I have a basic concept question. From what I read in the ARMv8 docs... there is an NS and NSTable bit in the page table entries themselves for the 2nd level and higher page table lookups. So these can be used to block access ... I.e. NS access is attempting to do access to secure memory.
One point I don't quite understand is how is the first level page table itself protected? Meaning what determines whether secure/non secure can access the first level page table? the first level page table being the very initial lookup. I believe the address of the page table itself gets programmed in a TTBR register that is not banked on secure/non-secure. So is it a common page table for both worlds if there is a single register and what protection prevents NS trying to change the page table itself?
Thanks
Nothing at all. To prevent the non-secure OS to access physical memory you consider "Secure Only", you have to use a TZASC (trustzone address space controller), that will use the NS bit of the virtual address to allow or deny access to the physical memory