The processor can change from Secure to Non-secure state for the following reasons:

When the state change is because of an exception return, the PTM generates a branch address packet that indicates the security state change. If you have enabled Context ID tracing the PTM generates a Context ID packet, if required, immediately after the branch address packet.

ARM recommends that you do not use the other mechanisms to change security state, and if one of these mechanisms causes the state change, the ARM architecture does not guarantee the exact point of the security state change. The state change might not take effect until the next time the processor executes an ISB or exception return instruction or takes an exception and therefore the PTM does not trace the state change immediately. This means that the security state change is not marked in the trace output when it occurs, but only at the next branch address packet generated by the PTM. After a security state update, the PTM always generates a branch address packet for a taken direct branch, and therefore the state change is reported at the first of:

In the unusual case that the next waypoint after the security state change is a not-taken branch, the PTM generates an N atom, and does not report the state change until the next taken branch or exception. If the next waypoint after the security state change is an exception that returns the processor to Secure state the PTM does not indicate the entry to Non-secure state in the trace output stream.