feat: add `VZVmnetNetworkDeviceAttachment` support (macOS 26.0) #205

norio-nomura · 2025-11-22T12:06:06Z

feat: add `VZVmnetNetworkDeviceAttachment` support (macOS 26.0)

VZVmnetNetworkDeviceAttachment is an API that creates vmnet devices on VMs added in macOS 26.

see: https://developer.apple.com/documentation/virtualization/vzvmnetnetworkdeviceattachment?language=objc

It does not require the com.apple.vm.networking entitlement nor root privileges.
HostMode and SharedMode are supported.
In order for multiple VMs to communicate with each other in SharedMode, they must be started in the same executable and the same VmnetNetwork must be passed to NewVmnetNetworkDeviceAttachment() to create an attachment.

This change adds:

vz.VmnetNetworkDeviceAttachment represents VZVmnetNetworkDeviceAttachment in Go
vmnet package to use vmnet APIs that added on macOS 26.0
- Return represents vmnet_return_t as error
  - ErrSuccess, ErrFailure, ...
- Mode represents operating_modes_t
  - HostMode, SharedMode
- NetworkConfiguration represents vmnet_network_configuration_t
- Network represents vmnet_network_ref
- Interface represents interface_ref
- *FileAdaptorForInterfaces support File Handle based network device APIs on QEMU, krunkit, and vz.NewFileHandleNetworkDeviceAttachment
vz_test.TestVmnetSharedModeAllowsCommunicationBetweenMultipleVMs
vz_test.TestVmnetSharedModeWithConfiguringIPv4
pkg/xpc package that providing <xpc/xpc.h> APIs to support implementing Mach service server and client
vz_test.TestVmnetNetworkShareModeSharingOverXpc
TestVmnetNetworkShareModeSharingOverXpc tests sharing vmnet.Network in SharedMode over XPC communication.
This test registers test executable as an Mach service and launches it using launchctl.
The launched Mach service provides vmnet.Network serialization to clients upon request, after booting
a VM using the provided vmnet.Network to ensure the network is functional on the server side.
The client boots VM using the provided vmnet.Network serialization.

Edit: on macOS 26.2, "the same executable" restriction seems to be relaxed.

VZVmnetNetworkDeviceAttachment seems to allow connecting to subnet created by a different executable.
vmnet_interface_start_with_network seems to allow connecting to subnet created by an executable at same path? (may changing CDHash not affect?)
I don't know how far the restrictions have been relaxed.

Which issue(s) this PR fixes:

Mentioned in #198 (comment)

Based on `VMNET_SHARED_MODE`, and `VMNET_HOST_MODE` ```yaml networks: - vzShared: true - vzHost: true ``` But, to sharing network between multiple VMs, `VZVmnetNetworkDeviceAttachment` requires VMs are launched by same process. It depends on Code-Hex/vz#205 Signed-off-by: Norio Nomura <[email protected]>

vmnet.go

nirs · 2025-11-24T11:21:33Z

This can be used by multiple processes like this:

Start a network process create the vmnet_network_ref, starting a xpc listener
Start vm process, obtaining the vmnet_network_ref from the xpc server
- server create a xpc_object_t using https://developer.apple.com/documentation/vmnet/vmnet_network_copy_serialization(_:_:)?language=objc
- client get the xpc_oject_t via https://developer.apple.com/documentation/xpc/xpc_connection_send_message_with_reply(_:_:_:_:)
- client create new vment_netwrok_ref via https://developer.apple.com/documentation/vmnet/vmnet_network_create_with_serialization(_:_:)?language=objc
Start more vms using same vmnet_network_ref...
Wait until vms exit
Terminate network process

norio-nomura · 2025-11-28T09:16:22Z

This can be used by multiple processes like this:

In this procedure, I confirmed that VMs launched from multiple processes can share networks with each other. 👍🏻
It seems that it can be reproduced in the unit test, so I will try to make a unit test.

norio-nomura · 2025-12-02T03:57:43Z

It seems that it can be reproduced in the unit test, so I will try to make a unit test.

Added unit test and pkg/xpc.

norio-nomura · 2025-12-02T04:01:54Z

Added unit test and pkg/xpc.

I'll try this added xpc package with lima to make it work. Until then, it's a draft.

