Just came back to this thread wondering if anything new had occured.

For the record, I'm still occasionally messing around with legitly/legally reverse-engineering the booting process. My reasoning is this: if I use a modified preinit plus a console to get command-line access at the earliest moment possible, and then I figure out how to boot all the way from there, referring only to the open source parts of Maemo 5 for reference/guidance, then the results are proper, legally-clean, reverse engineering.

Needless to say, given that I'm a complete coding newb (and for booting-level stuff, linux newb too), unlike most Maemo devs, I suspect progress will be painfully slow. For instance, someone who knows what they're doing would already know how to mount the eMMC from where my old preinit mod (with the boot shell as early as I thought reasonable) gives you the shell. However, I am still just figuring out mknod properly. So don't expect real results on this front any time soon.