bootloader never boots to user2.bin after OTA

[strnk]

I am using a 128Mb / 16MB SPI flash, and cannot make the bootloader to boot to the second OTA partition.

The first boot after flashing the bootloader (v1.7) @ 0x0000, user1.bin @ 0x1000 and a blank system parameters @ 0xffd000 gives me this output:

ets Jan  8 2013,rst cause:2, boot mode:(3,7)

load 0x40100000, len 2592, room 16
tail 0
chksum 0xf3
load 0x3ffe8000, len 764, room 8
tail 4
chksum 0x92
load 0x3ffe82fc, len 676, room 4
tail 0
chksum 0x22
csum 0x22

2nd boot version : 1.7(5d6f877)
SPI Speed : 40MHz
SPI Mode : DIO
SPI Flash Size & Map: 128Mbit(1024KB+1024KB)
jump to run user1 @ 1000

V2
Mo
,▒rf cal sector: 4091
freq trace enable 0
rf[112] : 00

Afterwards, I have a custom code which flashes user2.bin @ 0x101000, and boils down to:

system_upgrade_flag_set(UPGRADE_FLAG_START);
spi_flash_erase_sector(...);
spi_flash_write(...);
system_upgrade_flag_set(UPGRADE_FLAG_FINISH);
system_upgrade_reboot();

The system reboots, system_get_userbin_addr() tells me that I booted from 0x101000, and system_upgrade_userbin_check() tells me I am on the OTA 2 slot. BUT it is really running the OTA 1 slot from 0x1000 :

• If I start flashing @0x1000 (like if I want to update the OTA 1 slot now that I'm booting OTA 2), the system crashes (software wdt timeout), as if I was overwriting the current OTA slot
• when I try slightly different firmwares, I get the output from the firmware that was originally flashed using esptool on slot OTA1, not the output I should get after custom-flashing the OTA 2 slot.

This is the output I get after doing the system_upgrade_reboot():

reboot to use2
state: 5 -> 0 (0)
rm 0
del if0
bcn 0
del if1
usl
WiFi station: disconnected from *** (48:a9:***), reason=8
--- (gibberish -- I set my baudrate to 78400 but I still can't get this part)
rf cal sector: 4091
freq trace enable 0
rf[112] : 00

Would anyone have a clue on what I'm doing wrong ? Thanks.

NB:

• I tried to use the system_upgrade() calls but it failed to boot anytime I flashed something
• SPI_FLASH_SIZE_MAP is set to 9 (for the 16MB flash)
• the partition table I register in user_preinit seems ok (SYSTEM_PARTITION_OTA_2 is set @ 0x101000)
• I'm using the latest 3.0.6-dev non-OS SDK
• If I read back @ 0x101000 with esptool, it's identical to my user2.bin
• Resetting the system parameters by erasing the flash @ 0xffd000 / length 0x3000 stills boots the original user1.bin, but system_get_userbin_addr() and system_upgrade_userbin_check() now show the OTA 1 slot values.