FS at: https://cwiki.apache.org/CLOUDSTACK/pvlan-for-isolation-within-a-vlan.html
PVLAN branch has been under development for some time, and now the functionality works on KVM and Xen, would be followed by VMware soon VM live migration is not supported so far, I am waiting for the fix of https://issues.apache.org/jira/browse/CLOUDSTACK-1638 . We're using ovs/open flow to manipulate ingress/egress traffic to emulate the isolation PVLAN function on KVM and Xen. The details are in the FS. The core code change is minimal and there is no DB change, because we took advantage of "broadcast domain" to introduce "pvlan://" broadcast URI to describe the primary and isolated PVLAN for the network. If there is no objection, I would merge the branch in 48 hours. Thanks. --Sheng