feat: add `VZVmnetNetworkDeviceAttachment` support (macOS 26.0) #205

norio-nomura · 2025-11-22T12:06:06Z

feat: add `VZVmnetNetworkDeviceAttachment` support (macOS 26.0)

VZVmnetNetworkDeviceAttachment is an API that creates vmnet devices on VMs added in macOS 26.

see: https://developer.apple.com/documentation/virtualization/vzvmnetnetworkdeviceattachment?language=objc

It does not require the com.apple.vm.networking entitlement nor root privileges.
HostMode and SharedMode are supported.
In order for multiple VMs to communicate with each other in SharedMode, they must be started in the same executable and the same VmnetNetwork must be passed to NewVmnetNetworkDeviceAttachment() to create an attachment.

This change adds:

vz.VmnetNetworkDeviceAttachment represents VZVmnetNetworkDeviceAttachment in Go
vmnet package to use vmnet APIs that added on macOS 26.0
- Return represents vmnet_return_t as error
  - ErrSuccess, ErrFailure, ...
- Mode represents operating_modes_t
  - HostMode, SharedMode
- NetworkConfiguration represents vmnet_network_configuration_t
- Network represents vmnet_network_ref
vz_test.TestVmnetSharedModeAllowsCommunicationBetweenMultipleVMs
vz_test.TestVmnetSharedModeWithConfiguringIPv4
pkg/xpc package that providing <xpc/xpc.h> APIs to support implementing Mach service server and client
vz_test.TestVmnetNetworkShareModeSharingOverXpc
TestVmnetNetworkShareModeSharingOverXpc tests sharing vmnet.Network in SharedMode over XPC communication.
This test registers test executable as an Mach service and launches it using launchctl.
The launched Mach service provides vmnet.Network serialization to clients upon request, after booting
a VM using the provided vmnet.Network to ensure the network is functional on the server side.
The client boots VM using the provided vmnet.Network serialization.

Which issue(s) this PR fixes:

Mentioned in #198 (comment)

Based on `VMNET_SHARED_MODE`, and `VMNET_HOST_MODE` ```yaml networks: - vzShared: true - vzHost: true ``` But, to sharing network between multiple VMs, `VZVmnetNetworkDeviceAttachment` requires VMs are launched by same process. It depends on Code-Hex/vz#205 Signed-off-by: Norio Nomura <[email protected]>

AkihiroSuda · 2025-11-22T15:19:17Z

vmnet.go

+const (
+	HostMode   VmnetMode = C.VMNET_HOST_MODE
+	SharedMode VmnetMode = C.VMNET_SHARED_MODE
+	// Deprecated: BridgedMode is not supported by NewVmnetNetworkConfiguration


Do you know why not supported?

I don't know. It's documented on:
https://developer.apple.com/documentation/vmnet/vmnet_network_configuration_create(_:_:)?language=objc

Parameters
mode
Shared mode or host-only mode.

Why BridgedMode is Deprecated? Can you link to the docs about this?

Since it is not supported we should not include it, marking it as Deprecated look wrong.

nirs · 2025-11-24T11:21:33Z

This can be used by multiple processes like this:

Start a network process create the vmnet_network_ref, starting a xpc listener
Start vm process, obtaining the vmnet_network_ref from the xpc server
- server create a xpc_object_t using https://developer.apple.com/documentation/vmnet/vmnet_network_copy_serialization(_:_:)?language=objc
- client get the xpc_oject_t via https://developer.apple.com/documentation/xpc/xpc_connection_send_message_with_reply(_:_:_:_:)
- client create new vment_netwrok_ref via https://developer.apple.com/documentation/vmnet/vmnet_network_create_with_serialization(_:_:)?language=objc
Start more vms using same vmnet_network_ref...
Wait until vms exit
Terminate network process

norio-nomura · 2025-11-28T09:16:22Z

This can be used by multiple processes like this:

In this procedure, I confirmed that VMs launched from multiple processes can share networks with each other. 👍🏻
It seems that it can be reproduced in the unit test, so I will try to make a unit test.

norio-nomura · 2025-12-02T03:57:43Z

It seems that it can be reproduced in the unit test, so I will try to make a unit test.

Added unit test and pkg/xpc.

norio-nomura · 2025-12-02T04:01:54Z

Added unit test and pkg/xpc.

I'll try this added xpc package with lima to make it work. Until then, it's a draft.

Based on `VMNET_SHARED_MODE`, and `VMNET_HOST_MODE` ```yaml networks: - vzShared: true - vzHost: true ``` But, to sharing network between multiple VMs, `VZVmnetNetworkDeviceAttachment` requires VMs are launched by same process. It depends on Code-Hex/vz#205 Signed-off-by: Norio Nomura <[email protected]>

nirs

I did not review most of this change, just the stange part of about marking bridged mode as depracated.

pkg/xpc/xpc.m

nirs · 2025-12-16T14:31:25Z

vmnet.go

+const (
+	HostMode   VmnetMode = C.VMNET_HOST_MODE
+	SharedMode VmnetMode = C.VMNET_SHARED_MODE
+	// Deprecated: BridgedMode is not supported by NewVmnetNetworkConfiguration


Why BridgedMode is Deprecated? Can you link to the docs about this?

