As of r3819, this works now. I still need to make it ignore the environment (which it fetches from NAND, and which may contain nasty surprises), but that's less urgent.
However, there's one subtle detail that's quite interesting: we can check the boot mode (i.e., whether NOR or NAND) by reading the OM[1:0] bits through the BWSCON register. As it turns out, BWSCON reflects the _current_ status of OM[1:0], i.e., after doing a "reset halt" in OpenOCD while holding down AUX, and then releasing AUX (after all, it's kinda inconvenient to type when one hand it busy with the GTA02), BWSCON will happily read all zero. Even better, this also changes whether we see Steppingstone (followed by zeroes) or NOR at address 0. u-boot copies itself away quickly enough (and, in fact, we could just jump to the permanently visible copy of the NOR at 0x18000000 if we're in a great hurry), so this doesn't cause any real issues. But it surely made debugging this little feature a lot more exciting than I expected ... :) - Werner
