A method for remote function call in a security application based on TEE specification
By backing up the entry function context in a security application and using assembly language to achieve fast return, the security application can temporarily call rich execution environment functions under the Global Platform specification, solving the problems of high development complexity and increased resource requirements in existing technologies, and realizing flexible function calls and parameter passing.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHANGHAI TRUSTKERNEL INFORMATION TECH CO LTD
- Filing Date
- 2022-12-11
- Publication Date
- 2026-05-19
AI Technical Summary
The existing Global Platform interface specification does not allow security applications to temporarily return and call functions within the rich execution environment, resulting in high complexity in security application development, increased resource requirements, and low security. Existing solutions require fine-grained decomposition of the entire business logic.
By backing up the entry function context in a security application, temporarily interrupting and calling a remote function, and using assembly language to quickly return to the rich execution environment, the security application can call the rich execution environment functions at any time under the Global Platform specification, defining the transmission methods of parameters and return results.
It enables security applications to call rich execution environment functions at any time while adhering to the Global Platform specification, reducing development difficulty, meeting the logic requirements of complex security applications, without increasing the resource requirements of security applications, and supporting parameter passing of any type and direction.
Smart Images
Figure CN115964103B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a method for remote function calls, and more particularly to a method for remote function calls in secure applications based on the TEE specification. Background Technology
[0002] The Global Platform (GP) international standards organization defines a standard execution model for secure applications within a Trusted Execution Environment (TEE) and interface specifications for communication with secure applications. In this model, the user of the secure application (TA) is called the client application (CA); the secure application provides services to the client application in a client-server-like manner. In processing requests from client applications, the secure application can call interfaces defined by the Global Platform Internal API (a network interface specification developed by the GP) to meet specific business requirements, such as storage functionality, key usage, and memory management.
[0003] The interfaces exposed by the Global Platform Internal API are highly versatile. However, compared to the interfaces provided by Rich Execution Environments (REEs) (such as the POSIX API), their functionality is extremely limited. Furthermore, as the internal logic of security applications becomes increasingly complex, the interfaces defined in the specifications are no longer sufficient to meet development needs.
[0004] Currently, security application developers typically need to manually port the required functionality from the rich execution environment to the trusted execution environment (TEX). However, this approach has several problems: 1) it requires a relatively high level of development skill from the developers; 2) it increases the resource requirements within the TEX; and 3) some of the functionality that needs to be ported has requirements on the underlying characteristics of the operating system, which the current operating systems within the TEX cannot meet.
[0005] Furthermore, within the overall business logic of a security application, the security requirements for different business logics vary. Some business logics (such as sending network packets) may have relatively low security requirements and can be executed directly in a rich execution environment. Therefore, for this type of business logic, instead of completely porting it into a trusted execution environment, having the application in the trusted execution environment directly call the corresponding function in the rich execution environment is a better choice to save resources and reduce development difficulty.
[0006] However, the current Global Platform interface specification makes the above methods difficult to implement. This is because the specification does not allow security applications to temporarily return and invoke functions within the rich execution environment during request processing. Therefore, existing solutions typically require fine-grained decomposition of the entire security application's business logic, which actually increases the complexity of the entire security solution and is not inherently very secure. Summary of the Invention
[0007] The purpose of this invention is to overcome the shortcomings of the existing technology and provide a method for remote function calls in secure applications based on the TEE specification, so as to enable the use of functions in the rich execution environment at any time through remote calls within a Global Platform secure application.
[0008] The objective of this invention can be achieved through the following technical solutions:
[0009] A method for remote function calls in a secure application based on the TEE specification, the method comprising the following steps:
[0010] 1) The client application calls TEEC_InvokeCommand, the security application backs up the entry function context, and proceeds to step 2);
[0011] 2) The security application executes the business logic and determines whether a remote function call is needed. If not, the security application completes the execution of the business logic and returns the call result to the client application. If yes, the security application encapsulates the call parameters and backs up the interrupted function context, quickly returns from the security application to the client application, and executes step 3).
[0012] 3) The client application parses the call parameters, system call, and encapsulates the call result, and then calls TEEC_InvokeCommand again to execute step 4);
[0013] 4) The security application obtains the remote function call context, restores the call context, parses the remote call result, and executes step 2).
