diff --git a/os/common/ports/ARMv8-M-ML/chcore.h b/os/common/ports/ARMv8-M-ML/chcore.h
index 354bf3a1d..b0b2d1809 100644
--- a/os/common/ports/ARMv8-M-ML/chcore.h
+++ b/os/common/ports/ARMv8-M-ML/chcore.h
@@ -631,6 +631,9 @@ extern "C" {
 #endif
   void port_init(void);
   void __port_thread_start(void);
+#if PORT_KERNEL_MODE == PORT_KERNEL_MODE_HOST
+  __NO_RETURN void __port_ns_boot(uint32_t vtor);
+#endif
 #ifdef __cplusplus
 }
 #endif
diff --git a/os/common/ports/ARMv8-M-ML/compilers/GCC/chcoreasm.S b/os/common/ports/ARMv8-M-ML/compilers/GCC/chcoreasm.S
index 623addee5..2cc9dfd3c 100644
--- a/os/common/ports/ARMv8-M-ML/compilers/GCC/chcoreasm.S
+++ b/os/common/ports/ARMv8-M-ML/compilers/GCC/chcoreasm.S
@@ -65,6 +65,7 @@
 
 /* Other constants.*/
 #define SCB_ICSR        0xE000ED04
+#define SCB_VTOR_NS     0xE002ED08
 #define ICSR_PENDSVSET  0x10000000
 
                 .syntax unified
@@ -218,6 +219,51 @@ __port_thread_start:
                 bl      chThdExit
 _zombies:       b       _zombies
 
+#if PORT_KERNEL_MODE == PORT_KERNEL_MODE_HOST
+/*--------------------------------------------------------------------------*
+ * Safe jump in non-secure code zone. All registers are cleared.
+ *--------------------------------------------------------------------------*/
+                .thumb_func
+                .globl  __port_ns_boot
+__port_ns_boot:
+                movs    r3, #0
+                movs    r4, #0
+                movs    r5, #0
+                movs    r6, #0
+                movs    r7, #0
+                movs    r8, #0
+                movs    r9, #0
+                movs    r10, #0
+                movs    r11, #0
+                movs    r12, #0
+                movs    lr, #0
+#if CORTEX_USE_FPU
+                vldr.64 d0, =0
+                vldr.64 d1, =0
+                vldr.64 d2, =0
+                vldr.64 d3, =0
+                vldr.64 d4, =0
+                vldr.64 d5, =0
+                vldr.64 d6, =0
+                vldr.64 d7, =0
+                vldr.64 d8, =0
+                vldr.64 d9, =0
+                vldr.64 d10, =0
+                vldr.64 d11, =0
+                vldr.64 d12, =0
+                vldr.64 d13, =0
+                vldr.64 d14, =0
+                vldr.64 d15, =0
+#endif
+                msr     BASEPRI, r3
+                ldr     r1, =SCB_VTOR_NS
+                str     r0, [r1, #0]
+                ldr     r1, [r0, #0]    /* MSP from vectors table.*/
+                msr     MSP_NS, r1
+                ldr     r2, [r0, #4]    /* PC from vectors table.*/
+                bxns    r2
+#endif
+
 #endif /* !defined(__DOXYGEN__) */
 
 /** @} */
diff --git a/os/hal/ports/common/ARMCMx/sau.c b/os/hal/ports/common/ARMCMx/sau.c
index 7bc394113..a4fa09425 100644
--- a/os/hal/ports/common/ARMCMx/sau.c
+++ b/os/hal/ports/common/ARMCMx/sau.c
@@ -66,12 +66,17 @@ void sauDisable(void) {
 
 /**
  * @brief   Enables a SAU region.
+ * @note    When SAU is enabled then the whole memory is marked as secure,
+ *          using this function you can scale it down to "non-Secure Callable"
+ *          or "non-Secure" but you have to consider also the IDAU security
+ *          level, you cannot set a level less secure than the one specified
+ *          in IDAU.
  *
  * @param[in] region    the region number
  * @param[in] start     the region start address
  * @param[in] end       the region end address
  * @param[in] flags     regions mode, note, this is tricky, read carefully
- *                      the ARM documentation
+ *                      the ARM documentation and the note above
  */
 void sauEnableRegion(uint32_t region, uint32_t start,
                      uint32_t end, uint32_t flags) {