/>
       <alias name='channel0'/>
       <address type='virtio-serial' controller='0' bus='0'
port='1'/>
     </channel>
     <input type='tablet' bus='usb'>
       <alias name='input0'/>
     </input>
     <input type='mouse' bus='ps2'/>
     <graphics type='spice' port='5908' autoport='yes'
listen='0.0.0.0'>
       <listen type='address' address='0.0.0.0'/>
     </graphics>
     <sound model='ich6'>
       <alias name='sound0'/>
       <address type='pci' domain='0x0000' bus='0x00'
slot='0x04' 
function='0x0'/>
     </sound>
     <video>
       <model type='qxl' ram='65536' vram='65536'
heads='1'/>
       <alias name='video0'/>
       <address type='pci' domain='0x0000' bus='0x00'
slot='0x02' 
function='0x0'/>
     </video>
     <redirdev bus='usb' type='spicevmc'>
       <alias name='redir0'/>
       <address type='usb' bus='0' port='4'/>
     </redirdev>
     <redirdev bus='usb' type='spicevmc'>
       <alias name='redir1'/>
     </redirdev>
     <redirfilter>
       <usbdev class='0x08' vendor='0x12BA' product='0x00FF' 
version='2.0' allow='yes'/>
       <usbdev allow='no'/>
     </redirfilter>
     <memballoon model='virtio'>
       <alias name='balloon0'/>
       <address type='pci' domain='0x0000' bus='0x00'
slot='0x07' 
function='0x0'/>
     </memballoon>
   </devices>
   <seclabel type='dynamic' model='selinux' relabel='yes'>
<label>unconfined_u:system_r:svirt_t:s0:c824,c991</label>
<imagelabel>unconfined_u:object_r:svirt_image_t:s0:c824,c991</imagelabel>
   </seclabel>
</domain>