[0014] Furthermore, step 1) specifically includes:
[0015] 101) Allocate memory in the security application and create a remote function jump context instance;
[0016] 102) Back up the session context, command ID, and command parameters passed to TA_InvokeCommandEntryPoint to the remote function jump context instance;
[0017] 103) Jump to the entry record function.
[0018] Furthermore, step 103) specifically includes:
[0019] 1031) Backup all general-purpose registers except the program counter register;
[0020] 1032) Push the value of the link register onto the stack, and then assign the values of registers R0, R1, and R2 to the values of registers R1, R2, and R3 in sequence, before jumping to the actual business logic;
[0021] 1033) Subtract the specified value from the stack pointer register to increase the stack frame size of the entry recording function;
[0022] 1034) Jump to the function entry point that handles the actual business logic and execute step 2).
[0023] Furthermore, the entry recording function receives four parameters, including the entry function context in the remote function jump context instance, the session context backed up in the remote function jump context, the command ID backed up in the remote function jump context, and the command parameters backed up in the remote function jump context.
[0024] Furthermore, step 2) specifically includes:
[0025] 201) Obtain the current remote function call context;
[0026] 202) Serialize the parameters of the function that needs to be passed to the rich execution environment, and copy the serialized content to the remote function call request parameters in the remote function call context;
[0027] 203) Call the fast interrupt function and back up the interrupt function context, then quickly return from the secure application; the fast interrupt function accepts the interrupt function context in the remote function call context as a parameter and is implemented in assembly.
[0028] Further, step 203) specifically includes:
[0029] 2031) Back up all general-purpose registers except the program counter register to the structure corresponding to the interrupt function context;
[0030] 2032) Back up all stack contents from the next stack frame of the entry recording function to the fast interrupt function to the stack backup space of the remote function call context by copying memory;
[0031] 2033) Set the value of the general-purpose register according to the contents of the entry function context in the remote function call context;
[0032] 2034) Copy R0 to a predefined remote function call request magic number, indicating that the reason for this function return is a remote function call, and its actual business logic has not yet been completed;
[0033] 2035) Assign the contents of the link register to the program counter register to form a jump to the location of the entry record function's return, and return the magic number of the remote function call request.
[0034] Furthermore, step 3) specifically refers to:
[0035] At the entry point, the return value of the recording function is checked. If the return value is the magic number of the remote function call request, the security application returns directly. In the client application, the rich execution environment function is called based on the return value and parameters of the security application. After the call is completed, the client application sends the call result back to the security application through TEEC_InvokeCommand. At this time, the command ID of TEEC_InvokeCommand is the magic number of the remote function call recovery.
[0036] Furthermore, step 4) specifically includes:
[0037] 401) Obtain the specified remote function call context based on the context ID obtained from the input parameters;
[0038] 402) Call the restore context function, which accepts the interrupt function context in the remote function call context as a parameter, and is implemented in assembly;
[0039] 403) At the point where the fast interrupt function returns, determine whether the remote function call was successful based on the return value; if it is non-zero, the remote function call failed; if it is zero, obtain the return value of the remote function and other data updates from the remote call recovery buffer in the remote call context according to predefined rules.
[0040] 404) Security applications continue to run.
[0041] Further, step 402) specifically includes:
[0042] 4011) Based on the stack backup space in the remote function call context, restore all stack contents from the next stack frame of the entry recording function to the bottom of the stack of the interrupt recording function;
[0043] 4012) Modify the top of the restored stack contents, replacing the data at the location of the backup link register with the current value of the link register;
[0044] 4013) Set the value of the current general-purpose register according to the interrupt function context in the remote function call context;
[0045] 4014) Set the value of register R0 to 0;
[0046] 4015) Assigns the value of the link register to the program counter register, forming a jump to the location of the fast interrupt function return, and the return value is 0.
[0047] Furthermore, the parameters passed from the security application to the client application include: the ID of the remote function call context, the function ID that uniquely describes the remote function call, and the parameters in the order of the remote function call parameters; the parameters passed from the client application to the security application include: the ID of the remote function call context, the serialized content of the returned content, and the serialized content of all outgoing type parameters.
