Non-secure call Secure used SG instruction cause Hard Fault

I tried to switch between secure and non-secure on M33. Based on the qemu mps2-an521 platform, with sau configured, the security can be switched to the non-secure state, and then I tried to switch to the secure state through the SG instruction, but it failed.

memory layout：

0x0200_0000 - 0x003F_FFFF (non-secure)

0x1000_0000 - 0x100F_FFFF (secure)

0x1010_0000 - 0x101F_FFFF (non-secure callable)

SAU config:

    SAU->RBAR = 0x10100000;
	SAU->RLAR = 0x101FFFE3;

NSC code:

	.thumb_func
	.section NSC,"aw"
	.globl   nsc_call
nsc_call:
	sg
	nop
	nop
	nop

secure ld：

    NSC (0x10100000):
    {
        *nsc*(.text*)
    } > RAM

non-secure caller code:

	ldr		r0, =0x10100001;
	bx 		r0

When the line of code 'bx r0' is executed, it will enter the secure world hard fault. 

Any reason why this is occurring? I don’t know how to continue. 

Thanks for any clues or suggestions.