Context
I am working on an ARMv8-M system with TrustZone enabled. I want to completely disallow Non-Secure Unprivileged Execution (NS Unprivileged) from entering the Secure World via Non-Secure-Callable (NSC) regions using the SG (Secure Gateway) instruction.
SG
I tested this behavior on the following platforms:
Infineon PSC3M5 (ARM Cortex M33)
Musca-B1 (QEMU emulation)
The Problem
I initially thought I could restrict access to the NSC memory region using the Non-Secure Memory Protection Unit (NS MPU). However, based on my experiments, this does not seem to work as expected.
Even when a Non-Secure unprivileged process is restricted by the MPU to only access its own dedicated memory, it is still able to:
Branch/jump directly into the NSC region.
Execute the SG instruction.
Successfully transition the processor into the Secure World.
My Question
How can I properly block or disallow Non-Secure Unprivileged code from utilizing SG instructions to enter the Secure World, if the NS MPU alone isn't preventing this transition? Is there a specific configuration or architectural feature I am missing?
Any insights or best practices on how to achieve this isolation would be greatly appreciated.