Hi Sandy,

Responses in-line.

On Fri, Aug 11, 2017 at 1:38 AM, Sandy Zhang <sanzhang@celestica.com> wrote:
Hi David,

     Sorry, I have a doubt about the range outside, from the binary map, we can find the Spare 3 Region size is 0x00FFFFFF - 0xFF0000 + 1 = 0x10000, and the binary size map to this range is also 0x10000, they are equal, why outside was happened? and can you tell me how to update the binary region's range defined in the flash description?

Start (hex)    End (hex)    Length (hex)    Area Name
-----------    ---------    ------------    ---------
...
...
....
00FF0000       00FFFFFF     00010000        Spare 3 Region
01000000       01FFFFFF     01000000        BIOS Region

The Flash Region registers (BIOS_FREGn) define the boundaries of each region. I don't see where 0xa36000-0xffffff is covered:
0x54: 0x00000000 FREG0: Flash Descriptor region (0x00000000-0x00000fff) is read-write.
0x58: 0x1fff1000 FREG1: BIOS region (0x01000000-0x01ffffff) is read-write.
0x5C: 0x0a250003 FREG2: Management Engine region (0x00003000-0x00a25fff) is read-write.
0x60: 0x00020001 FREG3: Gigabit Ethernet region (0x00001000-0x00002fff) is read-write.
0x64: 0x00007fff FREG4: Platform Data region is unused.
0x68: 0x0a350a26 FREG5: unknown region (0x00a26000-0x00a35fff) is read-write.
0x6C: 0x00007fff FREG6: unknown region is unused.
0x70: 0x00007fff FREG7: unknown region is unused.
0x74: 0x00007fff FREG8: unknown region is unused.
0x78: 0x00007fff FREG9: unknown region is unused.

You might also need to set permissions for the "BIOS" master (i.e. flashrom running on the CPU) via BRWA and BRRA in the FRACC register.

 In addition, from flash log file(please see attachment "Lewisburg_W25Q256.log"), it shows:
Found Programmer flash chip "Opaque flash chip" (32768 kB, Programmer-specific) mapped at physical address 0x0000000000000000.
 but, my flash chip is "Winbond flash chip", what do you think about this? 

This is OK. Intel hardware sequencing is an "opaque" programmer interface since flashrom does not directly send NOR flash commands via a raw SPI interface. For hardware sequencing we use the FCYCLE field as our command interface to the SPI flash.