I wonder how VA->PA translation is handled from non-secure world with Aarch64.
I see the HYP mode uses IPA so that the second stage translation may restrict the VM to certain memory.
But what about limiting access to secure memory? Is it only possible if the SOC support the NS-bit for peripherals and memory?
Or is there also a second-stage translation table for EL3?