So I bought an Arduino, to join the cool kids etc. That's the board on the left ...
The story goes something like this ... first, I discovered the U-Boot is ancient garbage of the 1.1.x vintage with billion hacks. OK, this is something I kinda expected and this clearly needs to be fixed.
Arduino is apparently open hardware or something, so I started looking for schematics to find JTAG. Well, turns out the schematics of the MIPS part are not really available, but there are schematics of some compatible bit. Turns out, JTAG is not routed from the CPU and I really don't feel like hotairing this horrid package. So it boils down to plan B.
Plan B is to solder patchwires onto the SPI NOR, disconnect CS from the CPU, route the SPI NOR signals through an FPGA and ultimately write SPI NOR emulator for the FPGA This is extra convenient, since I can just push new testing U-Boot builds into this emulator via ethernet. But since I didn't feel like breaking some cute FPGA, I dug out MCVEVK prototype. The upside of this MCV prototype is also that it has Cyclone V C6, which has some 5 Mib of block RAM in the FPGA. That's enough to store 256kiB big U-Boot image and some, convenient.
MCVEVK prototype behaved exactly like a prototype should, it was broken. So first thing I had to do was to fix it. I ported U-Boot to it, added SoCFPGA NAND support (it's posted to U-Boot ML now), since the prototype used NAND instead of eMMC. And so on, usual U-Boot porting chores to get the ARM part running, so I can use it to load the emulated SPI NOR content from ethernet via the HPS2FPGA bridge to the FPGA block RAM.
Writing the emulator was kinda trivial, by applying signaltap to the SPI NOR signals and observing how the original firmware behaves, I figured that the SPI NOR controller only ever sends on opcode and reads 256 Bytes block afterward. Moreover, it seems like at some point, the SPI NOR starts running at higher clock speed, which the FPGA does no longer appreciate, but this can be fixed by keeping the AHB clock low.
Turns out, implementing emulation of that one SPI NOR instruction is enough to get me all the way to board_init_f() in U-Boot running from the FPGA-emulated SPI NOR.