Context protection when calling a secure function(NSC) in a non-secure interrupt function

I want to know where the context was saved when a secure function was called in a non-secure interrupt function.

As shown in the figure, when a secure NSC function is called in a non-secure SVC interrupt service function,

the PUSH {R4-R6, LR} operation is executed. At this time, CONTROL_S==0x03, that is, the Thread/PSP state.

But the PSP_S=0X00000000, I want to know where the {R4-R6, LR}  registers are pushed into?  

By the way: the result of the program is normal.

Thank you!