Question about Cortex-M exceptions and ES bit value

[Igor Kotrasinski/Security (PLT) /SRPOL/Engineer/Samsung Electronics]

Hi,

I'm playing around with hacking in support for a custom Cortex-M board, 
and I noticed something strange in exception entry code. The 
av7m_exception_taken function has a bit like this:

 > if (arm_feature(env, ARM_FEATURE_V8)) {
 >     ...
 >     lr &= ~R_V7M_EXCRET_ES_MASK;
 >     if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) {
 >         lr |= R_V7M_EXCRET_ES_MASK;
 >     }
 > }

Meaning that, if Cortex-M security extensions are NOT present, the ES 
bit is set. However, in the reference manual for Armv8-M the roughly 
equivalent ExceptionTaken() function does something like this:

 > assert(HaveSecurityExt() || !excIsSecure);
 > ...
 > if excIsSecure then
 >     LR<2> = CONTROL_S.SPSEL;
 >     LR<0> = '1';
 > else
 >     LR<2> = CONTROL_NS.SPSEL;
 >     LR<0> = '0';

That looks to me like the ES bit (LR<0>) should NOT be set if security 
extensions are NOT present. Am I correct, is it a bug?

Thanks,
Igor