Bug 1060573 - Spice shared session: Obey connected=keep settings during setTicket
Summary: Spice shared session: Obey connected=keep settings during setTicket
Alias: None
Product: vdsm
Classification: oVirt
Component: General
Version: ---
Hardware: Unspecified
OS: Unspecified
Target Milestone: ovirt-4.0.0-rc
: 4.18.0
Assignee: Milan Zamazal
QA Contact: sefi litmanovich
: 1342479 (view as bug list)
Depends On:
Blocks: 1060854
TreeView+ depends on / blocked
Reported: 2014-02-02 18:41 UTC by Markus Stockhausen
Modified: 2016-07-05 07:47 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2016-07-05 07:47:51 UTC
oVirt Team: Virt
rule-engine: ovirt-4.0.0+
rule-engine: planning_ack+
michal.skrivanek: devel_ack+
rule-engine: testing_ack+

Attachments (Terms of Use)
working shared spice console (327.98 KB, image/png)
2014-02-02 18:44 UTC, Markus Stockhausen
no flags Details

System ID Private Priority Status Summary Last Updated
oVirt gerrit 56224 0 'None' ABANDONED virt: Don't set connected attribute in <graphics> if already set 2020-04-27 19:30:58 UTC
oVirt gerrit 56836 0 'None' MERGED virt: Don't fail when existingConnAction is unset for a SPICE device 2020-04-27 19:30:58 UTC
oVirt gerrit 57660 0 'None' MERGED core: Don't send existingConnAction in VM ticket 2020-04-27 19:30:58 UTC

Description Markus Stockhausen 2014-02-02 18:41:45 UTC
Description of problem:

It is not possible to rewrite a vdsm/libvirt XML in a before_vm_start hook so that a spice console can be shared between multiple admins. Whenever the second admin opens a SPICE console the console that was opened before will be closed automatically.

Version-Release number of selected component (if applicable):

Ovirt engine 3.3.2-el6
Ovirt node:
Fedora 19
KVM 1.6.1 - 2.fc19
SPICE 0.12.4 - 3.fc19

How reproducible:


Steps to Reproduce:

1. Define a VM with a SPICE console

2. Create a before_vm_start hook that enables SPICE session sharing. See http://libvirt.org/formatdomain.html#elementsGraphics

A very rudimentary hook looks like this:

> cat /usr/libexec/vdsm/hooks/before_vm_start/50_shared_spice.py

import os
import sys
import hooking
import traceback

domxml = hooking.read_domxml()

d = domxml.getElementsByTagName('domain')[0]

c = domxml.createElement('qemu:commandline')
p = domxml.createElement('qemu:env')



g = domxml.getElementsByTagName('graphics')[0]


3. Start the VM and verify that QEMU runs with SPICE shared console option

> cat /var/log/libvirt/qemu/<VM-Name>.log
Domain id=18 is tainted: custom-argv
((null):14375): Spice-Warning **: reds.c:4008:do_spice_init: spice: allowing multiple client connections (crashy)

4. Start a console session via the admin portal. virt-viewer will be started and the console window opens

5. Start a second console via the admin portal.

Actual results:

The first console closes.

Expected results:

The first console should stay open.

Additional info:

The before_vm_start_hook rewrites the libvirt XML. It contains the <graphics connected="keep" type="spice"> settings. When we open a console in the admin interface qemu is instructed to create a new ticket. This process must obey the privously created XML. At the moment it simply fills the connected=disconnect option. That is wrong.

To show that shared sessions are indeed working with this setup one can simply adapt the /usr/share/vdsm/BindingXMLRPC.py on the hypervisor host.

    def vmSetTicket(self, vmId, password, ttl,
                    existingConnAction='disconnect', params={}):
        vm = API.VM(vmId)
# Allow spice shared sessions and disable automatic disconnect
#        return vm.setTicket(password, ttl, existingConnAction, params)
        return vm.setTicket(password, ttl, 'keep', params)

See screenshot attached.

Comment 1 Markus Stockhausen 2014-02-02 18:44:49 UTC
Created attachment 858287 [details]
working shared spice console

Comment 2 Markus Stockhausen 2014-02-02 20:34:53 UTC
I searched the engine coding for the initiator of that call. It might be inside SetVmTicketVDSCommand.java. The disconnect action is hard coded:

public class SetVmTicketVDSCommand<P extends SetVmTicketVDSCommandParameters> extends VdsBrokerCommand<P> {
    private Guid mVmId = Guid.Empty;
    private String mTicket;
    private int mValidTime; // in seconds
    private String connectionAction = "disconnect";

My tests show that if will be an simple and save way to change the default value of connectionAction to "keep". As long as we do not modify libvirt XML to allow crashy session sharing spice server will only allow one single session. The current behaviour won't be changed and we have the possibility to enable shared spice consoles using hooks.

Comment 3 Itamar Heim 2014-02-09 08:52:51 UTC
Setting target release to current version for consideration and review. please
do not push non-RFE bugs to an undefined target release to make sure bugs are
reviewed for relevancy, fix, closure, etc.

Comment 4 Sandro Bonazzola 2014-03-04 09:22:18 UTC
This is an automated message.
Re-targeting all non-blocker bugs still open on 3.4.0 to 3.4.1.

Comment 5 Michal Skrivanek 2014-03-09 13:11:06 UTC
did you try to use before_vm_set_ticket/after_vm_set_ticket hook instead of vm lifecycle-related hook?

