嵌入式 Linux C ARM

OP-TEE6-REE FS文件存储方式变化

2019-06-06  本文已影响17人  阿棍儿_Leon

Since commit 874a9121e40df114d850c918e5e240f2, the file structure of optee secure store REE FS has changed. The tag 2.5.0-rc1 (or later) includes this change.

Basic knowledge

Before 2.5.0-rc1

Files in REE side

A file of a TA is represented in following form:

<TEE Path>
|--<TA uuid>
   |--<object id>
      |--meta.0 or meta.1
      |--block0.0
      |--block0.1
      |--block1.0
      |--block1.1
      |--...
      |--blockN.0
      |--blockN.1

The path /data/tee is often used as TEE Path.
object id is a series of hex number, which is output of coverting TA file name. The convertion function is tee_b2hs.

From TA file to REE file

Here is an example that a TA file updates partially.
Because block 0 (0~4095B) has no change, there's nothing to do about block 0. So do block0.0 and block0.1. And for block 1, current version is 0, so block1.0 is unchanged too.
4096~6144B is in block 1, so the updated block is encrypted into another version (ver 1) of block (block 1). After that current version is changed from 0 to 1, and this is revorded in the new meta file.


from date to file

Since 2.5.0-rc1

files in REE side

Secure file in REE side is represented in following form:

<TEE Path>/
|--dirf.db
|--0
|--1
|--...
|--N

dirf.db is a special file, which only saves information of other TA files and doesn't save any TA file data. And every file else saves a file of a TA.


mapping between TA data and REE file

Hash Tree

Hash tree is a data structure, which saves encrypted data and meta data. It's a complete binary tree.


hash tree

So it's easy to imagine that there should be at least three types of data structures. The first one saves information about the whole tree, the second one saves information about a node, and the third one saves data corresponding to nodes.

Information type data structure type
tree info struct tee_fs_htree_image
node info struct tee_fs_htree_node_image
node data just bytes

From TA file to REE file

First physical block
File offset(B)
S=sizeof(struct tee_fs_htree_image)
Version Content
0 0 hash tree image version 【0】
S 1 hash tree image version 【1】
2S - no data

The (63n+1, n=0,1,2...) block saves node images.

block offset(B)
S=sizeof(struct tee_fs_htree_node_image)
Index Version Content
(2(N mod 63)+V)S N V
(V=0,1)
node 【N】 version 【V】

The (63(n+1)-m, n=0,1,2..., m=0,1...61) block saves node data.

physical block index data type
0 tree block
1 node block 1~31
2~63 data block 2~31
64 node block 32~62
65~126 data block 32~62
... ...

The struct tee_fs_htree_image isn't shown in the following picture.

from data to file
上一篇 下一篇

猜你喜欢

热点阅读