Damaged u-boot on Linkit Smart 7688 duo (MPU, not MCU)


I have damaged u-boot on MT7688 chip on Linkit Smart duo, and now looking for some advice on how to restore it. After some research I found three options:

  1. Desolder metal shield, and write directly to SPI FLASH IC using some programmer like ch431a. Theoretically I can do this without desoldering the FLASH IC itself, just hold MT7688 in reset, right? Pretty straightforward, but I’m afraid to damage the board.

  2. JTAG. I have J-Link Debug Probe but It’s my first time with Mediatek chips ever, may be not that straightforward.

  3. Use SPI Slave Programming (https://labs.mediatek.com/en/download/UEE7Hv5D) Which seamed the easiest way, but I have not succeeded.

I still have Atmega MCU and Arduino bootloader on it, so I tried the 3d variant and implemented described protocol on Arduino to access AHB bus. But it simply does not work as described. Later I noticed that MOSI and MISO pins are twisted between MCU and MPU:
MDI_TN_P1 - CLK - PB1 - SCLK - S2
MDI_RN_P1 - MOSI - PB3 - MISO - S0
MDI_TP_P1 - CS - PB0 - SS - S3
MDI_RP_P1 - MISO - PB2 - MOSI - S1
I believe it is made for AVR ISP programming to work.
So I took an external Arduino board connected MOSI-MOSI and MISO-MISO, then held MCU and MPU in reset - no result.
Looks like SPI Slave AHB bus simply does not work, it does not behave like SPI at all: whatever level I put on MOSI - pops out on MISO immediately, that’s not right.

Here is arduino sketch I used, just in case:

I can compile u-boot but I don’t understand what is the correct way to burn it into FLASH.
Any suggestions or explanations will be helpful, Thanks!

The u-boot is only there to boot OS, it is not recommended to modify it.

Yes, u-boot boots OS, and in my case it is damaged, it does not work anymore, so I have no other option but to reprogram it.