Rootless · No KVM · 8 vCPU · Software-emulated ARM64

The KVM-Less
Boss Rush

A locked-down cloud desktop. No sudo, no Docker, no /dev/kvm, no binder module. The mission: boot a real ARM64 Android on it anyway. Six bosses stood in the way. Five fell.

0
Bosses
0
Defeated
0
Binary patches
0
Emulator builds
0
Root used

// Encounter log

I · THE GATEKEEPERDefeated
FATAL | Avd's CPU Architecture 'arm64' is not supported
      | by the QEMU2 emulator on x86_64 host.

A bluff. The check lived only in the launcher wrapper — the real emulator sat right behind it. Called qemu-system-aarch64-headless directly with -avd. Wall vanished.

II · THE PHANTOM BUSDefeated
qemu: PCI bus not available for virtio-snd-pci

It demanded a PCI sound card on a board that has no PCI bus at all. No flag could silence it — every switch just swapped one PCI device for another. Patched the string -soundhw-L in the binary: same byte length, and -L is a harmless repeatable option. It asked for nothing thereafter.

III · THE TWO WATCHERSDefeated
SIGSEGV · ___pthread_mutex_lock (mutex=0x188)
  HangDetector::addWatchedLooper
  CpuUsage::Impl::workerThread

A watchdog and a metrics collector, both clutching a null pointer, both killing the run. Neither did any actual work. Two no-op stubs via LD_PRELOAD and they stopped watching.

IV · RAMOOPSDefeated
Kernel panic - not syncing: Fatal exception
  __memcpy_toio ← persistent_ram_write ← pstore_console_write

Every line init logged got mirrored into a crash-log region that faulted on write. Logging itself was lethal. Renamed the kernel params ramoops.mem_*ramoops_mem_* so the kernel ignored them entirely.

V · GRALLOC PRIMEOutmaneuvered
vendor.hwcomposer-2-3 · signal 6 (SIGABRT)
  mapper@3.0-impl-ranchu :: HIDL_FETCH_IMapper

The graphics mapper wanted a memory device that only exists on a PCI bus — and there is no PCI bus. Unwinnable head-on. Retreated from Android 14 → 11 → 9, whose older graphics path never asks. Kernel booted. init, zygote64, system_server, surfaceflinger — all alive. adb shell answered.

VI · THE TRANSLATOR◈ Still standing
F libc: Fatal signal 11 (SIGSEGV), fault addr 0xffffff8f_b8dd1011
  _GLOBAL__sub_I_C2Config ← call_constructors
  android.hardware.audio@4.0-impl.so + 0x2fc50   ← identical PC, every run

The final boss isn't a config — it's the emulator's decade-old ARM translator miscompiling code. Vendor drivers die on impossible pointers, inside plain C++ startup code that cannot legitimately fail. Same crash address whatever you change. system_server waits forever for an audio service that can never arrive. Boot never completes. This one holds the field.

▚ RUN ENDED — 5/6

Android really does run here without KVM: kernel up, services up, adb answering. It just can't cross the finish line, because three ceilings sit in one ancient bundled emulator — ARMv8.0-only CPUs, a bus that isn't there, and a translator that gets the code wrong.

There is a cheat code. It is one line, and someone with root has to type it:

sudo usermod -aG kvm $USER

Served to you from that very machine — a rootless cloud desktop behind CGNAT, through an outbound tunnel, on a port above 1024.