[Qemu-devel] Re: TODO item: guest programmable mac/vlan filtering with macvtap

[Dragos Tatulea <dragos.tatulea@gmail.com>]

Hi,

>    I'm starting a  thread related to the TODO item mentioned in the
> subject. Currently still gathering info and trying to make kvm &
> macvtap play nicely together. I have used this [1] guide to set it up
> but qemu is still complaining about the PCI device address of the
> virtio-net-pci. Tried with latest qemu. Am I missing something here?
>

Here are the suggestions received so far from Michael Tsirkin (and my
questions):

1. add a secondary mac (or third, etc) address to the guest virtio-net
interface.
    - This implies using a single macvtap interface to handle all the macs
    - How would that appear on the guest? As another interface? As a
virtual interface? This is tap-like behavior :).
    - The macvtap interface on the host shouldn't have a mac or should
ignore it.

2. create a vlan device on the guest virtio-net device

3. set promiscuous mode on guest virtio-net device
    - And that means STRICTLY guest promiscuous, right? You shouldn't
be able to receive frames from other VM's, right?

4. the above stuff must be controllable by host admin
  - Well, for this there are a few options:
    > admin switch that allows the guest user to add macs
    > preconfig allowed MAC's in mactap (or qemu config) for the guest user
    > allow/disallow command for user in qemu (although this doesn't
seem to be supported)

What is the use-case for this project? From what I gather so far, the
guest user will be able to add interfaces/macs without rebooting the
VM. Am I correct? Anything else?

Thanks,
Dragos