Since commit 874a9121e40df114d850c918e5e240f2, the file structure of optee secure store REE FS has changed. The tag 2.5.0-rc1 (or later) includes this change.
Basic knowledge
- block size = 4096B = 4KB
The data to be encrypted is devided into blocks firstly, and the encryption and decryption is executed block by block. - dual version
There are always two versions of encrypted blocks after second writing. One is current version, and the other one is the last version.
Before 2.5.0-rc1
Files in REE side
A file of a TA is represented in following form:
|--
|-- The path /data/tee is often used as TEE Path.
object id is a series of hex number, which is output of coverting TA file name. The convertion function is tee_b2hs.
- blockX.Y file
As is mentioned above, every block saves 4KB data. The file with name blockX.Y is a block with index X and version Y. - meta.* file
Every time the data is changed, the meta.* file will alternate. For example, if meta.0 exists at first, it will be deleted and meta.1 will be created after data was updated.
From TA file to REE file
Here is an example that a TA file updates partially.
Because block 0 (0~4095B) has no change, there's nothing to do about block 0. So do block0.0 and block0.1. And for block 1, current version is 0, so block1.0 is unchanged too.
4096~6144B is in block 1, so the updated block is encrypted into another version (ver 1) of block (block 1). After that current version is changed from 0 to 1, and this is revorded in the new meta file.
Since 2.5.0-rc1
files in REE side
Secure file in REE side is represented in following form:
/
|--dirf.db
|--0
|--1
|--...
|--N
dirf.db is a special file, which only saves information of other TA files and doesn't save any TA file data. And every file else saves a file of a TA.
Hash Tree
Hash tree is a data structure, which saves encrypted data and meta data. It's a complete binary tree.
So it's easy to imagine that there should be at least three types of data structures. The first one saves information about the whole tree, the second one saves information about a node, and the third one saves data corresponding to nodes.
| Information type | data structure type |
|---|---|
| tree info | struct tee_fs_htree_image |
| node info | struct tee_fs_htree_node_image |
| node data | just bytes |
From TA file to REE file
First physical block
| File offset(B) S=sizeof(struct tee_fs_htree_image) |
Version | Content |
|---|---|---|
| 0 | 0 | hash tree image version 【0】 |
| S | 1 | hash tree image version 【1】 |
| 2S | - | no data |
The (63n+1, n=0,1,2...) block saves node images.
| block offset(B) S=sizeof(struct tee_fs_htree_node_image) |
Index | Version | Content |
|---|---|---|---|
| (2(N mod 63)+V)S | N | V (V=0,1) |
node 【N】 version 【V】 |
The (63(n+1)-m, n=0,1,2..., m=0,1...61) block saves node data.
| physical block index | data type |
|---|---|
| 0 | tree block |
| 1 | node block 1~31 |
| 2~63 | data block 2~31 |
| 64 | node block 32~62 |
| 65~126 | data block 32~62 |
| ... | ... |
The struct tee_fs_htree_image isn't shown in the following picture.