<html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><style>body { line-height: 1.5; }blockquote { margin-top: 0px; margin-bottom: 0px; margin-left: 0.5em; }body { font-size: 10.5pt; font-family: 微软雅黑; color: rgb(0, 0, 0); line-height: 1.5; }</style></head><body>
<div><span></span><br></div>
<div><br></div><blockquote style="margin-top: 0px; margin-bottom: 0px; margin-left: 0.5em;"><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"><div style="PADDING-RIGHT: 8px; PADDING-LEFT: 8px; FONT-SIZE: 12px;FONT-FAMILY:tahoma;COLOR:#000000; BACKGROUND: #efefef; PADDING-BOTTOM: 8px; PADDING-TOP: 8px"><div><b>From:</b> <a href="mailto:laine@laine.org">Laine Stump</a></div><div><b>Date:</b> 2015-04-27 21:41</div><div><b>To:</b> <a href="mailto:libvirt-users@redhat.com">libvirt-users</a></div><div><b>CC:</b> <a href="mailto:berrange@redhat.com">Daniel P. Berrange</a>; <a href="mailto:wh.h@foxmail.com">wh.h@foxmail.com</a></div><div><b>Subject:</b> Re: [libvirt-users] How does the libvirt deal with the vnet mac address</div></div></div><div><div>On 04/27/2015 04:59 AM, Daniel P. Berrange wrote:</div>
<div>> On Sun, Apr 26, 2015 at 10:51:34AM +0800, wh.h@foxmail.com wrote:</div>
<div>>> How does the libvirt deal with the vnet mac address?</div>
<div>>></div>
<div>>> Greetings,</div>
<div>>> if I establish a network for the VM (hypervisor is KVM) using bridge in</div>
<div>>> the virt-manager , a vnet0 device is created . There are some relationships</div>
<div>>> about mac address between the vnet0 device in the hypervisor and the ethX</div>
<div>>> device in the VM, for example :</div>
<div>>> the mac address of vnet0 is FE:54:00:84:E3:62</div>
<div>>> the mac address of ethX in the VM is 52:54:00:84:E3:62</div>
<div>>> two mac addresses above are almost the same except the first part of the address .</div>
<div>>> but if I created a tap device manually , </div>
<div>>> tunctl -t tap0 -u root</div>
<div>>> brctl addif br0 tap0</div>
<div>>> and add tap0 to the VM, I will find that mac address between the tap0 device</div>
<div>>> in the hypervisor and the ethX device in the VM will totally different . so</div>
<div>>> I think that libvirt must do something about the mac address handling, could</div>
<div>>> you please kindly tell me something about this ?</div>
<div>> When first created, the kernel assigns the tap device a completely random</div>
<div>> MAC address. This bears no relation to the MAC address that is used in the</div>
<div>> guest OS.</div>
<div>></div>
<div>> When you create a bridge device it initially has a MAC address of all zeros,</div>
<div>> and when you add NIC devices to the bridge, its MAC address gets update to</div>
<div>> the numerically lowest MAC address of all the NICs. The problem is that</div>
<div>> when the kernel assigns MAC addresses randomly, one of these random MAC</div>
<div>> address might be numerically lower than the bridge's current MAC address.</div>
<div>> So the effect is that when you start/stop guests, and their TAP devices</div>
<div>> get added/removed from the bridge, the bridge's own MAC address will</div>
<div>> occassionally change which is a bad thing.</div>
<div>></div>
<div>> So deal with this, libvirt will set all guest TAP devices so that they</div>
<div>> have a MAC address with 0xFE as the first byte. The real physical NIC</div>
<div>> added to the bridge is thus guaranteed to have a smaller MAC address,</div>
<div>> and so the bridge will permanently use the MAC address of the physical</div>
<div>> NIC, which is what we want.</div>
<div>></div>
<div>> For bridges which do not have any physical NIC, libvirt will create a</div>
<div>> dummy TAP device, not connected to any guest, and give it a small MAC</div>
<div>> address. This ensures again ensures the bridge MAC address won't change</div>
<div>> when guests start/stop.</div>
<div>></div>
<div>></div>
<div>>> How does the libvirt establish the arp table in the hypervisor if the</div>
<div>>> vnet0 device in the hypervisor and the ethX device in the VM is</div>
<div>>> different?</div>
<div>> The MAC address of the TAP device is actually totally irrelevant for</div>
<div>> the ARP table maintenance.</div>
<div>></div>
<div>> If a packet arrives on the bridge and the IP doesn't have a ARP table</div>
<div>> mapping, the bridge will just send it to all connected TAP devices.</div>
<div>></div>