[0048] Compared with the prior art, the present invention has the following beneficial effects:
[0049] I. This invention performs non-standard operations on the stack frames during function calls in C language, enabling secure applications to bypass the last-in-first-out (LIFO) restriction of stack frames during function calls. This allows for a jump to the entry point of the outermost function during execution, achieving a temporary interruption and return to the rich execution environment. Furthermore, at the entry point of the outermost function, the jump returns to the point of interruption during the previous execution, allowing for a return from the rich execution environment and continuation of execution from the point of interruption.
[0050] Second, this invention, while adhering to the Global Platform specification and without requiring any system-level support from the trusted execution environment, allows secure applications to use the functions within the rich execution environment at any time via remote invocation, satisfying complex business logic of secure applications without increasing the development difficulty of secure applications.
[0051] Third, this invention defines a method for transmitting parameters and return results when a secure application remotely calls a rich execution environment function, allowing parameter transmission of any type and in any direction. Attached Figure Description
[0052] Figure 1 This is a schematic diagram of the method flow of the present invention;
[0053] Figure 2 A diagram illustrating the call stack layout for fast return;
[0054] Figure 3 Sequence diagram of remote function calls for security applications;
[0055] Figure 4 A schematic diagram of the output parameter layout for a remote function call;
[0056] Figure 5 This is a schematic diagram of the layout of input parameters for a remote function call. Detailed Implementation
[0057] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.
[0058] Example
[0059] Related concepts:
[0060] The outermost function entry point for security applications is typically the TA_InvokeCommandEntryPoint function (according to the Global Platform Client API / Global Platform Internal API specification). This entry function takes three parameters:
[0061] Security application-private data associated with the invocation session (a communication session built between the security application and the client application via the Global Platform Client API) is maintained by the security application itself.
[0062] Command ID: Represents the specific command used by the client application to request the security application.
[0063] Parameters: These represent the parameters that the client application sends to the security application in this request.
[0064] According to the Global Platform Client API, a single call from a client application to a security application can pass four parameters of type value or buffer. When the type is value, the transmitted content is two 32-bit unsigned integers; when the type is buffer, the transmitted content is a buffer, the length of which is represented by the length field in the parameter structure; each parameter can define the direction of parameter transmission, which can be incoming, outgoing, or incoming-outgoing, corresponding to transmitting data from the client application to the security application, transmitting data from the security application to the client application, and both directions, respectively.
[0065] SP register (R13): Stack Pointer register SP, which points to the top of the function call stack.
[0066] PC register (R15): The Program Counter register (PC) typically points to the address of the next instruction to be executed. Program jumps can be achieved by modifying the value of the PC register.
[0067] LR register (R14): Link Register, used to store the return address of a subroutine when a program jumps.
[0068] General-purpose registers R0-R3 are typically used to pass parameters between subroutines. That is, when a function is called, the passed parameters are stored; when a subroutine returns, register R0 stores the function's return value.
[0069] like Figure 1 and 3 As shown, a method for remote function calls in a secure application based on the TEE specification includes the following steps:
[0070] 1) The client application calls TEEC_InvokeCommand, which is the context of the security application's backup entry function.
[0071] The outermost function entry point for a security application is typically the TA_InvokeCommandEntryPoint function. Normally, the security application needs to determine the purpose of the request based on the command ID within this entry function, and then forward the parameters to the specific business processing function. However, after implementing the method of this invention, the processing logic of the function entry point needs to be performed according to the following steps:
[0072] 101) Allocate memory in the security application and create a remote function jump context instance;
[0073] 102) Back up the session context, command ID, and command parameters passed to TA_InvokeCommandEntryPoint to the remote function jump context instance; for value type parameters, allocate 8 bytes of space and copy the value content when backing up the parameters; for buffer type parameters, allocate space of the same size as the buffer length when backing up the parameters. If the parameter type is passed in, copy the buffer content in the parameter to the newly allocated buffer. The purpose of this step is to ensure that the parameters passed to TA_InvokeCommandEntryPoint are still usable after subsequent business logic is interrupted and resumed, because these parameter information are determined by the client application when using the TEEC_InvokeCommand function (trusted execution environment calls command function), and subsequent TEEC_InvokeCommand calls may not carry the same parameters as the first InvokeCommand call for performance reasons.
