(Disclaimer: I'm the author of this blog)
In this post I cover the development of a full TrustZone exploit in MSM8974 (Snapdragon 800) SoCs, resulting in arbitrary code execution in the "Secure World". I've also provided the full source code!
Please let me know if you have any questions/comments.