[lolita]

Inspecting the schematics and datasheets for the 7515, it seems that CE5 is the same pin as what would be GPO A3, so it is likely a multifunction pin. Try setting bit 3 of EE (GPO A port) to see if CE5 does enable. If it does, then the pin is not in CE mode but in GPO mode.

Good job finding the RESET and CD, that will make it much easier to get a working firmware on your device. Now if my guesses are correct, we only need to figure out how to get CE5 into CE mode.

Which CE gets activated when you write 28 to port 2? Only one can be active at a time, and if all the external ones are disabled then CE0 is enabled, which only selects the internal boot ROM.