diff --git a/blog/content/post/2024-03-08-cross2024-ftpm-tee-ta.md b/blog/content/post/2024-03-08-cross2024-ftpm-tee-ta.md
index ee09bf9e..24a1d4a8 100644
--- a/blog/content/post/2024-03-08-cross2024-ftpm-tee-ta.md
+++ b/blog/content/post/2024-03-08-cross2024-ftpm-tee-ta.md
@@ -45,20 +45,34 @@ in a protected execution environment called a trusted execution environment
For Arm Cortex-A, there exists the Arm TrustZone technology.
When used on an embedded device it creates two distinct memory "worlds": a
Normal World for the Operating System (referred to as Rich OS in documentation)
-and a Secure World, perfect for implementing the Trusted Execution Environment.
+and a Secure World, perfect for implementing the Trusted Execution
+Environment[[1]](#figure-1%3A-arm-trustzone-for-arm-cortex-a).
The transition between these worlds is managed by the Secure Monitor, operating
at a higher exception level (EL3), ensuring secure memory regions are
-exclusively accessible from the Secure World. This mechanism supports running
+exclusively accessible from the Secure
+World[[2]](#figure-2%3A-cortex-a-exception-levels).
+This mechanism supports running
fTPM in the Secure World, enabling secure syscalls from user space. Secrets
stored in fTPM are secure as long as the Secure Monitor is not compromised.
+
+
-
+
+##### Figure 1: Arm TrustZone for ARM Cortex-A
-
+
+
+
+
+
+
+
+##### Figure 2: Cortex-A Exception Levels
Arm TrustZone also exists for the Cortex-M series but adopts a simpler and more
hardware-focused approach relying on hardware mechanisms to manage the CPU
-state via interrupts.
+state via
+interrupts[[3]](#figure-3%3A-arm-trustzone-for-arm-cortex-m).
fTPM requires a non-trivial amount of computational
resources and memory, which might be scarce in the environments where Cortex-M
@@ -67,6 +81,12 @@ due to the limited resources available on these devices. It's also rare for the
Cortex-M devices demand the complex security functionalities that fTPM
provides.
+
+
+
+
+##### Figure 3: Arm TrustZone for ARM Cortex-M
+
## Fallbacks and Security Concerns
_The best-protected systems have dedicated hardware security measures included
@@ -79,7 +99,7 @@ this can improve the security of such devices there are hardware security
concerns that the device should fulfill from the beginning.
OP-TEE (Open Portable Trusted Execution Environment) is an open-source project
-that provides a TEE designed for Arm architectures that utilizes Arm TrustZone.
+that provides a TEE designed for ARM architectures that utilizes Arm TrustZone.
Its [official documentation specifies the Raspberry Pi 3 platform as not
suitable for a secure implementation of Trusted Execution Environment](
https://optee.readthedocs.io/en/latest/building/devices/rpi3.html#disclaimer).
