and Correctly Using the NSTable Bit in ARMv7-A LPAE and AArch64 MMU Descriptors

NSTable Bit Behavior and Its Implications in ARMv7-A LPAE and AArch64

The NSTable bit in ARMv7-A LPAE (Large Physical Address Extension) and AArch64 memory management units (MMUs) plays a critical role in defining the security attributes of memory translations. Specifically, it determines whether the subsequent level of page tables should be treated as Non-Secure (NS) or Secure (S). This bit is particularly important in systems where both Secure and Non-Secure worlds coexist, such as in TrustZone-enabled ARM processors.

In the ARMv7-A short descriptor format, the NS bit is located at the first level of the MMU, meaning that an entire section of memory (typically 1 MB) must be marked as either Secure or Non-Secure. However, with the introduction of LPAE and AArch64, the NS bit is moved to the final level of the MMU, allowing individual pages to be marked as Secure or Non-Secure. This granularity is beneficial for fine-grained memory protection but introduces complexity when porting systems that rely on the older, section-based security model.

The NSTable bit, when set to 1, has two primary effects:

1. It marks the next level of page tables as Non-Secure, meaning that all entries within those tables will be treated as Non-Secure, regardless of their individual NS bits.
2. It implies that the next level of page tables themselves are located in Non-Secure memory, which can lead to complications if the tables are actually stored in Secure memory.

This dual effect is crucial for systems that share page tables between Secure and Non-Secure worlds. For example, the Non-Secure world might be allowed to modify its own page tables, but the Secure world needs to ensure that these modifications do not inadvertently map Non-Secure addresses to Secure memory. The NSTable bit helps enforce this separation by ensuring that Non-Secure page tables cannot override the Secure attributes of memory regions.

However, this mechanism can cause issues when the page tables are stored in Secure memory but marked as Non-Secure via the NSTable bit. In such cases, the memory controller might reject access attempts during table walks or descriptor updates, leading to MMU faults or unexpected behavior.

Memory Controller Rejections and Cache Coherency Challenges

One of the primary challenges when using the NSTable bit in systems with mixed Secure and Non-Secure memory is ensuring that the memory controller and cache hierarchy behave correctly. When the NSTable bit is set to 1, the MMU treats the next level of page tables as Non-Secure, which affects not only the translation process but also the attributes sent to the cache and bus during table walks.

If the page tables are stored in Secure memory but marked as Non-Secure via the NSTable bit, the memory controller might reject access attempts because it detects a mismatch between the security attributes of the access and the memory region. This can manifest as bus faults or data aborts during MMU table walks.

Additionally, cache coherency can become a concern. The cache hierarchy in ARM processors typically uses the security attributes of memory accesses to determine how data is cached and invalidated. If the NSTable bit is used incorrectly, it can lead to situations where data is cached with the wrong security attributes, causing coherency issues when the same data is accessed with different security settings.

For example, if a Secure world application writes data to a memory region that is later accessed by the Non-Secure world, the cache might retain the Secure attributes of the data, leading to incorrect behavior when the Non-Secure world attempts to access it. This is particularly problematic in systems that rely on shared memory regions for communication between Secure and Non-Secure worlds.

Implementing Secure and Non-Secure Memory Partitioning with NSTable

To address the challenges associated with the NSTable bit, system designers must carefully partition memory between Secure and Non-Secure regions and ensure that page tables are stored in the appropriate type of memory. Here are some key considerations and steps for implementing a robust memory partitioning scheme:

1. Define Clear Memory Regions: Clearly define which regions of memory are Secure and which are Non-Secure. This includes not only application memory but also MMU page tables and other system data structures. Use the memory protection unit (MPU) or MMU to enforce these boundaries.

2. Store Page Tables in the Correct Memory Type: Ensure that page tables are stored in memory regions that match their security attributes. For example, if a page table is marked as Non-Secure via the NSTable bit, it should be stored in Non-Secure memory. This prevents the memory controller from rejecting access attempts during table walks.

3. Use Memory Barriers and Cache Maintenance Operations: When transitioning between Secure and Non-Secure worlds, use memory barriers and cache maintenance operations to ensure that data is correctly synchronized between the cache and main memory. This is especially important when sharing memory regions between worlds.

4. Leverage TrustZone Mechanisms: ARM TrustZone provides hardware mechanisms for isolating Secure and Non-Secure worlds. Use these mechanisms to enforce security policies and prevent unauthorized access to Secure memory. For example, the Secure Monitor Call (SMC) instruction can be used to switch between worlds in a controlled manner.

5. Test and Validate the Implementation: Thoroughly test the memory partitioning scheme to ensure that it behaves as expected under all conditions. This includes testing edge cases, such as simultaneous access to shared memory regions by both Secure and Non-Secure worlds.

By following these steps, system designers can effectively use the NSTable bit to implement a secure and efficient memory partitioning scheme in ARMv7-A LPAE and AArch64 systems. This ensures that both Secure and Non-Secure worlds can coexist without compromising system integrity or performance.

Conclusion

The NSTable bit in ARMv7-A LPAE and AArch64 MMUs is a powerful tool for managing memory security attributes, but it requires careful handling to avoid pitfalls such as memory controller rejections and cache coherency issues. By understanding the dual effects of the NSTable bit and implementing a robust memory partitioning scheme, system designers can ensure that their systems are both secure and efficient. This is particularly important in TrustZone-enabled systems, where the separation between Secure and Non-Secure worlds is critical for maintaining system integrity.