feat: add `VZVmnetNetworkDeviceAttachment` support (macOS 26.0) by norio-nomura · Pull Request #205 · Code-Hex/vz

norio-nomura · 2025-11-22T12:06:06Z

feat: add `VZVmnetNetworkDeviceAttachment` support (macOS 26.0)

VZVmnetNetworkDeviceAttachment is an API that creates vmnet devices on VMs added in macOS 26.

see: https://developer.apple.com/documentation/virtualization/vzvmnetnetworkdeviceattachment?language=objc

It does not require the com.apple.vm.networking entitlement nor root privileges.
HostMode and SharedMode are supported.
In order for multiple VMs to communicate with each other in SharedMode, they must be started in the same executable and the same VmnetNetwork must be passed to NewVmnetNetworkDeviceAttachment() to create an attachment.

This change adds:

vz.VmnetNetworkDeviceAttachment represents VZVmnetNetworkDeviceAttachment in Go
vmnet package to use vmnet APIs that added on macOS 26.0
- Return represents vmnet_return_t as error
  - ErrSuccess, ErrFailure, ...
- Mode represents operating_modes_t
  - HostMode, SharedMode
- NetworkConfiguration represents vmnet_network_configuration_t
- Network represents vmnet_network_ref
- Interface represents interface_ref
- *FileAdaptorForInterfaces support File Handle based network device APIs on QEMU, krunkit, and vz.NewFileHandleNetworkDeviceAttachment
xpc package that providing <xpc/xpc.h> APIs to support implementing Mach service server/client to sharing serializations of vmnet.Network and file descriptors of vmnet.*FileAdaptorForInterfaces
vz_test.TestVmnetSharedModeAllowsCommunicationBetweenMultipleVMs
vz_test.TestVmnetSharedModeWithConfiguringIPv4
vz_test.TestVmnetNetworkShareModeSharingOverXpc
TestVmnetNetworkShareModeSharingOverXpc tests sharing vmnet.Network in SharedMode over XPC communication.
This test registers test executable as an Mach service and launches it using launchctl.
The launched Mach service provides vmnet.Network serialization to clients upon request, after booting
a VM using the provided vmnet.Network to ensure the network is functional on the server side.
The client boots VM using the provided vmnet.Network serialization.

Edit: on macOS 26.2, "the same executable" restriction seems to be relaxed.

VZVmnetNetworkDeviceAttachment seems to allow connecting to subnet created by a different executable.
vmnet_interface_start_with_network seems to allow connecting to subnet created by an executable at same path? (may changing CDHash not affect?)
I don't know how far the restrictions have been relaxed.

Which issue(s) this PR fixes:

Mentioned in #198 (comment)

Based on `VMNET_SHARED_MODE`, and `VMNET_HOST_MODE` ```yaml networks: - vzShared: true - vzHost: true ``` But, to sharing network between multiple VMs, `VZVmnetNetworkDeviceAttachment` requires VMs are launched by same process. It depends on Code-Hex/vz#205 Signed-off-by: Norio Nomura <norio.nomura@gmail.com>

nirs · 2025-11-24T11:21:33Z

This can be used by multiple processes like this:

Start a network process create the vmnet_network_ref, starting a xpc listener
Start vm process, obtaining the vmnet_network_ref from the xpc server
- server create a xpc_object_t using https://developer.apple.com/documentation/vmnet/vmnet_network_copy_serialization(_:_:)?language=objc
- client get the xpc_oject_t via https://developer.apple.com/documentation/xpc/xpc_connection_send_message_with_reply(_:_:_:_:)
- client create new vment_netwrok_ref via https://developer.apple.com/documentation/vmnet/vmnet_network_create_with_serialization(_:_:)?language=objc
Start more vms using same vmnet_network_ref...
Wait until vms exit
Terminate network process

norio-nomura · 2025-11-28T09:16:22Z

This can be used by multiple processes like this:

In this procedure, I confirmed that VMs launched from multiple processes can share networks with each other. 👍🏻
It seems that it can be reproduced in the unit test, so I will try to make a unit test.

norio-nomura · 2025-12-02T03:57:43Z

It seems that it can be reproduced in the unit test, so I will try to make a unit test.

Added unit test and pkg/xpc.

norio-nomura · 2025-12-02T04:01:54Z

Added unit test and pkg/xpc.

I'll try this added xpc package with lima to make it work. Until then, it's a draft.

