title: ARM TrustZone, connecting peripherals?
body: <p>I'm currently doing some research about ARM's TrustZone, e.g. here: <a href="http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.prd29-genc-009492c/CABGFFIC.html" rel="noreferrer">ARM information center</a>. As far as I understand, with TrustZone a secure environment based on the AMBA AXI bus can be created.  </p>
  
  <p>On <a href="https://www.arm.com/products/security-on-arm/trustzone" rel="noreferrer">ARM website</a> it says: "This concept of secure and non-secure worlds extends beyond the processor to encompass memory, software, bus transactions, interrupts and peripherals within an SoC." I read that peripherals can be connected to TrustZone via the <strong>N</strong>on<strong>S</strong>ecure-bit of the AMBA AXI bus (The extra signal is used to differentiate between trusted and non-trusted requests). </p>
  
  <p>1) What, except the extra pin of AMBA AXI bus, is the TrustZone specific hardware in a SoC with TrustZone?</p>
  
  <p>2) Is it possible to connect an external non-volatile memory (e.g. Flash) or a partition of it to TrustZone with access to secure world (via external memory interface and -then internal- the AXI bus)? If no, how are secrets (as keys) stored to be used in the secure world (with help of fuses??)? If yes, how is it prevented that a Flash including malicious code is connected?</p>
  
  <p>3) Is it possible to implement code to the secure world as a customer of a chip vendor (e.g. TI or NXP), either before or after the chip left the factory? </p>
  
  <p>Thank you for your answers.</p>