Based on `VMNET_SHARED_MODE`, and `VMNET_HOST_MODE` ```yaml networks: - vzShared: true - vzHost: true ``` But, to sharing network between multiple VMs, `VZVmnetNetworkDeviceAttachment` requires VMs are launched by same process. It depends on Code-Hex/vz#205 Signed-off-by: Norio Nomura <[email protected]>

nirs

I did not review most of this change, just the stange part of about marking bridged mode as depracated.

pkg/xpc/xpc.m

vmnet.go

Based on `VMNET_SHARED_MODE`, and `VMNET_HOST_MODE` ```yaml networks: - vzShared: true - vzHost: true ``` But, to sharing network between multiple VMs, `VZVmnetNetworkDeviceAttachment` requires VMs are launched by same process. It depends on Code-Hex/vz#205 Signed-off-by: Norio Nomura <[email protected]>

Signed-off-by: Norio Nomura <[email protected]>

norio-nomura · 2026-01-05T15:53:11Z

I'll add:

missing APIs to xpc; to hide unsafe.Pointer
StartInterfaceWithNetwork related APIs to vmnet that used in feat: add vmnet_network support on macOS 26+ lima-vm/lima#4394 (comment)

Signed-off-by: Norio Nomura <[email protected]>

nirs · 2026-01-06T11:13:05Z

vmnet/vmnet_darwin.go

 // This is only supported on macOS 26 and newer, error will be returned on older versions.
 //   - https://developer.apple.com/documentation/vmnet/vmnet_network_create_with_serialization(_:_:)?language=objc
-func NewNetworkWithSerialization(serialization unsafe.Pointer) (*Network, error) {
+func NewNetworkWithSerialization(serialization xpc.Object) (*Network, error) {


With this change, if I have xpc_object_t I got from a xpc service, I need to wrap it like this, right?

// serialization is xpc_object_t network, err := NewNetworkWithSerialization(xpc.NewObject(serialization))

So we did not really got rid of the unsafe.Pointer - I think we cannot avoid this since this is the only way to integrate with code retuning xpc_object_t. The vmnet interface vment_network_create_with_serialization() accepts xpc_object_t so we cannot implement it without accepting xpc_object.

But I think this wrapping makes sense to minimize the scope of a raw xpc_object_t.

@norio-nomura @Code-Hex ?

Update to consume API changes in the vz PR[1] commit[2]. - vment.NewNetworkWithSerialization() accepts now xpc.Object interface instead of xpc_object_t. We can wrap the raw xpc_object_t with xpc.NewObject(). - Updated dependencies [1] Code-Hex/vz#205 [2] norio-nomura/vz@9c98b6b

nirs · 2026-01-06T11:59:06Z

I tested the latest version, it works for me.

Signed-off-by: Norio Nomura <[email protected]>

Call `ReleaseOnCleanup()` explicitly if needed. Signed-off-by: Norio Nomura <[email protected]>

Update to consume API changes in the vz PR[1] commit[2]. - vment.Network.Raw() removed [1] Code-Hex/vz#205 [2] norio-nomura/vz@c68bc89

Signed-off-by: Norio Nomura <[email protected]>

Based on `VMNET_SHARED_MODE`, and `VMNET_HOST_MODE` ```yaml networks: - vzShared: true - vzHost: true ``` But, to sharing network between multiple VMs, `VZVmnetNetworkDeviceAttachment` requires VMs are launched by same process. It depends on Code-Hex/vz#205 Signed-off-by: Norio Nomura <[email protected]>

norio-nomura · 2026-01-14T07:39:19Z

I think the approximately necessary APIs have been added.
Do I need to add tests to the xpc package?

Code-Hex · 2026-01-14T11:48:13Z

@norio-nomura Does the xpc package need to be public? If it fits within internal, I don't think we need to add tests.

norio-nomura · 2026-01-14T11:53:45Z

@norio-nomura Does the xpc package need to be public? If it fits within internal, I don't think we need to add tests.

It depends on the xpc package to make MachService at lima-vm/lima#4394.
The xpc package realizes the sharing of vmnet.Network serialization and the sharing of File Descriptor used to communicate with vmnet.Interface.

nirs · 2026-01-14T12:27:25Z

@norio-nomura Does the xpc package need to be public? If it fits within internal, I don't think we need to add tests.

We need the xpc.NewObject() for creating a vment_network_ref with serialization. Here is an example usage in vmnet-broker test vm:
https://github.com/nirs/vmnet-broker/blob/6ba05b6ba38b15524c5cb833f223e0b91aa70376/go/cmd/test.go#L197

If vmnet.NewNetworkWithSerialization() will accept xpc_object_t (unsafe.Pointer), the xpc package is not needed in this project and can be part of Lima or available as separate package.

norio-nomura · 2026-01-15T00:56:04Z

Unit tests added to xpc.
Previously, when I tried vmnet_network_configuration_add_port_forwarding_rule, it didn't work well, so vmnet_interface_add_ip_port_forwarding_rule related to Interface has not been implemented, but I want to make it a separate PR to support them in the future.

