Calypso differences between C139 and C156?

Hello fellow hackers, In process of getting FreeCalypso loadtools (primarily the flash manipulation utility fc-loadtool) working on the C1xx family in addition to the previously supported Openmoko and Pirelli targets, I discovered one bit of strangeness for which I have no explanation, and I wonder if anyone else has seen it or might have an explanation for it. According to Calypso chip documentation (gathered on the GSM mini- Wikileaks site ftp.ifctf.org:/pub/GSM), the complete nCS0 flash bank should always be accessible at address 0x03000000, regardless of whether the physical nIBOOT input is low or high, and regardless of what may have been written into the FFFF:FB10 register to enable or disable the mapping of the boot ROM at address 0. And indeed I have always used this nCS0 mapping at 0x03000000 on Openmoko and Pirelli targets, and have got used to it always working. But when I started playing with Compal phones a few months ago, I discovered that at least on the North American (1900+850 MHz) C139s reading from 0x03000000 returns all 0xFF's instead of the flash content, no matter what the FFFF:FB10 register is set to. So I figured it must be some difference between the full Calypso in the Openmoko & Pirelli phones and the Calypso Lite in C1xx, or perhaps that mapping at 0x03000000 only works when the physical nIBOOT input is low. Then last night I dusted off my North American C156 (this C156 and a bunch of NA C139s are the only Compal phones I have, as the more "mainstream" 900+1800 MHz models aren't of much use to me, given my geographic location) and tried my tools on it, as I'm polishing them up for a stable release. And guess what: reading from 0x03000000 yields the flash content on this phone, not the 0xFF's I get on all of the C139s I've tested! But don't all C1xx phones use the same Calypso Lite chip? And this C156 surely has nIBOOT tied high just like the other C1xx: the small sector at 0x2000 is all 0xFF's (blank), so if the boot ROM were enabled, the phone would never boot. (The boot ROM requires the 32-bit word at 0x2000 to be either 0 or 1, selecting different modes of booting the main fw.) Just wondering if anyone else has seen this strangeness, and what the behaviour might be on other C1xx phones besides those I have... Oh, and all of the work I've done for Compal target support in FreeCalypso loadtools is in the public Hg repository: https://bitbucket.org/falconian/freecalypso-sw VLR, SF P.S. Is Christophe Devine still on this list? Christophe, if you are reading this: I sent unicast email to your gmail address last night, but it bounced. Are you still around?