Which means that either kernel thumb errata workaround does not work on n900 (because IBE bit is not accessible from non-secure mode) or this workaround is incomplete. In both cases it does not make sense to have this errata workaround enabled in kernel.

BTW can you provide me some hints how to install chrooted thumb2 compiled Ubuntu, I really need something heavy and thumb2 compiled to test the errata workaround in question, along with another possible workarounds for that ARM thumb errata. As the final goal is to have stable thumb2 support on n900 (if humanly possible).