Based on `VMNET_SHARED_MODE`, and `VMNET_HOST_MODE` ```yaml networks: - vzShared: true - vzHost: true ``` But, to sharing network between multiple VMs, `VZVmnetNetworkDeviceAttachment` requires VMs are launched by same process. It depends on Code-Hex/vz#205 Signed-off-by: Norio Nomura <[email protected]> # Conflicts: # go.sum

Signed-off-by: Norio Nomura <[email protected]> `vmnet`: Fix golangci-lint-v2 violations Signed-off-by: Norio Nomura <[email protected]> `vmnet`: if iface.EnableVirtioHeader { packetSize += virtioNetHdrSize } Signed-off-by: Norio Nomura <[email protected]>

Signed-off-by: Norio Nomura <[email protected]>

Use `*FileAdaptorForInterface` APIs in `TestVmnetSharedModeAllowsCommunicationBetweenMultipleVMs`: - `vmnet.DatagramFileAdaptorForInterface` - `vmnet.DatagramNextFileAdaptorForInterface` Since they are compatible with `vz.NewFileHandleNetworkDeviceAttachment`. Signed-off-by: Norio Nomura <[email protected]>

- Fix `NewArray` with empty slices. - Change `New*` to return actual typed instance instead of `Object` Signed-off-by: Norio Nomura <[email protected]>

norio-nomura changed the title ~~feat: add VmnetNetworkDeviceAttachment support (macOS 26.0)~~ feat: add VZVmnetNetworkDeviceAttachment support (macOS 26.0) Nov 22, 2025

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 2 times, most recently from 6617c8f to 6a1f741 Compare November 22, 2025 12:34

norio-nomura mentioned this pull request Nov 22, 2025

feat: add vmnet_network support on macOS 26+ lima-vm/lima#4394

Draft

AkihiroSuda reviewed Nov 22, 2025

View reviewed changes

vmnet.go Outdated Show resolved Hide resolved

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from 5a7a116 to 72cc1d4 Compare November 26, 2025 02:58

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from 72cc1d4 to 9506cbd Compare December 2, 2025 03:56

norio-nomura marked this pull request as draft December 2, 2025 04:01

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 5 times, most recently from 7bf24c1 to 007c2a5 Compare December 3, 2025 07:26

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 2 times, most recently from aba95bd to ba619f5 Compare December 4, 2025 03:51

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 2 times, most recently from d3fad75 to 7a58378 Compare December 15, 2025 03:39

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from 7a58378 to 33858c0 Compare December 16, 2025 14:25

nirs reviewed Dec 16, 2025

View reviewed changes

pkg/xpc/xpc.m Outdated Show resolved Hide resolved

vmnet.go Outdated Show resolved Hide resolved

nirs reviewed Dec 16, 2025

View reviewed changes

vmnet.go Outdated Show resolved Hide resolved

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from f048f6e to 3b512d7 Compare December 17, 2025 00:10

norio-nomura marked this pull request as ready for review December 17, 2025 05:20

xpc: Use internal/objc

826b088

Signed-off-by: Norio Nomura <[email protected]>

xpc: Add missing APIs, hide unsafe.Pointer, and unexport xpcObject

9c98b6b

Signed-off-by: Norio Nomura <[email protected]>

nirs reviewed Jan 6, 2026

View reviewed changes

norio-nomura added 2 commits January 9, 2026 18:58

xpc: Change Fd from int to uintptr

2e2d3a7

Signed-off-by: Norio Nomura <[email protected]>

xpc: Remove calling ReleaseOnCleanup() in xpcObject.retain()

3a32863

Call `ReleaseOnCleanup()` explicitly if needed. Signed-off-by: Norio Nomura <[email protected]>

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 4 times, most recently from 16c89d9 to c68bc89 Compare January 10, 2026 00:17

nirs added a commit to nirs/vmnet-broker that referenced this pull request Jan 10, 2026

go: Update to latest github.com/norio-nomura/vz

4f88a89

Update to consume API changes in the vz PR[1] commit[2]. - vment.Network.Raw() removed [1] Code-Hex/vz#205 [2] norio-nomura/vz@c68bc89

norio-nomura added 2 commits January 14, 2026 15:21

xpc: minor tweak

38bcc2a

Signed-off-by: Norio Nomura <[email protected]>

internal/cgohandler: Separate from xpc package

8cb6b7f

Signed-off-by: Norio Nomura <[email protected]>

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from c68bc89 to f92e6f3 Compare January 14, 2026 07:04

norio-nomura marked this pull request as ready for review January 15, 2026 00:56

norio-nomura added 4 commits January 16, 2026 13:20

vmnet: Remove object

50b9c97

Signed-off-by: Norio Nomura <[email protected]>

xpc: Add unit tests

7420c05

- Fix `NewArray` with empty slices. - Change `New*` to return actual typed instance instead of `Object` Signed-off-by: Norio Nomura <[email protected]>

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from 701968f to 7420c05 Compare January 16, 2026 04:20

Uh oh!

feat: add VZVmnetNetworkDeviceAttachment support (macOS 26.0) #205

Are you sure you want to change the base?

feat: add VZVmnetNetworkDeviceAttachment support (macOS 26.0) #205

Conversation

norio-nomura commented Nov 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!