I have settled my problem.
AM335x series CPU can only allocate 512MB addr space, while OMAP35xx and DM37xx can allocate 1GB.
So a address like 28000000 cannot be accessed by am335x, even it can be configured in register.
I believe this is a bug of TI's technical reference manual, which tells "ADDR 0x00-0x3f" is valid in GPMC_CS_CONFIG7 register. Indeed, only "0x00-0x1f" is valid.