U-Boot on SPI flash - discussion

[pfeerick]

 - Stage 1 code to select U-Boot image, that has recovery by looking at a special SD card
 - data to select image 1 or 2
 - U-Boot image 1
 - U-Boot image 2

Sounds very similar to the solution used on the ESP8266 and other SPI flash based MCUs. They have a bootloader (eboot IIRC) for over the air (wireless) flashing, and a dual slot system. one slot for the current firmware image, and one for the next or last, as the case may be. When a new image is written (to the non-running slot), at the end of the update, if the write was successful, swapping of the slots is scheduled, and the unit is reset. The bootloader, in looking for commands at boot up, sees that scheduled update, and marks the new slot as active, and then passes control over. If the update failed for some reason, the last working image is still present, and the slot isn't changed, so no harm done. Rinse, repeat. This model works quite well there, and has been well tested, so no reason the same wouldn't work here.