| commit | 67c6ae4076728d3f1dbb8aac023d3d2af65f9f46 | [log] [tgz] |
|---|---|---|
| author | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | Sat Feb 17 02:25:26 2024 +0000 |
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | Sat Feb 17 02:25:26 2024 +0000 |
| tree | 6c8e4ed97f463eda36a6f7a3d2b179a47ecce800 | |
| parent | 10d8f37ceef7bc8b0b7525baec37d1723f26f931 [diff] | |
| parent | 3d0b4922803178c784a55272b7c67c5ba33bd290 [diff] |
Snap for 11463929 from 3d0b4922803178c784a55272b7c67c5ba33bd290 to 24D1-release Change-Id: I9e5375ef4d209fbeb041b9892511940b23544844
The secure storage service provides encrypted and tamper proof storage to secure apps. All operations that modify the file system state are transactional. Files can be opened, create or deleted by name (where the name is local to the app). Open files support read, write, get-size and set-size operations. There is currently no support for sparse files, permissions, quotas or directory operations.
The server provides three client ports that provide various minimum capabilities.
The STORAGE_CLIENT_TD_PORT port offers tamper and rollback detection once the non-secure OS has booted. This port should be used by most apps as it can offer more storage and better performance than the other choices.
The STORAGE_CLIENT_TDEA_PORT port also offers tamper and rollback detection but can be available before the non-secure OS has booted if the boot loader supports it.
The STORAGE_CLIENT_TP_PORT port offers tamper proof storage. An app can for instance use this port to store data needed by the boot loader that the non-secure OS cannot erase. Note that non-secure code can prevent read and write operations from succeeding, but it cannot modify on-disk data.
In the current code STORAGE_CLIENT_TDEA_PORT and STORAGE_CLIENT_TP_PORT map to the same file system. Apps should not create files with the same name using different ports, as it is device specific which ports share file systems.
The file system stores two super-blocks on a device that has tamper detection. The rest of the data can be stored in a non-secure partition or file. The default implementation has two file systems. One file system stores the super-blocks at the start of the mmc rpmb partition and all other blocks in a file in the file system of the non-secure OS. The other file system stores all data in the rpmb partition.
Both file systems use the same basic storage format but are configured to use different block, block number and mac sizes. Two super blocks are used to allow devices that don't provide atomic block write operations. Two version bits are used to identify the most recent super block version. The main purpose of the super block is to locate and validate the root of the free and file B+ trees.
Every block in the file system starts with a 16 byte iv struct. Each time the data in the block changes, this is assigned a new random value. The rest of the block is encrypted using this value and a device specific key.
The free set B+ tree list every free block in the file system as a set of ranges. The key value in the B+ tree is the start of a free range and the data value is the first block number not in the free range. Overlapping or adjacent ranges are not allowed, so the data value is also the start of an allocated range or, for the last free range, the number of blocks in the file system.
The file tree stores all the files in the file system. The key value is a hash of the file name and is the same size and the block number size for the file system. The data value is a block-mac that points to a file-entry block. The file-entry block stores the full file name, file size and the root of a block map where the file data can be found.
The block map tree is similar to the file tree except the key is the file block plus one (0 keys are not supported), and the data points to file data.
The super block always points to a valid file system. To make changes to the file system, any block that needs to change is copied to a new location. These changes are tracked by in-memory transaction objects. Before a transaction is complete it uses three block sets (the same storage format as the free set described above) to keep track of allocated and freed blocks. Blocks that will not be needed after the transaction completes are stored in the tmp_allocated set. Blocks that will be needed are stored in allocated, and blocks that should be added to the free set are stored in freed. To allow concurrent transactions to update independent files without conflict, files modified by a transaction are stored in temporary trees until the transaction is complete.
Example file system states of a file system using a 2k block size, 64 bit block numbers and 16 byte mac values:
Empty file system example.
Active Transaction state after creating a new file and writing one byte to it. Note that at this point all the added nodes may only be in the block cache.
State after completing transaction. The second super block is now the most recent one. The first super block still points to a valid file system, but as soon as the next transaction starts, those blocks may be reused. Block 3072 and above may not be on disk and their cache entries are invalid.
| 缺锌会有什么症状 | 结婚15年是什么婚 | 幺妹是什么意思 | 黄雀是什么鸟 | 空调不出水是什么原因 |
| 甲状腺囊性结节是什么意思 | 脑血管造影是什么意思 | 低迷是什么意思 | 未必是什么意思 | 七月十六号是什么星座 |
| 虚岁28岁属什么生肖 | 璨字五行属什么 | 欢乐海岸有什么好玩的 | 看什么 | lo娘是什么意思 |
| 干什么一天能挣1000元 | 苍蝇最怕什么 | 跳蚤最怕什么药 | 真丝和桑蚕丝有什么区别 | 石蜡是什么 |
| 刮痧是什么原理hcv8jop4ns3r.cn | 月经什么时候来hcv9jop5ns2r.cn | 白色病变是什么病hcv9jop0ns2r.cn | 吉可以加什么偏旁hcv8jop5ns4r.cn | 上身胖下身瘦是什么原因hcv8jop8ns5r.cn |
| 鼻子油腻是什么原因hcv8jop5ns4r.cn | 5201314是什么意思hcv9jop4ns2r.cn | 夜尿多是什么原因引起的hcv8jop9ns2r.cn | 阑尾炎在什么位置bjhyzcsm.com | 吃生姜有什么好处hcv9jop0ns0r.cn |
| 怀孕哭对宝宝有什么影响hcv8jop5ns6r.cn | 五彩斑斓是什么意思hcv9jop3ns8r.cn | 补肾壮阳吃什么好hcv9jop0ns1r.cn | 氯喹是什么药hcv8jop7ns2r.cn | 一九九八年属什么生肖hcv9jop0ns1r.cn |
| t和p是什么意思gangsutong.com | 湖北九头鸟是什么意思wzqsfys.com | 高招是什么意思hcv7jop6ns8r.cn | 面包虫是什么huizhijixie.com | 人潮汹涌是什么意思hcv7jop6ns8r.cn |