So is the 0x40000 offset for irom hardcoded in the tools to match the linker script or does the tool discover the offset when it runs?
Edit: I guess neither since you have to manually flash the bins and specify the addresses? I was thinking it was automated for some reason ( because I haven't used it yet).
The size of the irom section may be limited as necessary, for example to save room for the OTA upgrade to use part of the flash?
Flash map
0x00000000 - ? = default iram/dram image
? - 0x0007bfff = free space for irom image or other use
0x0007c000 - 0x0007dfff = default config
0x0007e000 - 0x0007ffff = config
With ota updates:
0x00000000 - 0x00000fff = boot.bin
0x00001000 - 0x00010fff = app1 iram/dram ?
0x00011000 - 0x0003bfff = app1 irom
0x0003c000 - 0x0003dfff = app1 default config ?
0x0003e000 - 0x0003efff? = master_device_key.bin (shouldn't need more than 1 sector, used for iotbucket cloud)
0x0003f000 - 0x0003ffff = free space ?
0x00040000 - 0x00040fff = boot.bin copy ? (Probably not)
0x00041000 - 0x00050fff = app2 iram/dram ?
0x00051000 - 0x0007bfff = app2 irom
0x0007c000 - 0x0007dfff = app2 default config ?
0x0007e000 - 0x0007ffff = config
So you have to compile ota updates targeting both app1 and app2, the device picks the one not currently active and flashes it. Boot.bin presumably manages selecting between them.
So:
What's in the config sections?
Where's the boot.bin source?
What happens when you go to a 16M flash device?