Since it is not supported we should not include it, marking it as Deprecated look wrong.

vmnet.go

Based on `VMNET_SHARED_MODE`, and `VMNET_HOST_MODE` ```yaml networks: - vzShared: true - vzHost: true ``` But, to sharing network between multiple VMs, `VZVmnetNetworkDeviceAttachment` requires VMs are launched by same process. It depends on Code-Hex/vz#205 Signed-off-by: Norio Nomura <[email protected]>

Code-Hex · 2026-01-03T15:49:08Z

@norio-nomura Thanks for creating your PR
and I`m sorry for the late. I will check this PR today around lunch time 🙇

Code-Hex

Thank you very much for creating a great PR.

I don't think it's ready for review yet, but I'll review it in its current state.

When providing it as a library, it is not desirable to create a pkg directory and create detailed packages within it. Please remove the pkg directory and create vmnet, xpc directories at the same level as network.go, such as vz/network.go, vz/vmnet, vz/xpc
Similar to the above, create a directory for the osversion package under internal and move osversion.go it to use the macOSAvailable function in the vmnet package.
Overall, the code seems to have a tendency to overlap with existing code (does it support generative AI?). It would be appreciated if you could align it as much as possible with the packages in the internal directory.

Code-Hex · 2026-01-04T08:20:23Z

xpc/object.go

+
+// Object represents a generic XPC object.
+//   - https://developer.apple.com/documentation/xpc/xpc_object_t?language=objc
+type Object interface {


I think it is better to extend NSObject interface under internal/objc package.
Making this change, you should notice that most of the code defined in pkg/xpc/xpc_object.go is duplicated. It is desirable to use an NSObject interface as an argument rather than generics.

Since objc is an internal package, it cannot be used to retrieve unsafe.Pointer on Lima, etc.
xpc and vmnet did not want to implement all APIs, but instead of exposing unsafe.Pointer, so they avoided completely imitating the NSObject interface.

@norio-nomura Thanks for your explanation. I do not wish users to interact with unsafe.Pointer as a feature provided by the library. The reason being that users may inadvertently utilise unintended library specifications, which are then treated as bugs requiring correction.

However, I understand your point, but I'd be very happy if we could find a solution that doesn't require exposing unsafe.Pointer.

Code-Hex · 2026-01-04T08:22:52Z

xpc/xpc_darwin.h

+// size_t xpcDataGetBytes(void *object, void *buffer, size_t offset, size_t length);
+// const void *xpcDataGetBytesPtr(void *object);
+// size_t xpcDataGetLength(void *object);
+
+// MARK: - Number objects


Please remove any parts that are not being used. They are noise.

virtualization_11.m

norio-nomura · 2026-01-04T16:00:30Z

3. Overall, the code seems to have a tendency to overlap with existing code (does it support generative AI?).

The reason why it contains duplicate code is because it was written to work alone when this PR was not accepted.
I was already thinking about moving xpc and vmnet to lima.

Code-Hex · 2026-01-04T17:23:30Z

@norio-nomura I agree with the basic policy, so I would appreciate it if you could remove any duplicated codes.

Signed-off-by: Norio Nomura <[email protected]>

`VZVmnetNetworkDeviceAttachment` is an API that creates vmnet devices on VMs added in macOS 26. see: https://developer.apple.com/documentation/virtualization/vzvmnetnetworkdeviceattachment?language=objc It does not require the `com.apple.vm.networking` entitlement nor root privileges. `HostMode` and `SharedMode` are supported. In order for multiple VMs to communicate with each other in `SharedMode`, they must be started in the same executable and the same `VmnetNetwork` must be passed to `NewVmnetNetworkDeviceAttachment()` to create an attachment. This change adds: - `vz.VmnetNetworkDeviceAttachment` represents `VZVmnetNetworkDeviceAttachment` in Go - `vmnet` package to use vmnet APIs that added on macOS 26.0 - `Return` represents `vmnet_return_t` as `error` - `ErrSuccess`, `ErrFailure`, ... - `Mode` represents `operating_modes_t` - `HostMode`, `SharedMode` - `NetworkConfiguration` represents `vmnet_network_configuration_t` - `Network` represents `vmnet_network_ref` - `vz_test.TestVmnetSharedModeAllowsCommunicationBetweenMultipleVMs` - `vz_test.TestVmnetSharedModeWithConfiguringIPv4` Signed-off-by: Norio Nomura <[email protected]>

- Add `TestVmnetNetworkShareModeSharingOverXpc` to `vmnet_test.go` `TestVmnetNetworkShareModeSharingOverXpc` tests sharing `vmnet.Network` in `SharedMode` over XPC communication. This test registers test executable as an Mach service and launches it using `launchctl`. The launched Mach service provides `vmnet.Network` serialization to clients upon request, after booting a VM using the provided `vmnet.Network` to ensure the network is functional on the server side. The client boots VM using the provided `vmnet.Network` serialization. - Add `pkg/xpc` package that providing `<xpc/xpc.h>` APIs to support implementing Mach service server and client Signed-off-by: Norio Nomura <[email protected]>

