I have looked at sharing the stack with coreboot/vsa, but it really gets messy.
Also, there is the still unexplained zero'ing of memory at 0x1000. That mostly working example i sent was with coreboot text at 0x2000.
So vsa does nothing ABOVE %esp, just in the stack?
This is weird. Can you trap the fs2 on a write to 0x1000 and see if that occurs?
thanks
ron