"Also note that writing to the BSB and BLJB are done by setting up registers and doing an LCALL 0FFF0H. I don't know where the 0F800H addresss came from."

For the AT89C51RD2 0xf800 is the entry point for the bootloader. At least it is according to the 'sample' code on Atmel's site, I don't recall seeing it actually documented anywhere. 0xfff0 is the common entry point for the "IAP API", in other words the functions that you can call from your application. You have to load some specific values into registers to indicate which function you are calling.

I am not familiar with other Atmel derivatives which fit into your description "AT89C51Rx2". Which one are you using?