Based on `VMNET_SHARED_MODE`, and `VMNET_HOST_MODE` ```yaml networks: - vzShared: true - vzHost: true ``` But, to sharing network between multiple VMs, `VZVmnetNetworkDeviceAttachment` requires VMs are launched by same process. It depends on Code-Hex/vz#205 Signed-off-by: Norio Nomura <norio.nomura@gmail.com>

nirs

I did not review most of this change, just the stange part of about marking bridged mode as depracated.

Based on `VMNET_SHARED_MODE`, and `VMNET_HOST_MODE` ```yaml networks: - vzShared: true - vzHost: true ``` But, to sharing network between multiple VMs, `VZVmnetNetworkDeviceAttachment` requires VMs are launched by same process. It depends on Code-Hex/vz#205 Signed-off-by: Norio Nomura <norio.nomura@gmail.com>

To avoid crash when `Context` is canceled before receiving reply. Signed-off-by: Norio Nomura <norio.nomura@gmail.com>

`vmnet`: Fix golangci-lint-v2 violations `vmnet`: if iface.EnableVirtioHeader { packetSize += virtioNetHdrSize } `vmnet`: Remove `object` `vmnet`: Add doc comments to `*FileAdapterForInterface`s `vmnet`: Refactor `*FileAdapterForInterface`s - Remove written packet count from result of `WritePacketsTo*` in `PacketForwarder` - Minimize differences between `pktDescsManager` and `msgHdrXArray` `vmnet`: Handle `syscall.ENOBUFS` in `DatagramPacketForwarder.WritePacketsToConn` `syscall.Sendmsg` may return `syscall.ENOBUFS` if there is not enough buffer set to the destination. Signed-off-by: Norio Nomura <norio.nomura@gmail.com>

- `StreamFileAdapterForInterface`: - Support partial read on `unix.Readv` in `readPacketsFromConn` - `Datagram*FileAdapterForInterface`: - Add wait on `syscall.ENOBUFS` in `writePacketsToPacketConn` Signed-off-by: Norio Nomura <norio.nomura@gmail.com>

Signed-off-by: Norio Nomura <norio.nomura@gmail.com>

Use `*FileAdapterForInterface` APIs in `TestVmnetSharedModeAllowsCommunicationBetweenMultipleVMs`: - `datagram.FileAdapterForInterface` - `datagramx.FileAdapterForInterface` Since they are compatible with `vz.NewFileHandleNetworkDeviceAttachment`. Signed-off-by: Norio Nomura <norio.nomura@gmail.com>

Based on `VMNET_SHARED_MODE`, and `VMNET_HOST_MODE` ```yaml networks: - vzShared: true - vzHost: true ``` But, to sharing network between multiple VMs, `VZVmnetNetworkDeviceAttachment` requires VMs are launched by same process. It depends on Code-Hex/vz#205 Signed-off-by: Norio Nomura <norio.nomura@gmail.com> # Conflicts: # go.sum # Conflicts: # go.sum

bubunyo · 2026-04-19T13:18:20Z

+	if !netip.MustParsePrefix("192.168.0.0/16").Overlaps(subnet) {
+		return fmt.Errorf("subnet %s is out of range", subnet.String())
+	}


Is there any specific reason for limiting to the 192.168.0.0/16 range only? Ideally users should be able to specify any RFC 1918 range, including 10.0.0.0/8 or 172.16.0.0/12 and it doesnt look like apple explicitly prevents this.

Suggested change

if !netip.MustParsePrefix("192.168.0.0/16").Overlaps(subnet) {

return fmt.Errorf("subnet %s is out of range", subnet.String())

}

rfc1918 := []netip.Prefix{

netip.MustParsePrefix("10.0.0.0/8"),

netip.MustParsePrefix("172.16.0.0/12"),

netip.MustParsePrefix("192.168.0.0/16"),

}

allowed := false

for _, r := range rfc1918 {

if r.Overlaps(subnet) {

allowed = true

break

}

}

if !allowed {

return fmt.Errorf("subnet %s is not in an RFC 1918 range", subnet.String())

}

The docs say a /24 under 192.168/16.
https://developer.apple.com/documentation/vmnet/vmnet_network_configuration_create(_:_:)

According to the doc, it is a default value.

All other parameters are optional and have the following default value: ...

Right, good chance that it supports the same private addresses as the older APIs.

bubunyo · 2026-07-05T04:19:28Z

@norio-nomura any progress here, if you can list some of the changes you are looking for, i am happy to assist i making them and the adding then opening a pr to this.

s3rj1k · 2026-07-25T21:02:18Z

Played with this a bit, specifically with

vmnet.NewNetworkConfiguration(vmnet.SharedMode)
vz.NewVmnetNetworkDeviceAttachment()
netCfg.AddPortForwardingRule()

And I can confirm that at least this flow works fine and there is no need for root if below entitlements are used alongside with --options runtime to codesign

<dict>
    <key>com.apple.security.virtualization</key>
    <true/>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
</dict>

Hoping we get this merged before macOS 27.0 comes out, as it will also ship more new features.

