Just want to confirm that I found the place of crash:

cpus[id].construct(id, _global_work_list); , just as I thought from
start. I changed exception return to B .
>From that I could narrow it down.

Thanks for reading!

To be sure that uboot isn't the problem I tried with the same version you use on I.mx8m. It doesn't support my board so I only tried with top layer , u-boot.itb . It boots to exception. Iam thinking if the offending call is the first one which allocates ram dynamically. That would point to permission problem and or problem with the defined system ram. Bootm takes the el to el2.

To be continued..

Michael