Haven't tried that actually, only the regular RGH startup way. In this case my emmc driver might be pretty useful

Fixed some mistakes, tested on Jasper BB and Corona 4GB. Just thought - to read 4GB you don't need my eMMC support, the system image can be read using any latest XeLL image (via the web page)

here are my sources, will test 16 MB + 512 MB + 4 GB soon
github.com/15432/libxen...

However kernel uses DMA and fast commands like multiple read, while hardware SPI can't access the memory (and the DMA registers) so I had to use MMC single read/writes instead

I mean the kernel uses same register set as the SB's hardware SPI (used in different "NAND flashers"). But instead of NAND read/write/erase in 4GB consoles these SFCX registers implement the whole MMC command set. Until my research XeLL was capable of reading eMMC using default memory-mapped acces

It's both, kernel accesses the eMMC via the same memory mapped SPI-like interface

That is outdated information, as part of my RGH3 update I created a XeLL version with 4GB eMMC support. A bit lazy to clean up & publish sources, but can do today if you want