4 ms·

This is the common (and correct) solution. In this scenario, the biggest problem is updating the bootloader, which cannot do this type of fallback. Generally

• striking 9y ago
  Right. It's important that you leave as little logic in your bootloader as possible.
• com2kid 9y ago
  Have two bootloaders, one is trivially provable and can always be relied on in case the entire world falls apart, and can never be updated. The second one is updatable if needs be.
• sliverstorm 9y ago
  Of course, the good thing about the bootloader is it is less likely to need updates in the first place, and it's also likely easier to verify an update with a high level of confidence, as its functionality is so tightly bounded.