diff --git a/include/arch/aarch64/arch.h b/include/arch/aarch64/arch.h
index e48e201852ed8a3eef962d05b1f7cbb9d0ce773e..1fcd0f9ba5c87847b66ed2eb86f44e9ed99ec61f 100644
--- a/include/arch/aarch64/arch.h
+++ b/include/arch/aarch64/arch.h
@@ -141,7 +141,7 @@
 #define ID_AA64PFR0_SVE_SHIFT	U(32)
 #define ID_AA64PFR0_SVE_MASK	ULL(0xf)
 #define ID_AA64PFR0_SEL2_SHIFT	U(36)
-#define ID_AA64PFR0_SEL2_MASK	U(0xf)
+#define ID_AA64PFR0_SEL2_MASK	ULL(0xf)
 #define ID_AA64PFR0_MPAM_SHIFT	U(40)
 #define ID_AA64PFR0_MPAM_MASK	ULL(0xf)
 #define ID_AA64PFR0_DIT_SHIFT	U(48)
diff --git a/lib/el3_runtime/aarch64/context_mgmt.c b/lib/el3_runtime/aarch64/context_mgmt.c
index 752a2606ea8e4321672826a263cd75428dbd42c0..b7908adec40a5ccdf816b235343ff57d41ddf30a 100644
--- a/lib/el3_runtime/aarch64/context_mgmt.c
+++ b/lib/el3_runtime/aarch64/context_mgmt.c
@@ -182,8 +182,14 @@ void cm_setup_context(cpu_context_t *ctx, const entry_point_info_t *ep)
 	}
 
 	/* Enable S-EL2 if the next EL is EL2 and security state is secure */
-	if ((security_state == SECURE) && (GET_EL(ep->spsr) == MODE_EL2))
+	if ((security_state == SECURE) && (GET_EL(ep->spsr) == MODE_EL2)) {
+		if (GET_RW(ep->spsr) != MODE_RW_64) {
+			ERROR("S-EL2 can not be used in AArch32.");
+			panic();
+		}
+
 		scr_el3 |= SCR_EEL2_BIT;
+	}
 
 	/*
 	 * Initialise SCTLR_EL1 to the reset value corresponding to the target