[0074] 103) Jump to the entry record function; the entry record function is a dedicated jump board function, implemented in assembly language to avoid polluting application registers. It receives four parameters: the entry function context in the remote function jump context instance, containing an integer of length N (N is the number of general-purpose registers in the current instruction set architecture, such as 16 in the ARMv7-A architecture), the session context backed up in the remote function jump context, the command ID backed up in the remote function jump context, and the command parameters backed up in the remote function jump context. Specifically, it includes the following steps:
[0075] 1031) Backup all general-purpose registers except the program counter register;
[0076] 1032) Push the value of the link register onto the stack, and then assign the values of registers R0, R1, and R2 to the values of registers R1, R2, and R3 in sequence, before jumping to the actual business logic;
[0077] 1033) Subtract the specified value from the stack pointer register to increase the stack frame size of the entry record function; the purpose of increasing the stack frame size here is to avoid conflicts between the stack of specific business logic and the stack space required by the function to be executed during context restoration. Therefore, the specific length to be increased depends on the size of the stack involved in the subsequent context restoration process.
[0078] 1034) Jump to the function entry point that handles the actual business logic and start executing the specific business logic; at this time, the three parameters accepted by the business logic function are: the session context backed up in the remote function jump context, the command ID backed up in the remote function jump context, and the command parameters backed up in the remote function jump context.
[0079] 2) The security application executes the business logic and determines whether a remote function call is needed. If not, the security application completes the execution of the business logic and returns the call result to the client application. If so, the security application encapsulates the call parameters and backs up the interrupted function context, and quickly returns from the security application to the client application.
[0080] During the execution of real business logic, if the security application needs to call functions in the rich execution environment, it needs to back up the current context and quickly return from the security application. This process can be achieved through the following steps:
[0081] 201) Obtain the current remote function call context;
[0082] 202) Serialize the parameters of the function that needs to be passed to the rich execution environment, and copy the serialized content to the remote function call request parameters in the remote function call context;
[0083] 203) Call the fast interrupt function and back up the interrupt function context, then quickly return from the secure application; the fast interrupt function accepts the interrupt function context from the remote function call context as a parameter, is implemented in assembly, and the layout of the interrupt function context structure is consistent with the entry function context mentioned earlier; specifically:
[0084] 2031) Back up all general-purpose registers except the program counter register to the structure corresponding to the interrupt function context;
[0085] 2032) The stack contents from the next stack frame of the entry recording function to the fast interrupt function are backed up to the stack backup space of the remote function call context by memory copy; the stack backup space is a temporarily allocated buffer with the same length as the previous memory copy.
[0086] 2033) Set the value of the general-purpose register according to the contents of the entry function context in the remote function call context;
[0087] 2034) Copy R0 to a predefined remote function call request magic number, indicating that the reason for this function return is a remote function call, and its actual business logic has not yet been completed;
[0088] 2035) Assign the contents of the link register to the program counter register; because the value of the link register in the context of the entry function actually points to the address of the first instruction after the entry record function returns, the above assignment operation of the program counter register actually constitutes a jump to the location returned by the entry record function, and the return value is the remote function call request magic number.
[0089] 3) The client application parses the call parameters, system calls, and encapsulates the call results, and then calls TEEC_InvokeCommand again.
[0090] like Figure 2 As shown, the return value is checked at the entry record function return point. If the return value is the magic number of the remote function call request, the security application returns directly. In the client application, the rich execution environment function is called according to the return value and return parameters of the security application. After the call is completed, the client application sends the call result back to the security application through TEEC_InvokeCommand. At this time, the command ID of TEEC_InvokeCommand is the magic number of the remote function call recovery.
[0091] 4) The security application obtains the remote function call context, restores the call context, parses the remote call result, and executes step 2).
[0092] Upon re-entering the security application's entry function TA_InvokeCommandEntryPoint, the application determines whether this entry into TA is a business layer command or the completion of a remote function call based on the passed command ID. If the command ID is the remote function call recovery magic number, then it is considered that this call to the security application continues the logic that was interrupted by the previous remote function call, as follows:
[0093] 401) Obtain the specified remote function call context based on the context ID obtained from the input parameters;
[0094] 402) Call the restore context function, which accepts the interrupt function context in the remote function call context as a parameter, and is implemented in assembly;
[0095] 403) At the point where the fast interrupt function returns, determine whether the remote function call was successful based on the return value; if it is non-zero, the remote function call failed; if it is zero, obtain the return value of the remote function and other data updates from the remote call recovery buffer in the remote call context according to predefined rules.
