Qualcomm’s Secure Environment Operating System (QSEOS) provides services to the applications running under it by means of system-calls. In the “Secure World”, user-space applications can invoke system-call by issuing the “SVC” instruction. This means the operating system mustn’t trust any information provided by an application and should always validate it. In this blog post we’ll continue our journey from zero permissions to code execution in the TrustZone kernel. There are quite a few interesting things we can do solely from the context of this kernel. We could hijack any QSEE application directly, exposing all of it’s internal secrets.”]
Source: https://bits-please.blogspot.com/2016/06/trustzone-kernel-privilege-escalation.html