Since commit 874a9121e40df114d850c918e5e240f2, the file structure of optee secure store REE FS has changed. The tag 2.5.0-rc1 (or later) includes this change.

Basic knowledge

• block size = 4096B = 4KB
  The data to be encrypted is devided into blocks firstly, and the encryption and decryption is executed block by block.
• dual version
  There are always two versions of encrypted blocks after second writing. One is current version, and the other one is the last version.

Before 2.5.0-rc1

Files in REE side

A file of a TA is represented in following form:

<TEE Path>
|--<TA uuid>
   |--<object id>
      |--meta.0 or meta.1
      |--block0.0
      |--block0.1
      |--block1.0
      |--block1.1
      |--...
      |--blockN.0
      |--blockN.1

The path /data/tee is often used as TEE Path.
object id is a series of hex number, which is output of coverting TA file name. The convertion function is tee_b2hs.

• blockX.Y file
  As is mentioned above, every block saves 4KB data. The file with name blockX.Y is a block with index X and version Y.
• meta.* file
  Every time the data is changed, the meta.* file will alternate. For example, if meta.0 exists at first, it will be deleted and meta.1 will be created after data was updated.

From TA file to REE file

Here is an example that a TA file updates partially.
Because block 0 (0~4095B) has no change, there's nothing to do about block 0. So do block0.0 and block0.1. And for block 1, current version is 0, so block1.0 is unchanged too.
4096~6144B is in block 1, so the updated block is encrypted into another version (ver 1) of block (block 1). After that current version is changed from 0 to 1, and this is revorded in the new meta file.

from date to file

Since 2.5.0-rc1

files in REE side

Secure file in REE side is represented in following form:

<TEE Path>/
|--dirf.db
|--0
|--1
|--...
|--N

dirf.db is a special file, which only saves information of other TA files and doesn't save any TA file data. And every file else saves a file of a TA.

mapping between TA data and REE file

Hash Tree

Hash tree is a data structure, which saves encrypted data and meta data. It's a complete binary tree.

hash tree

So it's easy to imagine that there should be at least three types of data structures. The first one saves information about the whole tree, the second one saves information about a node, and the third one saves data corresponding to nodes.

From TA file to REE file

First physical block

The (63n+1, n=0,1,2...) block saves node images.

The (63(n+1)-m, n=0,1,2..., m=0,1...61) block saves node data.

The struct tee_fs_htree_image isn't shown in the following picture.

from data to file