[PATCH v4 1/6] tee: add restricted memory allocation