<div>> When a packet arrives from a guest TAP, the source MAC address will</div>
<div>> be used to populate the ARP table.</div>
<div>></div>
<div>> In neither case does the MAC address of the TAP device itself have</div>
<div>> any involvement.</div>
<div>></div>
<div>> The only time the TAP device MAC address has any effect is when</div>
<div>> the kerenel auto-assigns a MAC to the bridge device as explained</div>
<div>> above.</div>
<div>></div>
<div>>> If I want to create tap device manually , how should I deal</div>
<div>>> with the mac address ?I have setup the mac address of the</div>
<div>>> tap0 device in the hypervisor and the ethX device in the VM</div>
<div>>> in the same way with libvirt , but the network of VM cannot</div>
<div>>> work.</div>
<div>> As mentioned above, the TAP device MAC can be pretty much anything,</div>
<div>> but we'd recommend using 0xFE as the first byte.</div>
<div>></div>
<div> </div>
<div>Along with everything that Dan has explained, it's important to also</div>
<div>know that it is essential the tap device's MAC address be different from</div>
<div>the MAC address used by the guest. The reason is that the tap device</div>
<div>will not forward a packet to the other side of itself if it sees a</div>
<div>destination MAC address matching its own - it will think that the packet</div>
<div>must be intended for local delivery; this is another reason that libvirt</div>
<div>replaces the 1st byte of the guest address with 0xFE when setting the</div>
<div>tap device address.</div>
<div> </div>
<div>(This is in contrast to macvtap devices, which *do* match the MAC</div>
<div>address used by the guest.)</div>
<div> </div>
<div>(...and I'm still curious why you are choosing to do all of this</div>
<div>yourself rather than just letting libvirt deal with it. Is there some</div>
<div>functionality you need that libvirt can't supply?)</div><div><br></div><div>/**********************************************/</div><div>Thanks a lot for your reply!</div><div>The reason is that only the command scripts can be integrated to the upper layer software which is designed by <span style="background-color: rgba(0, 0, 0, 0); font-size: 10.5pt; line-height: 1.5;">workmates.</span></div><div><span style="background-color: rgba(0, 0, 0, 0); font-size: 10.5pt; line-height: 1.5;"><br></span></div><div><span style="background-color: rgba(0, 0, 0, 0); line-height: 1.5;">I </span><span style="background-color: window; font-family: Arial, 宋体, 微软雅黑; line-height: 20px;"> remain </span><span class="text_blue" style="background-color: window; font-family: Arial, 宋体, 微软雅黑; line-height: 20px;">puzzled about :</span></div><div><font color="#236fd4" face="Arial, 宋体, 微软雅黑"><span style="line-height: 20px;">"</span></font><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;">it's important to also </span><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;">know that it is essential the tap device's MAC address be different from</span></div><div>the MAC address used by the guest. The reason is that the tap device</div><div>will not forward a packet to the other side of itself if it sees a</div><div><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;">destination MAC address matching its own</span><font color="#236fd4" face="Arial, 宋体, 微软雅黑"><span style="line-height: 20px;">"</span></font></div><div>Does "the other side" mean :<br>one side is ethx in the VM, the other side is tap device <span style="font-size: 10.5pt; line-height: 1.5; background-color: window;">in the hypervisor?</span></div><div><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;">But , these two devices is actually the same one . If package is received in the ethx device in the VM , the package also arrives at the tap device </span><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;"> </span><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;">in the hypervisor at the same time , doesn't it ?</span></div><div><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;"><br></span></div><div><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;">weihua </span></div><div><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;">wh.h@foxmail.com</span></div><div><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;"><br></span></div><div><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;"><br></span></div>
<div> </div>
<div> </div>
</div></blockquote>
</body></html>