sharing this as it might be interesting for somebody
i built whonix 18.2.4.2 (LXQt, ‘–target utm --arch arm64’) on a M3 Pro and have gateway and workstation running stable in UTM 5.0.8. I followed the wiki build instructions, below are only the places where i had to deviate, including issues.
Build:
- Debian 13 arm64 netinst in UTM, gave it 8 GB Ram, 4 Cores, 64 GB disk
- ‘virtio-ramfb’ resulted in "Display output is not active.’ had to change it to ‘virtio-gpu-pci’ to get working output (UTM VM Settings, Display, Emulated Display Card)
- After installing, eject the ISO, otherwise UTM boots installer again
Building:
Wikis dep list is no longer enough on a fresh trixie host. derivative-maker now verifies signatures with Sequoia. Step ‘1100_sanity-tests’ aborting with ‘Required command not found: ‘sqop’’, ‘sq-git’, and ‘1200_prepare-build-machine’ only runs after that tets. So these have to be installed beforehand:
sudo apt install sqop sequoia-git
‘–freshness’ is now mandatory (‘current’ or ‘frozen’):
derivative-maker --flavor whonix-gateway-lxqt --target utm --arch arm64 --tb open --repo true -vmsize 15G --freshness current
derivative-maker --flavor whonix-workstation-lxqt --target utm --arch arm64 --tb open --repo true --vmsize 25G --freshness current
Both builds finished without errors, taking 20 mins each. aarch64 Tor Browser installed automatuically.
Importing in UTM:
Each ‘*.utm.tar.gz’ contains ‘NAME.utm/config.plist’ and ‘NAME.utm/Data/NAME.raw’. i changed these things before importing them into UTM:
- Booting the generated bundle gives QEMU error: drive0 … Invalid argument. Dont know the root cause but converting the image to qcow2 and pointing ‘ImageName’ in ‘config.plist’ at the new file fixed it and the image also got much smaller. Might have to do something with UTM enables ‘discard=unmap,detect-zeroes=unmap’ and QEMU passes discards on raw files to macos via ‘fcntl(F_PUNCHHOLE)’, which APFS rejects bc ranges that arent 4k aligned with EINVAL and QEMU forwards unaligned head/tail pieces as-is. Macos code path ahs no EINVAl fallback like the linux one, so the failed discard surfaces as an I/O Error. Converting both images to qcow2 avoids it bc qcow2 only punches whole clusters. Put the qcow2 into the bundles Data folder, remove the raw file. Dont forget to point ImageName in each bundles plist at the new file.
qemu-img convert -0 qcow2 Whonix-Gateway-LXQt-18.2.4.2.arm64.raw Whonix-Gateway.qcow2
qemu-img convert -0 qcow2 Whonix-Workstation-LXQt-18.2.4.2.arm64.raw Whonix-Workstation.qcow2
- The bundle uses ‘virtio-gpu-gl-pci’ although the wiki advises against GPU acceleration. switched both VMs to ‘virtio-gpu-pci’,
- the gateways ‘AdditionalArguments’ contains ‘-netdev socket,id=internal,listen=:8010’. that binds to 0.0.0.0 so anyone on the local network can connect to internal interface. thats okay when you want that, but i changed it to listen=127.0.0.1:8010. Workstation already ues connect=127.0.0.1:8010.
All three edits were made with PListBuddy on macos.
Kloak Crash Loop on arm64 after first boot:
kloak.service keeps crashing/dies with SIGSYS (status=31/SYS). Logs showed syscall 48, which is ‘faccessat’ on arm64. The units SystemCallFilters lists only the legacy x86 names and those syscalls does not exist on arm64. drop in fixed it. boot into the sysmaint session and run
sudo mkdir -p /etc/systemd/system/kloak.service.d
printf '[Service]\nSystemCallFilter=faccessat ppoll epoll_pwait epoll_pwait2 unlinkat\n' | sudo tee /etc/systemd/system/kloak.service.d/50_arm64-syscalls.conf
sudo systemctl daemon-reload
sudo systemctl restart kloak
Panel disappeared after login:
wlr-resize-watcher sets workstation to fixed 1920x1080 with dynamic resolutoon off. On my 14 inch Macbook Pro UTM Window is smaller than that so UTM crops the top and LXQt panel is out of view. Disabling that option makes utm scale the image to fit. Guest resolution stays at whonix default.
Pissmeister