Permission fault, level 2 on MMU enable

Hi ARM folks, hoping someone can show me where I'm going wrong programming the MMU. The ESR_EL1 reports that it is a Permission fault, level 2. Here's what I'm trying to accomplish:

4GiB space, 4kiB granule flat identity mapped, divided like this:

0->1GiB: normal RAM (only 1G of RAM on this machine)

1->4GiB: device memory

And the normal RAM segment is to be divided into 512 x 2MB pages in a L2 table. My configuration is below. Any tips on what I'm doing wrong or how to debug is greatly appreciated!

PE State

-------------

EL1H

Registers

-------------

ESR_EL1 = 0x8600000E -> MMU fault, Permission fault, level 2

SCTLR_EL1 = 0xC00801 -> just RESVD1 bits and MMU enable bit set

TTBR0_EL1 = 0x8E000 -> base address 0 for translation tables

TTBR1_EL1 = 0x8E000 -> base address 1 for translation tables

TCR_EL1 = 0x35203520 -> 4GiB space, 4kiB granule inner shareable normal inner/outer cacheable for both TTBR0 and TTBR1

MAIR_EL1 = 0xffffffffff440400 -> ATTR0=device ATTR1=device ATTR2=normal non-cacheable ATTR3-ATTR7=normal cacheable

1st Level Table @ 0x8E000 (dumped with GDB)

--------------

0x8e000: 0x8f003 -> table pointer to next level table, table is 512 x 2MiB entries

0x8e008: 0x40000741 -> 1GiB device mem @ 0x40000000

0x8e010: 0x80000741 -> 1GiB device mem @ 0x80000000

0x8e018: 0xc0000741 -> 1GiB device mem @ 0xC0000000

1st Level Table @ 0x8F000 (dumped with GDB, truncated)

--------------

0x8f000: 0x74d

0x8f008: 0x20074d

0x8f010: 0x40074d

0x8f018: 0x60074d

0x8f020: 0x80074d

0x8f028: 0xa0074d

0x8f030: 0xc0074d

0x8f038: 0xe0074d

0x8f040: 0x100074d

... truncated ...

Adapted from: http://infocenter.arm.com/help/topic/com.arm.doc.dai0527a/DAI0527A_baremetal_boot_code_for_ARMv8_A_processors.pdf

Using openocd's virt2phys function I can see that my mappings are working as expected for normal and device mem, and thay unmapped areas fail at stage 1 as expected:

> virt2phys 0x82c30

Outer shareable, Not Secure

Normal Memory

Physical address 0x00082c30

> virt2phys 0x41000000

Outer shareable, Not Secure

Device Memory

Physical address 0x41000000

> virt2phys 0x81000000

Outer shareable, Not Secure

Device Memory

Physical address 0x81000000

> virt2phys 0xC0000000

Outer shareable, Not Secure

Device Memory

Physical address 0xc0000000

> virt2phys 0xC0000001

Outer shareable, Not Secure

Device Memory

Physical address 0xc0000001

> virt2phys 0x1F0000000

Address translation failed at stage 1, FST=4, PTW=0