Flash Region 1 (BIOS): 00400000 - 00ffffff
Flash Region 8 (EC): 07fff000 - 00000fff (unused)
Looking at the contents of flash.bin then the EC firmware is located at
offset 0x400000 which would appear to put it at the start of the IFD
Yep, the EC firmware is at the beginning of the BIOS partition then,
which isn't too unusual. Some of the first bytes of the flash within the
IFD section are likely some sort of pointer or jump to the beginning of
the EC firmware; sometimes the pointer case it's not an offset in bytes,
but in 256 or 4096 bytes. There might also be some sort of magic bytes
or checksum in the first few bytes so that the EC can detect if the
flash probably contains a valid firmware image for the EC, so it doesn't
just load random bytes when the flash doesn't contain the EC firmware.
Looks like the example of the mandolin board is going
to be the one to follow.
You probably want to take the x210's fmd file as a starting point
though, since that one is for an Intel system and leaves space for the
IFD/ME/GBE partition; you'll probably need to adjust the sizes and
offsets. The Makefile part is a bit clearer on the Mandolin board, but
it does basically the same as the x210's EC driver.