Update code over Ethernet?
A bootloader to network-boot might be too large to leave enough code space for your application. Your second suggestion sounds more workable - to collect &amp; verify the entire new image in secondary storage first, then call a storage-to-flash boot loader. You really don't want to start loading an image that then suffers damage in transit, or to have the link go down mid-download. The likely only way out of that is a site-visit. Saving first lets you confirm the integrity of the new image before you start over-writing any of the old one.