[0096] 404) Security applications continue to run.
[0097] Step 402) specifically refers to:
[0098] 4011) Based on the stack backup space in the remote function call context, restore all stack contents from the next stack frame of the entry recording function to the bottom of the stack of the interrupt recording function;
[0099] 4012) Modify the top of the restored stack contents, replacing the data at the location of the backup link register with the current value of the link register;
[0100] 4013) Set the value of the current general-purpose register according to the interrupt function context in the remote function call context;
[0101] 4014) Set the value of register R0 to 0;
[0102] 4015) Assign the value of the link register to the program counter register; because the value of the link register in the context of the interrupt function actually points to the address of the first instruction after the fast interrupt function returns, the above assignment operation of the program counter register actually constitutes a jump to the location of the fast interrupt function return, and the return value is 0.
[0103] To enable parameter and return value passing when calling functions within a rich execution environment, this invention further defines the parameter passing method between client applications and security applications.
[0104] The method of this invention uses the third and fourth parameters for message passing in both the client application and the security application.
[0105] like Figure 4 As shown, the third parameter needs to be of type buffer to pass all parameters of a single remote function call. Therefore, this parameter is passed outwards, i.e., data is transferred from the security application to the client application. This buffer type needs to contain the following:
[0106] Remote function call context ID: An identifier that is assigned to a remote function call context when it is created, which can uniquely identify the context;
[0107] A unique function ID that describes a remotely invoked function: the mapping relationship between this ID and the remote function needs to be agreed upon by both the security application and the client application;
[0108] Parameters in the order of parameters in the remote function call: The serialization and deserialization of parameters should be consistent on both the security application and the client application. For example, each parameter can be represented in the form of "length-value", where "length" is the length of the parameter in memory and "value" is the actual value of the parameter in memory.
[0109] It's important to note that parameters such as output variables and output buffers, which are passed from the called function to the caller, can be omitted to improve message passing performance. After receiving the complete content, the client application locates the rich execution environment function to be called based on the function ID, deserializes the parameters in the passed content, calls the specified function, and obtains the return value and the content of the output parameters.
[0110] like Figure 5 As shown, the fourth parameter must be of type buffer, used to pass the return value and output type of a remote function call, or a buffer, i.e., passing data from the client application to the security application. This buffer type must contain the following:
[0111] Remote function call context ID: An identifier that is assigned to a remote function call context when it is created, which can uniquely identify the context;
[0112] Returns the serialized content;
[0113] The serialized content of all outgoing type parameters.
[0114] After receiving the complete content, the security application checks whether the remote function call context matches the backed-up context ID in the stack frame. If they match, it deserializes the return content and output parameters and resumes execution from where it was interrupted.
[0115] The main idea of this invention is to perform non-standard operations on the stack frames during function calls in C language, enabling secure applications to bypass the last-in-first-out (LIFO) restriction of stack frames during function calls. This allows for jumps to the entry point of the outermost function during execution, achieving the effect of temporarily interrupting execution and returning to the rich execution environment, and jumping from the entry point of the outermost function to the point where execution was interrupted, thus returning from the rich execution environment and continuing execution from the point of interruption.
[0116] Because C++ operates on stack frames similarly during function calls, this invention is also applicable to C++. However, since this invention involves direct manipulation of registers, its applicability is affected by the target platform's instruction set architecture. Currently, this invention can be applied to hardware platforms using the ARM / ARM64 instruction set, including ARM-v7A, ARM-v8A, and ARM-v9A.
[0117] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.
Claims
1. A method for remote function calls in secure applications based on the TEE specification, characterized in that, The method includes the following steps: 1) The client application calls TEEC_InvokeCommand, the security application backs up the entry function context, and proceeds to step 2). 2) The security application executes the business logic and determines whether a remote function call is needed. If not, the security application completes the execution of the business logic and returns the call result to the client application. If yes, the security application encapsulates the call parameters and backs up the interrupted function context, quickly returns from the security application to the client application, and executes step 3). 3) The client application parses the call parameters, system call, and encapsulates the call result, and then calls TEEC_InvokeCommand again to execute step 4). 4) The security application obtains the remote function call context, restores the call context, parses the remote call result, and executes step 2). Step 1) specifically refers to: 101) Allocate memory in a security application and create a remote function jump context instance; 102) Back up the session context, command ID, and command parameters passed to TA_InvokeCommandEntryPoint to the remote function jump context instance; 103) Jump to the entry record function.
