> Also, there are multiple u-boot binaries with separate environments. It could be done for redundancy or different modes. I’m not sure. This is typically done

> Also, there are multiple u-boot binaries with separate environments. It could be done for redundancy or different modes. I’m not sure. This is typically done in order to be able to safely update the u-boot bootloader, retaining the ability to boot the previous version if the upgrade fails. Also called A/B firmware update. The previous bootloader stage ("SBL" or "TZ", depending on secure boot mechanism) might check a flag in a configuration partition to see which loader should be started and whether a previous boot to that loader was attempted, and will revert back to the previously active one after an upgrade that fails to boot up, or fails to pass secure boot integrity checks. A failure could for instance happen if the power drops while writing the update to the u-boot partition. Without such a mechanism, an update failure would brick the device. Alternatives are "never update the bootloader", or "hope for the best".