I'm trying to create VMs which can see each other and host. They are hosted with qemu/kvm and managed via libvirt. The network adapter of VMs is created with macvtap(VEPA mode) for performance.

After enabling hairpin over switch, the unicast stream is all OK, no matter among VMs or between VM and Host.

When it comes to multicast, however, I'm faced with problem. I find that host cannot ping6 each VM. With tcpdump, I observe that the Neighbor Solicitation packet to multicast address ff02::1:ff00:212 from host is not received by my VM, whose ipv6 address is 2001:da8:a0:600::212/64. Obviously this multicast packet should have been passed to VM by macvtap.

As a result of the problem of multicast, all ipv6 packet is lost for Neighbor Discovery cannot work properly.

I'm sure that there is nothing with the switch, because when I run tcpdump over the physical network adapter, I can see Neighbor Solicitation twice per second, one out, one in.

After I set the macvtap interface over the host to promiscuous mode, the VM get the Neighbor Solicitation packet, along with some other multicast packet which should be filtered by macvtap, but no unicast packet to other VM, even when I ping6 other VMs on the host at the same time.

So I think enabling promiscuous mode over all macvtap interface is an acceptable workaround but not graceful.

All my host and VM is CentOS 7.0. I've tried to install kernel-ml(linux 4.1.3) from elrepo on my host but it make not difference.

So:

  1. how can I set all macvtap interface to promiscuous mode everytime it's started by libvirt?
  2. I'm not familiar with net driver. But according to http://www.makelinux.net/ldd3/chp-17-sect-14, I'm suspicious that there is some bugs in the driver of macvlan so that the kernel cannot set the multicast list of the interface correctly. However, there is no set_multicast_list in linux/driver/net/{macvlan.c,macvtap.c}. Where is the correct place to search for help?

See also: https://bugzilla.redhat.com/show_bug.cgi?id=1035253

up vote 1 down vote accepted

libvirt's macvlan has gained support for multicast. Unfortunately by default it is disabled, by trustGuestRxFilters=no, and the documentation is not explicit that this breaks multicast and hence IPv6.

https://bugzilla.redhat.com/show_bug.cgi?id=1035253#c15

IMO the natural model would be to allow multicast by default. macvlan allows MAC spoofing anyway, as well as sending to multicast addresses. Blocking multicast reception (but not transmission) on a network you think you're directly connected to is an unpleasant surprise.

  • I have just figured out this solution occasionally. Thanks very much. This feature requires additionally documented. – Given92 Feb 1 '16 at 12:52

faced the same issue with macvtap. I found a way to fix it but I don't know how to automate it inside virsh. sudo ip link set dev macvtap0 allmulticast on

  • It's more graceful than promisc, but this is still a workaround. The only way I could figure out to configure it automatically is crontab. – Given92 Jul 24 '15 at 12:53

I found a solution although I'm not quite sure if it is completely correct.

Setup a libvirt hook in which you enable ALLMULTI after the qemu domain is started.

/etc/libvirt/hook/qemu

#!/bin/bash

if [ "$2" == "started" ]; then
 timestamp=$(date +"%Y-%m-%d %H:%M:%S")
 exists=$(ifconfig | grep macvtap0 | wc -l)

 if [ "$exists" -gt "0" ]; then
   ifconfig macvtap0 allmulti
   echo "$timestamp ALLMULTI set on macvtap0" >> /var/log/libvirt_hook_qemu.log
 fi
fi

The script is working for me on Ubuntu 14.04.3 + KVM/libvirt.

  • this solution is not perfect for large amount of packets in ipv6 network. – Given92 Feb 1 '16 at 12:51

The answer by sourcejedi contains the solution, but maybe not explicitly enough. Using "virsh edit", set the trustGuestRxFilters attribute on the network device:

<interface type='direct' trustGuestRxFilters='yes'>

See libvirt docs. The same can be done for all interfaces on a libvirt network.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.