2. The method for remote function calls in secure applications based on the TEE specification according to claim 1, characterized in that, Step 103) specifically refers to: 1031) Backup all general-purpose registers except the program counter register; 1032) Push the value of the link register onto the stack, and then assign the values of registers R0, R1, and R2 to the values of registers R1, R2, and R3 in sequence, before jumping to the actual business logic; 1033) Subtract the specified value from the stack pointer register to increase the stack frame size of the entry recording function; 1034) Jump to the function entry point that handles the actual business logic and execute step 2).
3. The method for remote function calls in secure applications based on the TEE specification according to claim 1, characterized in that, The entry record function receives four parameters, including the entry function context in the remote function jump context instance, the session context backed up in the remote function jump context, the command ID backed up in the remote function jump context, and the command parameters backed up in the remote function jump context.
4. The method for remote function calls in secure applications based on the TEE specification according to claim 1, characterized in that, Step 2) specifically refers to: 201) Obtain the current remote function call context; 202) Serialize the parameters of the function that needs to be passed to the rich execution environment, and copy the serialized content to the remote function call request parameters in the remote function call context; 203) Call the fast interrupt function and back up the interrupt function context, then quickly return from the secure application; the fast interrupt function accepts the interrupt function context in the remote function call context as a parameter and is implemented in assembly.
5. The method for remote function calls in secure applications based on the TEE specification according to claim 4, characterized in that, Step 203) specifically refers to: 2031) Back up all general-purpose registers except the program counter register to the structure corresponding to the interrupt function context; 2032) Back up all stack contents from the next stack frame of the entry recording function to the fast interrupt function to the stack backup space of the remote function call context by copying memory; 2033) Set the value of the general-purpose register according to the contents of the entry function context in the remote function call context; 2034) Copy R0 to a predefined remote function call request magic number, indicating that the reason for the function return is a remote function call, and its actual business logic has not yet been completed; 2035) Assign the contents of the link register to the program counter register to form a jump to the location of the entry record function's return, and return the magic number of the remote function call request.
6. The method for remote function calls in secure applications based on the TEE specification according to claim 5, characterized in that, Step 3) specifically refers to: The security application checks the return value at the entry point of the recording function. If the return value is the magic number of the remote function call request, the security application returns directly. In the client application, the rich execution environment functions are called based on the return value and return parameters of the security application. After the call is completed, the client application will send the call result back to the security application via TEEC_InvokeCommand. At this time, the command ID of TEEC_InvokeCommand is the remote function call recovery magic number.
7. The method for remote function calls in secure applications based on the TEE specification according to claim 1, characterized in that, Step 4) specifically refers to: 401) Obtain the specified remote function call context based on the context ID obtained from the input parameters; 402) Call the restore context function, which accepts the interrupt function context in the remote function call context as a parameter, and is implemented in assembly; 403) At the point where the fast interrupt function returns, determine whether the remote function call was successful based on the return value; If the value is non-zero, the remote function call fails; If the value is 0, the return value of the remote call function and other data updates are obtained from the remote call recovery buffer in the remote call context according to predefined rules; 404) Security applications continue to run.
8. A method for remote function calls in secure applications based on the TEE specification according to claim 7, characterized in that, Step 402) specifically refers to: 4011) Based on the stack backup space in the remote function call context, restore all stack contents from the next stack frame of the entry recording function to the bottom of the stack of the interrupt recording function; 4012) Modify the top of the restored stack contents, replacing the data at the location of the backup link register with the current value of the link register; 4013) Set the value of the current general-purpose register according to the interrupt function context in the remote function call context; 4014) Set the value of register R0 to 0; 4015) Assign the value of the link register to the program counter register, forming a jump to the location of the fast interrupt function return, and the return value is 0.
9. A method for remote function calls in secure applications based on the TEE specification according to claim 1, characterized in that, The parameters passed from the security application to the client application include: the ID of the remote function call context, the function ID that uniquely describes the remote function call, and the parameters in the order of the remote function call parameters; the parameters passed from the client application to the security application include: the ID of the remote function call context, the serialized content of the returned content, and the serialized content of all outgoing type parameters.