Single stepping with JTAG showed that some instructions were incorrect, and these instructions started from 32-byte boundary, suspected to be L2 cache issue. After disabling L2 cache, kexec was able to boot into the zImage OK. Using armv7 version of cache functions in arch/arm/boot/compressed/head.S was able to solve this issue as well, but in turn exhibited slow decompressing speed. And Marvell kindly provided the following two patches to solve this issue completely.
Single stepping with JTAG showed that some instructions were incorrect, and these instructions started from 32-byte boundary, suspected to be L2 cache issue. After disabling L2 cache, kexec was able to boot into the zImage OK. Using armv7 version of cache functions in arch/arm/ boot/compressed /head.S was able to solve this issue as well, but in turn exhibited slow decompressing speed. And Marvell kindly provided the following two patches to solve this issue completely.