Was thinking about it some more on the way back from choir.
Assuming that flashing the uboot and the uboot env variables went OK (e.g. no error), then the scripting in the new uboot env variables, does a scan of disks looking for what its after. I'll grab a copy and print here. Anyway if this is the case, you should be able to write a full file system to a USB disk - and the uboot, should boot that. That makes it far easier than popping the HDD every time.
$this->bbcode_second_pass_code('', 'startboot=usb start; ide reset; for devtype in usb ide; do  setenv devnum 0; while ${devtype} dev ${devnum}; do  echo ${devtype} found on device ${devnum}; setenv bootpart ${devnum}:1; echo Checking for: ${bootdir}/uEnv.txt ...; if test -e ${devtype} ${bootpart} ${bootdir}/uEnv.txt; then  load ${devtype} ${bootpart} ${loadaddr} ${bootdir}/uEnv.txt; env import -t ${loadaddr} ${filesize}; echo Loaded environment from ${bootdir}/uEnv.txt; echo Checking if uenvcmd is set ...; if test -n ${uenvcmd}; then  echo Running uenvcmd ...; run uenvcmd; fi; fi; if run loadimage; then if env exists root; then echo root has been defined by user; else part uuid ${devtype} ${bootpart} uuid; setenv root PARTUUID=${uuid}; fi;  run mainargs; if run loadfdt; then  if run loadrd; then  bootz ${loadaddr} ${rdaddr}:${filesize} ${fdtaddr}; else  bootz ${loadaddr} - ${fdtaddr}; fi; else  if run loadrd; then echo Booting uImage with initrd;  bootm ${loadaddr} ${rdaddr}:${filesize}; else  bootm ${loadaddr}; fi; fi; else  echo No kernel found; fi; setexpr devnum ${devnum} + 1; done; done;')
So lets unwrap that:
$this->bbcode_second_pass_code('', '
usb start; 
ide reset; 
for devtype in usb ide; do  
   setenv devnum 0; 
   while ${devtype} dev ${devnum}; do  
      echo ${devtype} found on device ${devnum}; 
      setenv bootpart ${devnum}:1; 
      echo Checking for: ${bootdir}/uEnv.txt ...; 
      if test -e ${devtype} ${bootpart} ${bootdir}/uEnv.txt; then  
           load ${devtype} ${bootpart} ${loadaddr} ${bootdir}/uEnv.txt; 
           env import -t ${loadaddr} ${filesize}; 
           echo Loaded environment from ${bootdir}/uEnv.txt; 
           echo Checking if uenvcmd is set ...; 
           if test -n ${uenvcmd}; then  
              echo Running uenvcmd ...; 
              run uenvcmd; 
           fi; 
      fi; 
      if run loadimage; then 
         if env exists root; then 
            echo root has been defined by user; 
         else 
            part uuid ${devtype} ${bootpart} uuid; 
            setenv root PARTUUID=${uuid}; 
         fi;  
         run mainargs; 
         if run loadfdt; then  
             if run loadrd; then  
                bootz ${loadaddr} ${rdaddr}:${filesize} ${fdtaddr}; 
             else  
                bootz ${loadaddr} - ${fdtaddr}; 
             fi; 
        else  
           if run loadrd; then 
               echo Booting uImage with initrd;  
               bootm ${loadaddr} ${rdaddr}:${filesize}; 
          else  
               bootm ${loadaddr}; 
          fi; 
        fi; 
      else  
          echo No kernel found; 
      fi; 
      setexpr devnum ${devnum} + 1; 
   done; 
done;
')
So you can see it scanning through the disks, looking for /boot/uEnv.txt - and when it finds that updates the env variables. So that gives a way in - but should work on a usb stick. You'll need to know some of the other commands called:
$this->bbcode_second_pass_code('', 'loadfdt=echo loading ${fdtdir}/${fdtfile} ...; load ${devtype} ${bootpart} ${fdtaddr} ${fdtdir}/${fdtfile}')
$this->bbcode_second_pass_code('', 'loadimage=load ${devtype} ${bootpart} ${loadaddr} ${bootdir}/${bootfilez} || load ${devtype} ${bootpart} ${loadaddr} ${bootdir}/${bootfilem}')
$this->bbcode_second_pass_code('', 'loadrd=load ${devtype} ${bootpart} ${rdaddr} ${bootdir}/${rdfile}')
$this->bbcode_second_pass_code('', 'mainargs=setenv bootargs console=${console} ${mtdparts} root=${root} rw rootwait ${optargs} ${ncargs}')
So you can see it loading the image also from ${devtype} - so again that can be on the USB stick.
Whats relevent is:
$this->bbcode_second_pass_code('', 'bootdir=/boot')
So everything boot related must be in a the /boot directory on the relevent partition.
Does this give you enough to try? Let me know if you need more, and I can grab the settings off my NSA325.
Hope this helps,
David.
P.S. Oh yes - reason I know all this - is becuase I did exactly what you did, though I'd bricked my machine - but did manage to get it back to life (and without using a uart). So there is hope.
P.P.S. Does make me feel a bit bad though, that I never completed the code in the script to get the boot partuuid set correctly. I'll work on that now.
			
		