BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//talks.osfc.io//osfc-2026//talk//GSLJUP
BEGIN:VTIMEZONE
TZID:Europe/Berlin
BEGIN:DAYLIGHT
DTSTART:20250915T000000
TZNAME:CEST
TZOFFSETFROM:+0200
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20251026T030000
RDATE:20261025T030000
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20260329T030000
RDATE:20270328T030000
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Setting Boundaries: Securing overlooked OP-TEE attack vectors - Ma
 rco Felsch
DTSTART;TZID=Europe/Berlin:20260915T113000
DTEND;TZID=Europe/Berlin:20260915T120000
DTSTAMP:20260817T120804Z
UID:pretalx-osfc-2026-GSLJUP@talks.osfc.io
DESCRIPTION:Security requires isolation and for most ARM systems\, this co
 mes in the form of the ARM TrustZone\, which divides the CPU into a secure
  and normal world. This allows the system to run a trusted exectuion envir
 onment (TEE) in the secure world and a rich execution environment (REE) in
  the normal world.\n\nOf course\, the TEE needs to be loaded from somewher
 e and be executed somewhere else. Doing this in a secure manner requires c
 areful orchestration between multiple firmwares and failure to do so leads
  to serious vulnerabilities. \n\nThe talk starts off with a TEE setup that
  should sound familiar to many:\nA prebootloader starts at the highest pri
 vilige level\, does some DDR initialization and loads TF-A and OP-TEE as w
 ell as the final bootloader into memory. Then TF-A is invoked installing i
 tself as secure monitor and OP-TEE as trusted OS before returning to the b
 ootloader in a lower privilige level.\n\nFrom there on\, the CPU should fa
 ult trying to access secure memory\, however hard the normal world tries. 
 However\, as Marco will show\, there is no shortage on creative alternativ
 e ways to access memory and unfortunately\, they are often overlooked lead
 ing to real world exploits.\n\nThis work culiminated into a number of patc
 hes across TF-A\, OP-TEE and the barebox bootloader.
LOCATION:Main
URL:https://talks.osfc.io/osfc-2026/talk/GSLJUP/
END:VEVENT
END:VCALENDAR