- .github/workflows/compile.yml: Extend test job's timeout from 3m to 5m - Makefile: Extend test target's timeout from 2m to 4m Signed-off-by: Norio Nomura <[email protected]>

Signed-off-by: Norio Nomura <[email protected]>

norio-nomura · 2026-01-05T15:53:11Z

I'll add:

missing APIs to xpc; to hide unsafe.Pointer
StartInterfaceWithNetwork related APIs to vmnet that used in feat: add VZVmnetNetworkDeviceAttachment support on macOS 26+ lima-vm/lima#4394 (comment)

Signed-off-by: Norio Nomura <[email protected]>

nirs · 2026-01-06T11:13:05Z

vmnet/vmnet_darwin.go

 // This is only supported on macOS 26 and newer, error will be returned on older versions.
 //   - https://developer.apple.com/documentation/vmnet/vmnet_network_create_with_serialization(_:_:)?language=objc
-func NewNetworkWithSerialization(serialization unsafe.Pointer) (*Network, error) {
+func NewNetworkWithSerialization(serialization xpc.Object) (*Network, error) {


With this change, if I have xpc_object_t I got from a xpc service, I need to wrap it like this, right?

// serialization is xpc_object_t network, err := NewNetworkWithSerialization(xpc.NewObject(serialization))

So we did not really got rid of the unsafe.Pointer - I think we cannot avoid this since this is the only way to integrate with code retuning xpc_object_t. The vmnet interface vment_network_create_with_serialization() accepts xpc_object_t so we cannot implement it without accepting xpc_object.

But I think this wrapping makes sense to minimize the scope of a raw xpc_object_t.

@norio-nomura @Code-Hex ?

nirs · 2026-01-06T11:59:06Z

I tested the latest version, it works for me.

norio-nomura changed the title ~~feat: add VmnetNetworkDeviceAttachment support (macOS 26.0)~~ feat: add VZVmnetNetworkDeviceAttachment support (macOS 26.0) Nov 22, 2025

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 2 times, most recently from 6617c8f to 6a1f741 Compare November 22, 2025 12:34

norio-nomura mentioned this pull request Nov 22, 2025

feat: add VZVmnetNetworkDeviceAttachment support on macOS 26+ lima-vm/lima#4394

Draft

AkihiroSuda reviewed Nov 22, 2025

View reviewed changes

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from 5a7a116 to 72cc1d4 Compare November 26, 2025 02:58

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from 72cc1d4 to 9506cbd Compare December 2, 2025 03:56

norio-nomura marked this pull request as draft December 2, 2025 04:01

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 5 times, most recently from 7bf24c1 to 007c2a5 Compare December 3, 2025 07:26

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 2 times, most recently from aba95bd to ba619f5 Compare December 4, 2025 03:51

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 2 times, most recently from d3fad75 to 7a58378 Compare December 15, 2025 03:39

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from 7a58378 to 33858c0 Compare December 16, 2025 14:25

nirs reviewed Dec 16, 2025

View reviewed changes

vmnet.go Outdated Show resolved Hide resolved

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from f048f6e to 3b512d7 Compare December 17, 2025 00:10

norio-nomura marked this pull request as ready for review December 17, 2025 05:20

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 4 times, most recently from b4f69f8 to ebc8b36 Compare December 22, 2025 04:41

Code-Hex reviewed Jan 4, 2026

View reviewed changes

Code-Hex mentioned this pull request Jan 4, 2026

New version release with ASIF feature #206

Open

Create internal/osversion from osversion.go

4a3687b

Signed-off-by: Norio Nomura <[email protected]>

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 4 times, most recently from 7eace16 to b9433cf Compare January 5, 2026 11:49

norio-nomura marked this pull request as draft January 5, 2026 12:47

norio-nomura added 2 commits January 5, 2026 21:56

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 2 times, most recently from c62cc26 to 2d5a3ed Compare January 5, 2026 13:10

Extend test timeouts

0ce4c32

- .github/workflows/compile.yml: Extend test job's timeout from 3m to 5m - Makefile: Extend test target's timeout from 2m to 4m Signed-off-by: Norio Nomura <[email protected]>

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from 2d5a3ed to 0ce4c32 Compare January 5, 2026 13:23

xpc: Use internal/objc

826b088

Signed-off-by: Norio Nomura <[email protected]>

xpc: Add missing APIs, hide unsafe.Pointer, and unexport xpcObject

9c98b6b

Signed-off-by: Norio Nomura <[email protected]>

nirs reviewed Jan 6, 2026

View reviewed changes

Uh oh!

feat: add VZVmnetNetworkDeviceAttachment support (macOS 26.0) #205

Are you sure you want to change the base?

feat: add VZVmnetNetworkDeviceAttachment support (macOS 26.0) #205

Conversation

norio-nomura commented Nov 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!