# Linux Kernel Module Cheat

### 34.1. Android image structure

https://source.android.com/devices/bootloader/partitions-images

The messy AOSP generates a ton of images instead of just one.

When the emulator launches, we can see them through QEMU `-drive` arguments:

    emulator: argv[21] = "-initrd"
    emulator: argv[22] = "/data/aosp/8.1.0_r60/out/target/product/generic_x86_64/ramdisk.img"
    emulator: argv[23] = "-drive"
    emulator: argv[24] = "if=none,index=0,id=system,file=/path/to/aosp/8.1.0_r60/out/target/product/generic_x86_64/system-qemu.img,read-only"
    emulator: argv[25] = "-device"
    emulator: argv[26] = "virtio-blk-pci,drive=system,iothread=disk-iothread,modern-pio-notify"
    emulator: argv[27] = "-drive"
    emulator: argv[28] = "if=none,index=1,id=cache,file=/path/to/aosp/8.1.0_r60/out/target/product/generic_x86_64/cache.img.qcow2,overlap-check=none,cache=unsafe,l2-cache-size=1048576"
    emulator: argv[29] = "-device"
    emulator: argv[30] = "virtio-blk-pci,drive=cache,iothread=disk-iothread,modern-pio-notify"
    emulator: argv[31] = "-drive"
    emulator: argv[32] = "if=none,index=2,id=userdata,file=/path/to/aosp/8.1.0_r60/out/target/product/generic_x86_64/userdata-qemu.img.qcow2,overlap-check=none,cache=unsafe,l2-cache-size=1048576"
    emulator: argv[33] = "-device"
    emulator: argv[34] = "virtio-blk-pci,drive=userdata,iothread=disk-iothread,modern-pio-notify"
    emulator: argv[35] = "-drive"
    emulator: argv[36] = "if=none,index=3,id=encrypt,file=/path/to/aosp/8.1.0_r60/out/target/product/generic_x86_64/encryptionkey.img.qcow2,overlap-check=none,cache=unsafe,l2-cache-size=1048576"
    emulator: argv[37] = "-device"
    emulator: argv[38] = "virtio-blk-pci,drive=encrypt,iothread=disk-iothread,modern-pio-notify"
    emulator: argv[39] = "-drive"
    emulator: argv[40] = "if=none,index=4,id=vendor,file=/path/to/aosp/8.1.0_r60/out/target/product/generic_x86_64/vendor-qemu.img,read-only"
    emulator: argv[41] = "-device"
    emulator: argv[42] = "virtio-blk-pci,drive=vendor,iothread=disk-iothread,modern-pio-notify"

The root directory is the initrd given on the QEMU CLI, which `/proc/mounts` reports at:

    rootfs on / type rootfs (ro,seclabel,size=886392k,nr_inodes=221598)

This contains the Android init, which through `.rc` must be mounting mounts the drives int o the right places TODO find exact point.

The drive order is:

    system
    cache
    userdata
    encryptionkey
    vendor-qemu

Then, on the terminal:

    mount | grep vd

gives:

    /dev/block/vda1 on /system type ext4 (ro,seclabel,relatime,data=ordered)
    /dev/block/vde1 on /vendor type ext4 (ro,seclabel,relatime,data=ordered)
    /dev/block/vdb on /cache type ext4 (rw,seclabel,nosuid,nodev,noatime,errors=panic,data=ordered)

and we see that the order of `vda`, `vdb`, etc. matches that in which `-drive` were given to QEMU.

Tested on: `8.1.0_r60`.

- Android images read-only

- Android /data partition