Correct usage of the NSTable bit in aarch64/armv7a LPAE

I'm porting our armv7a-short descriptor OS to LPAE and aarch64. In the short descriptor MMU, the "NS" bit can only be found in the first level of the MMU (I'll call it the SECTION level), meaning that only a single page cannot be tagged as NS, a whole SECTION of pages must be.

With the introduction of LPAE (and now in aarch64), the NS bit is located at the last level of the MMU, and thus a single page can be tagged S or NS. However I'd like (for compatibility reason) to keep the same behavior as before, meaning I want to tag a whole SECTION of pages as S or NS.

From what I understand from the NSTable bit, it could be used to do that but I'm not 100% sure. Here is what I understand: setting the NSTable bit to 1 would have two effects:

1. The next table located at the address in the descriptor will be treated as Non-secure, meaning that all of its entries' NS bits will be ignored and treated as Non-Secure. That's what I'm looking for
2. The next table itself will be considered to be located in Non-Secure memory, which is not the case (all of my tables are in secure memory), so I'm facing MMU issues like writing data using S bindings and reusing them using NS bindings.

Is my understanding correct (in which case I can't use the NSTable bit for my compatibility purpose), or did I make some mistake and I could use it ?

Best regards,

V.