Comment 6 Markus Stockhausen 2014-03-09 19:55:35 UTC

in first instance the before_vm_start hook is to enable shared sessions in QEMU. If it is not available than QEMU will disable shared SPICE sessions automatically. Without this hook we can do what we want whereever it may be, shared sessions will not work.

Everything fine until here: Now to the task to issue new tickets with option "connected=keep". From my understanding this is an attribute of the domain.xml (http://libvirt.org/formatdomain.html) and therefore must be set in the start_vm hook. This parameters will be passed to qemu start command line (and therefore cannot be altered afterwards).

Without any reference scripts for the before_vm_set_ticket/after_vm_set_ticket hook I have no real idea what I can do there. Maybe you can enlighten me.

Comment 7 Michal Skrivanek 2014-04-03 14:33:23 UTC
check vm.py, setTicket(). We pull the graphics element from libvirt, update expiration time and password and set it back using updateDeviceFlags(). I believe this should work for all attributes, you could modify it in before_vm_se_ticket.
I didn't try but it should work…

I'm not sure about the actual support in SPICE though, IIRC it was experimental and not sure if it's exposed. Libvirt docs seems to indicate it allows concurrent access only for VNC using the "sharePolicy" attribute

It would make sense to support sharePolicy properly at least for VNC

Comment 8 Sandro Bonazzola 2015-09-04 09:02:14 UTC
This is an automated message.
This Bugzilla report has been opened on a version which is not maintained anymore.
Please check if this bug is still relevant in oVirt 3.5.4.
If it's not relevant anymore, please close it (you may use EOL or CURRENT RELEASE resolution)
If it's an RFE please update the version to 4.0 if still relevant.

Comment 9 Sandro Bonazzola 2015-10-02 10:55:19 UTC
This is an automated message.
This Bugzilla report has been opened on a version which is not maintained
Please check if this bug is still relevant in oVirt 3.5.4 and reopen if still
an issue.

Comment 10 Red Hat Bugzilla Rules Engine 2015-11-16 14:07:30 UTC
This bug is flagged for 3.6, yet the milestone is for 4.0 version, therefore the milestone has been reset.
Please set the correct milestone or add the flag.

Comment 11 Red Hat Bugzilla Rules Engine 2015-11-30 22:37:22 UTC
Bug tickets must have version flags set prior to targeting them to a release. Please ask maintainer to set the correct version flags and only then set the target milestone.

Comment 12 Michal Skrivanek 2016-04-15 09:41:43 UTC
Milan, can you take a look, it should really be fairly simple to just not overwrite existing stuff

Comment 13 Milan Zamazal 2016-04-15 15:05:59 UTC
I think simply not overwriting the attribute in Vdsm if already set is a reasonable solution.  See the proposed patch.

Comment 14 Sandro Bonazzola 2016-05-02 09:54:55 UTC
Moving from 4.0 alpha to 4.0 beta since 4.0 alpha has been already released and bug is not ON_QA.

Comment 15 Milan Zamazal 2016-05-10 08:35:06 UTC
Not yet solved, more patches needed.

Comment 16 Milan Zamazal 2016-05-17 11:19:52 UTC
We can approach the fix in several ways:

- The simplest way is to stop sending disconnect parameter from Engine on graphics ticket update.  This should probably cause no change in the current behavior and would allow setting the parameter in a Vdsm hook as described at the beginning of this bug report.
- A better way would be, in addition to the previous, to add a new API parameter to the create path and introduce a vdc option in Engine to provide the value of that parameter.  Then the Vdsm hook wouldn't be needed.  However SPICE_DEBUG_ALLOW_MC environment variable must be set for QEMU before it is started in order to make connected="keep" actually working.  This means using qemu:commandline in domain XML and thus may not be very welcome in Vdsm.
- Maybe the best way would be, in addition to the previous, to permit setting this option per each VM.  This would require the same changes in Vdsm as the approach above and some more changes in Engine.

In any case, SPICE shared sessions seem to be somewhat experimental feature and we should be cautious when modifying the current behavior. Unless we decide for the simplest way of not sending disconnect parameter from Engine at all, we must coordinate changes in Engine and Vdsm and should think about possible implications a bit more.

Comment 17 Milan Zamazal 2016-05-23 06:54:52 UTC
We decided to go the simple way: Engine shouldn't send the disconnect parameter anymore and the user can set `connected' attribute in Vdsm hooks. We may think about better support of SPICE shared sessions once libvirt+QEMU support them properly.

Comment 18 Vinzenz Feenstra [evilissimo] 2016-06-06 09:37:26 UTC
*** Bug 1342479 has been marked as a duplicate of this bug. ***

Comment 19 sefi litmanovich 2016-07-04 10:47:37 UTC
Verified on rhevm-4.0.2-0.2.rc1.el7ev.noarch with host: vdsm-4.18.4-2.el7ev.x86_64.

Added the vdsm hook as per description and restarted vdsm.
Created a vm with spice and started the vm.
Was able to open several consoles with shared session after the connected='keep' flag was added to vm's xml graphics entity as expected.

Comment 20 Sandro Bonazzola 2016-07-05 07:47:51 UTC
oVirt 4.0.0 has been released, closing current release.

Note You need to log in before you can comment on or make changes to this bug.