Changing the currently running user binary

[blubb]

Hi,

there are various boot modes which can be chosen by different GPIO voltage levels. Is there also a way to change the currently running user binary?

Let's assume I use OTA firmware updates. One day I accidentally upload a new version which has broken OTA support. Ooops. Now I cannot correct my mistake: The firmware has a correct checksum and it starts fine. So the bootloader will run it on every power on. What options do I have besides re-flashing the module?

It would be cool if there was a special GPIO setting to force either user1 or user2...

[Her Mary]

AFAIK, the latest boot.bin v1.7 can boot to another user.bin if the current one broke. For example, the system should run the user2.bin after OTA, but there is something wrong in the user2.bin. So when the system power on, the boot.bin will try to startup user2.bin at first, but it fails, and then the boot.bin will try to startup the original user1.bin instead.

[blubb]

Yeah, but only if the new bin does not start at all. In the example I mentioned above, this wouldn't help.

[blubb]

After writing the flash using the spi_flash_erase_sector and spi_flash_write APIs, I do

system_upgrade_flag_set(UPGRADE_FLAG_FINISH);
system_upgrade_reboot();

to finalize the OTA upgrade.

Question: Is there a way to boot the new image ONLY ONCE? So that its functionality can be verified BEFORE the change becomes permanent?

Edit:
Question 2: How does the bootloader (1.7) determine the current image is "broken"? I understand it reverts the change and goes back to the other image if something is wrong. But what must be wrong? I've seen it boot one image that caused an exception over and over and over again with no attempt to go to the other image. I had to reflash manually via UART.