OP-TEE6-REE FS文件存储方式变化

Since commit 874a9121e40df114d850c918e5e240f2, the file structure of optee secure store REE FS has changed. The tag 2.5.0-rc1 (or later) includes this change.

Basic knowledge

  • block size = 4096B = 4KB
    The data to be encrypted is devided into blocks firstly, and the encryption and decryption is executed block by block.
  • dual version
    There are always two versions of encrypted blocks after second writing. One is current version, and the other one is the last version.

Before 2.5.0-rc1

Files in REE side

A file of a TA is represented in following form:


|--
   |--
      |--meta.0 or meta.1
      |--block0.0
      |--block0.1
      |--block1.0
      |--block1.1
      |--...
      |--blockN.0
      |--blockN.1
 
 

The path /data/tee is often used as TEE Path.
object id is a series of hex number, which is output of coverting TA file name. The convertion function is tee_b2hs.

  • blockX.Y file
    As is mentioned above, every block saves 4KB data. The file with name blockX.Y is a block with index X and version Y.
  • meta.* file
    Every time the data is changed, the meta.* file will alternate. For example, if meta.0 exists at first, it will be deleted and meta.1 will be created after data was updated.

From TA file to REE file

Here is an example that a TA file updates partially.
Because block 0 (0~4095B) has no change, there's nothing to do about block 0. So do block0.0 and block0.1. And for block 1, current version is 0, so block1.0 is unchanged too.
4096~6144B is in block 1, so the updated block is encrypted into another version (ver 1) of block (block 1). After that current version is changed from 0 to 1, and this is revorded in the new meta file.


from date to file

Since 2.5.0-rc1

files in REE side

Secure file in REE side is represented in following form:

/
|--dirf.db
|--0
|--1
|--...
|--N

dirf.db is a special file, which only saves information of other TA files and doesn't save any TA file data. And every file else saves a file of a TA.


mapping between TA data and REE file

Hash Tree

Hash tree is a data structure, which saves encrypted data and meta data. It's a complete binary tree.


hash tree

So it's easy to imagine that there should be at least three types of data structures. The first one saves information about the whole tree, the second one saves information about a node, and the third one saves data corresponding to nodes.

Information type data structure type
tree info struct tee_fs_htree_image
node info struct tee_fs_htree_node_image
node data just bytes

From TA file to REE file

First physical block
File offset(B)
S=sizeof(struct tee_fs_htree_image)
Version Content
0 0 hash tree image version 【0】
S 1 hash tree image version 【1】
2S - no data

The (63n+1, n=0,1,2...) block saves node images.

block offset(B)
S=sizeof(struct tee_fs_htree_node_image)
Index Version Content
(2(N mod 63)+V)S N V
(V=0,1)
node 【N】 version 【V】

The (63(n+1)-m, n=0,1,2..., m=0,1...61) block saves node data.

physical block index data type
0 tree block
1 node block 1~31
2~63 data block 2~31
64 node block 32~62
65~126 data block 32~62
... ...

The struct tee_fs_htree_image isn't shown in the following picture.

from data to file

你可能感兴趣的:(OP-TEE6-REE FS文件存储方式变化)