Using JTAG to trace the problem, I found that the code aborts at 0x820009e4, after eventually running a bunch of code in the 0xc0000000 area of memory. The DM3730 TRM shows this region as reserved, so I am a bit confused as to what could be there. Any suggestions on how to debug this?
Addresses relative to 0x82000000
9b0: e320f000 nop {0}
9b4: e320f000 nop {0}
9b8: e320f000 nop {0}
9bc: e320f000 nop {0}
9c0: eafffffe b 9c0 <_binary_zImage_start+0x9c0>
9c4: eafffffe b 9c4 <_binary_zImage_start+0x9c4>
9c8: eafffffe b 9c8 <_binary_zImage_start+0x9c8>
9cc: eafffffe b 9cc <_binary_zImage_start+0x9cc>
9d0: eafffffe b 9d0 <_binary_zImage_start+0x9d0>
9d4: ea000001 b 9e0 <_binary_zImage_start+0x9e0>
9d8: eafffffe b 9d8 <_binary_zImage_start+0x9d8>
9dc: eafffffe b 9dc <_binary_zImage_start+0x9dc>
9e0: e3a00000 mov r0, #0
9e4: e1a0f004 mov pc, r4 jumps to 80008000, eventually gets to 8000805C, then 80101878, then 800080B8
then 80008078 branches to 8012028C, then 8011f6a4, then 8011f69c, then C149728C
Regs after crash, the link register shows C0D6F77C:
PC: (R15) = FFFF000C, CPSR = A00001D7 (ABORT mode, ARM FIQ dis. IRQ dis.)
Current:
R0 =D2FFB254, R1 =00005B4C, R2 =0001420C, R3 =00014254
R4 =D2FFB254, R5 =CFFE7000, R6 =00005B3C, R7 =0000000B
R8 =FFFF0014, R9 =FFFF0014, R10=00000000, R11=C127A4E8, R12=CFFECB84
R13=C1601DFC, R14=C1601E00, SPSR=C176218C
USR: R8 =00000000, R9 =C127A4E8, R10=CFFECB84, R11=C1601DFC, R12=C1601E00
R13=00000000, R14=00000000
FIQ: R8 =756FDFF6, R9 =6FFFF5F6, R10=F57DEBFF, R11=7FE73FFF, R12=78C3DFF7
R13=C17621A4, R14=C17621A4, SPSR=00000000
IRQ: R13=C1762180, R14=C1762180, SPSR=80000173
SVC: R13=C1601DF0, R14=C0D6F77C, SPSR=600001D3
ABT: R13=C176218C, R14=FFFF0010, SPSR=A00001D7
UND: R13=C1762198, R14=C1762198, SPSR=00000000