[Android Q&A, Help & Troubleshooting] shadow#:
U-Boot can do this, I have a boot.img on a tftp server.

u-boot> help
? - alias for 'help'
addheader- add a u-boot header to an image in place
android - start android [recovery|normal] [bootmode]
askenv - get environment variables from stdin
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootvc - boot videocore with application image at address 'addr'
capri_bootvc- Load and boot VideoCore with application image at address 'addr'
clock - clock framework
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
echo - echo args to console
editenv - edit environment variable
env - environment handling commands
exit - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls - list files in a directory (default /)
false - do nothing, unsuccessfully
fastboot- fastboot- use USB Fastboot protocol

fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
free - Release memory from u-boot heap at target.
go - start application at address 'addr'
gpio - input/set/clear/toggle gpio pins
gpt - GPT Table Utilities

help - print command description/usage
hwBoardSerialSet- Set the HW serial revision
i2c - I2C sub-system
iminfo - print header information for application image
imxtract- extract a part of a multi-image
initvcmem- initialize videocore emi

itest - return true/false on integer compare
jtag_boot- start zImage that is loaded at jtag_kern_base+0x8000
key - Check if a key is pressed.

little_mode- Check if we are in little Capri mode.
loadb - load binary file over serial line (kermit mode)
loadimg - Load Broadcom vc firmware, kernel. DT blob or cp images
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
malloc - Allocate memory from u-boot heap and store pointer in environemnt variable.
math - Environment variable math.
md - memory display
mdc - memory display cyclic
memstr_cmp- Memory to String Comparison

mipi - mipi driver for tc3587xx
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - display MMC info
mtest - simple RAM read/write test
mw - memory write (fill)
mwc - memory write cyclic
nm - memory modify (constant address)
printenv- print environment variables
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
saves - save S-Record file over serial line
serialno- display or set a serial number to be used as the fastboot and adb identity
setMac - Set the MAC address
set_watchdog- Turn on/off watch dog timer
setenv - set environment variables
showHwDesc- Display data in the hwDesc partition
showvar - print local hushshell variables
sleep - delay execution for some time
source - run script from memory
spm - show/usec spm metrics
test - minimal test like /bin/sh
testenv - test if an environment variable exists
true - do nothing, successfully
vc - VideoCore sub system
version - print monitor, compiler and linker version
writesparsed- trigger an expansion of a sparse image from ram into eMMC

Tried recovery which did not work.

Tried fastboot but the resulting USB device is detected as invalid in Windows.

u-boot> fastboot
Adding: gpt, offset 0x00000000, size 0x0000000000010000, flags 0x00000000
Adding: fbi, offset 0x00000100, size 0x0000000000020000, flags 0x00000000
Adding: custom-cert, offset 0x00000200, size 0x0000000000010000, flags 0x00000000
Adding: boot-parm, offset 0x00000280, size 0x0000000000010000, flags 0x00000000
Adding: loader, offset 0x00000300, size 0x0000000000020000, flags 0x00000000
Adding: u-boot, offset 0x00011000, size 0x0000000000100000, flags 0x00000000
Adding: dt-blob, offset 0x00011800, size 0x0000000000040000, flags 0x00000000
Adding: u-boot-env, offset 0x00011a00, size 0x0000000000001000, flags 0x00000000
Adding: mobicore, offset 0x00011a08, size 0x0000000000080000, flags 0x00000000
Adding: vc-firmware, offset 0x00018000, size 0x0000000000800000, flags 0x00000000
Adding: boot, offset 0x0001c000, size 0x0000000000800000, flags 0x00000000
Adding: boot2, offset 0x00020000, size 0x0000000000800000, flags 0x00000000
Adding: system, offset 0x00024000, size 0x0000000030920000, flags 0x00000000
Adding: system2, offset 0x001a8900, size 0x0000000030920000, flags 0x00000000
Adding: plcm_cfg, offset 0x0032d200, size 0x0000000000200000, flags 0x00000000
Adding: u-boot2, offset 0x0032e200, size 0x0000000000100000, flags 0x00000000
Adding: vc-recovery, offset 0x0032ea00, size 0x0000000000800000, flags 0x00000000
Adding: kpanic, offset 0x00332a00, size 0x0000000001700000, flags 0x00000000
Adding: recovery, offset 0x0033e200, size 0x0000000001000000, flags 0x00000000
Adding: misc, offset 0x00346200, size 0x0000000000800000, flags 0x00000000
Adding: cache, offset 0x0034a200, size 0x00000000407c0000, flags 0x00000000
Adding: userdata, offset 0x0054e000, size 0x000000003cc00000, flags 0x00000000

Unfortunately I have no clue what to do now.

Any way to have U-Boot load an image from the server?