Support using UTM's build of QEMU (for stability, GPU acceleration, sudo-less vmnet)

[AkihiroSuda]

UTM's build of QEMU seems more stable and also supports GPU acceleration:

• QEMU on macOS 15.2 on Apple M4: qemu-system-aarch64: Property 'host-arm-cpu.sme' not found #3032
• qemu: support OpenGL acceleration (VirGL) #2086

Not sure how to launch it though

$ file /Applications/UTM.app/Contents/Frameworks/qemu-x86_64-softmmu.framework/Versions/A/qemu-x86_64-softmmu 
/Applications/UTM.app/Contents/Frameworks/qemu-x86_64-softmmu.framework/Versions/A/qemu-x86_64-softmmu: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit dynamically linked shared library x86_64] [arm64]
/Applications/UTM.app/Contents/Frameworks/qemu-x86_64-softmmu.framework/Versions/A/qemu-x86_64-softmmu (for architecture x86_64):	Mach-O 64-bit dynamically linked shared library x86_64
/Applications/UTM.app/Contents/Frameworks/qemu-x86_64-softmmu.framework/Versions/A/qemu-x86_64-softmmu (for architecture arm64):	Mach-O 64-bit dynamically linked shared library arm64

$ /Applications/UTM.app/Contents/XPCServices/QEMUHelper.xpc/Contents/MacOS/QEMULauncher.app/Contents/MacOS/QEMULauncher /Applications/UTM.app/Contents/Frameworks/qemu-x86_64-softmmu.framework/Versions/A/qemu-x86_64-softmmu 
Trace/BPT trap: 5

An alternative way is to push UTM's patches to Homebrew, but not sure whether Homebrew maintainers will like it.

[AkihiroSuda]

Looks like sudo-less vmnet can be enabled too when UTM.app is signed
utmapp/UTM@4a22d43

[balajiv113]

UTM.app is signed

Exactly, If the app have the network entitlement them we don't need sudo for vmnet.

[jandubois]

Exactly, If the app have the network entitlement them we don't need sudo for vmnet.

What entitlements would allow this? I thought it would require com.apple.vm.networking, which is only available upon request to developers of virtualization software that is distributed through the app store (so has no access to run anything as root).

It was my understanding that it is impossible to get this entitlement if you want to distribute outside the app store; you are supposed to run as root instead.

I guess UTM is distributed through the app store, and they may have been given the entitlement by Apple.

I'm pretty sure we would need to be a GUI app to distribute Lima through the app store, and even then I wonder if we could get the entitlement as an open source project.

[AkihiroSuda]

The free version (brew install utm) seems to have the entitlement too.
ps -ef shows -netdev vmnet-bridged,id=net0,ifname=en0

[norio-nomura]

You can check the entitlements for each application using the following commands:

qlmanage -p "/Applications/UTM.app/Contents/embedded.provisionprofile"

It seems that VMware Fusion, which is distributed outside the App Store, also has the com.apple.vm.networking entitlement:

qlmanage -p "/Applications/VMware Fusion.app/Contents/embedded.provisionprofile"