Well, my alternate startup idea works fine on the K8. Except ... looks like flash rom addressing is not enabled by default for anything but the 0xffff0000 segment, which means while my idea works, it's useless: if I jump to the 0xfffe0000 segment, I'll be reading air, not the flash part.
Darn it. I kind of wish that we could get the chipmakers to default to full addressing in the high part of the address space, i.e. when it decodes for the flash, it decodes from 0xfff00000 up, not 0xffff0000 up. Someday ...
Well, at least I have an interesting (I guess) proof-of-concept. Not sure where to take it, but I think I'll go ahead and put it aside. Sigh.
ron