Here's rx1950 nand flash layout:
0x0000 - 0x1000 - First stage bootloader
0x1000 - 0x4000 - Some data, i.e. wifi mac is here
0x4000 - 0x44000 - Second stage bootloader. This block starts with 0x1000 byte header,
0x44000 - 0x-------- - WinCE image. This block starts with 0x400-byte partition table (???) followed by 0x1000 byte header (almost same as bootloader, but different addresses)
Bootloader header looks like this:
0xfe 0x03 0x00 0xea ; some magic bytes?
0x00 * 0x3c ; 0x3c zeros
0x45 0x43 0x45 0x43 ; "ECEC" - more magic bytes?
0x8c0b5dcc ; stored in little endian format, virtual address in ram where image ends
0x00035dcc ; stored in little endian format, image size
0x00 * 0xfb4 ; 0xfb4 zeros
So, bootloader will be loaded at 0x8c0b5dcc - 0x00035dcc = 0x8c080000 (virtual address)
WinCE header looks almost the same, except address is 0x8014e388 and size is 0x0014e388, so WinCE image will be loaded at 0x80000000 (virtual)
WinCE partition table is not looking interesting to me, we're not going to use WinCE-compatible FS :)
So, rx1950 will use following mtd partition table:
0x00000000-0x00004000 : "Boot0"
0x00004000-0x00044000 : "Boot1"
0x00044000-0x00344000 : "Kernel"
0x00344000-0x04000000 : "Filesystem"
If anyone interested in Boot0/Boot1/Kernel images - I can put it on tuxfamily ftp :)
P.S. I ported basic rx1950 patches to latest git kernel, and I'm going to submit it mainstream again :)