Hi Robert,
I don't have an openrex board, but I see a note on SPI is_locked freeze in the source code diffs as follows:  
     static inline int spi_flash_cmd_write_enable(struct spi_flash *flash)
 {
+#ifdef CONFIG_SPI_FLASH_SST26
+ //quick fix to  unlock Global Block-Protection of SST26
+ //this may only need to be executed once, after power up
+ //TODO: do it properly in the flash initialization process
+ spi_flash_cmd(flash->spi, CMD_WRITE_ENABLE, NULL, 0);
+ spi_flash_cmd(flash->spi, CMD_SST_ULBPR, NULL, 0);
+#endif
  return spi_flash_cmd(flash->spi, CMD_WRITE_ENABLE, NULL, 0);
 }   
| int spi_flash_cmd_erase_ops(struct spi_flash *flash, u32 offset, size_t len) | 
 | { | 
  ...
 +#ifdef CONFIG_SPI_FLASH_SST26
+ //is_locked will freeze SST26, has to be fixed
+#else
  if (flash->is_locked(flash, offset, len) > 0) {
   printf("offset 0x%x is protected and cannot be erased\n", offset);
   return -EINVAL;
  }
-
+#endif
In the spi_flash_write_enable() API, the sequence unlock followed by write_enable() sounds logical.
But there is also a write_enable() before unlock. Does this in anyway contribute to the freeze ?
Is there a reason why the write_enable() is used before unlock ?
Thanks!