One thing that I've noticed is that AddDhcpReservation kind of unreliable, guest can get different IP, this is fixable with custom cloud-init, but AddDhcpReservation itself enables AddPortForwardingRule, so I am happy this works.

XPC dictionary deletion passes a nil value through objc.Ptr. Carry the guard from PR #205 commit 43fded6.

Code-Hex · 2026-09-28T06:11:42Z

@norio-nomura Could you share the current status of this PR and what remains before it is ready for review? In February, you mentioned testing the file adapter in Lima and investigating the TSO issue. Are those still the main blockers?

No rush; I want to understand the next steps and whether a smaller part is ready to review separately.

norio-nomura changed the title ~~feat: add VmnetNetworkDeviceAttachment support (macOS 26.0)~~ feat: add VZVmnetNetworkDeviceAttachment support (macOS 26.0) Nov 22, 2025

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 2 times, most recently from 6617c8f to 6a1f741 Compare November 22, 2025 12:34

norio-nomura mentioned this pull request Nov 22, 2025

feat: add vmnet_network support on macOS 26+ lima-vm/lima#4394

Draft

AkihiroSuda reviewed Nov 22, 2025

View reviewed changes

Comment thread vmnet.go Outdated

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from 5a7a116 to 72cc1d4 Compare November 26, 2025 02:58

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from 72cc1d4 to 9506cbd Compare December 2, 2025 03:56

norio-nomura marked this pull request as draft December 2, 2025 04:01

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 5 times, most recently from 7bf24c1 to 007c2a5 Compare December 3, 2025 07:26

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 2 times, most recently from aba95bd to ba619f5 Compare December 4, 2025 03:51

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch 2 times, most recently from d3fad75 to 7a58378 Compare December 15, 2025 03:39

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from 7a58378 to 33858c0 Compare December 16, 2025 14:25

nirs reviewed Dec 16, 2025

View reviewed changes

Comment thread pkg/xpc/xpc.m Outdated

Comment thread vmnet.go Outdated

nirs reviewed Dec 16, 2025

View reviewed changes

Comment thread vmnet.go Outdated

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from f048f6e to 3b512d7 Compare December 17, 2025 00:10

norio-nomura marked this pull request as ready for review December 17, 2025 05:20

xpc: Change to delete cgoReplyHandler in callReplyHandler

d34115c

To avoid crash when `Context` is canceled before receiving reply. Signed-off-by: Norio Nomura <norio.nomura@gmail.com>

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from 9241433 to ec911e3 Compare February 10, 2026 03:15

norio-nomura added 6 commits February 10, 2026 12:29

git mv

2a02d7c

Signed-off-by: Norio Nomura <norio.nomura@gmail.com>

re-package

56c0733

Signed-off-by: Norio Nomura <norio.nomura@gmail.com>

adaptor -> adapter

520e29d

Signed-off-by: Norio Nomura <norio.nomura@gmail.com>

norio-nomura force-pushed the feat-add-vmnet-network-device-attachment branch from ec911e3 to e27a5fb Compare February 10, 2026 03:30

nirs mentioned this pull request Mar 20, 2026

Support native vmnet networking via vmnet-broker crc-org/vfkit#439

Open

bubunyo reviewed Apr 19, 2026

View reviewed changes

lixin9311 mentioned this pull request May 26, 2026

Add VZVmnetNetworkDeviceAttachment (macOS 26+) #218

Open

Code-Hex added a commit that referenced this pull request Sep 28, 2026

fix(objc): allow nil in Ptr

f2639fe

XPC dictionary deletion passes a nil value through objc.Ptr. Carry the guard from PR #205 commit 43fded6.

-	if !netip.MustParsePrefix("192.168.0.0/16").Overlaps(subnet) {
-		return fmt.Errorf("subnet %s is out of range", subnet.String())
-	}
+rfc1918 := []netip.Prefix{
+    netip.MustParsePrefix("10.0.0.0/8"),
+    netip.MustParsePrefix("172.16.0.0/12"),
+    netip.MustParsePrefix("192.168.0.0/16"),
+}
+allowed := false
+for _, r := range rfc1918 {
+    if r.Overlaps(subnet) {
+        allowed = true
+        break
+    }
+}
+if !allowed {
+    return fmt.Errorf("subnet %s is not in an RFC 1918 range", subnet.String())
+}

Uh oh!

Conversation

norio-nomura commented Nov 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!