Index: /trunk/include/VBox/VMMDevTesting.h
===================================================================
--- /trunk/include/VBox/VMMDevTesting.h	(revision 92522)
+++ /trunk/include/VBox/VMMDevTesting.h	(revision 92523)
@@ -40,7 +40,8 @@
 
 /** The base address of the MMIO range used for testing.
- * This is intentionally put at the 2nd page above 1M so that it can be
- * accessed from both real (!A20) and protected mode. */
-#define VMMDEV_TESTING_MMIO_BASE        UINT32_C(0x00101000)
+ * @remarks This used to be at 0x101000 but moved to 0xdf000 so that it would
+ *          work better with prototype NEM code.  This also means enabling A20
+ *          is not a requirement. */
+#define VMMDEV_TESTING_MMIO_BASE        UINT32_C(0x000df000)
 /** The size of the MMIO range used for testing.  */
 #define VMMDEV_TESTING_MMIO_SIZE        UINT32_C(0x00001000)
@@ -66,11 +67,10 @@
 #define VMMDEV_TESTING_MMIO_READBACK_R3     (VMMDEV_TESTING_MMIO_BASE + VMMDEV_TESTING_MMIO_OFF_READBACK_R3)
 
-/** The real mode selector to use.
- * @remarks Requires that the A20 gate is enabled. */
-#define VMMDEV_TESTING_MMIO_RM_SEL       0xffff
+/** The real mode selector to use. */
+#define VMMDEV_TESTING_MMIO_RM_SEL          0xdf00
 /** Calculate the real mode offset of a MMIO register. */
-#define VMMDEV_TESTING_MMIO_RM_OFF(val)  ((val) - 0xffff0)
+#define VMMDEV_TESTING_MMIO_RM_OFF(val)     ((val) - VMMDEV_TESTING_MMIO_BASE)
 /** Calculate the real mode offset of a MMIO register offset. */
-#define VMMDEV_TESTING_MMIO_RM_OFF2(off) ((off) + 16 + 0x1000)
+#define VMMDEV_TESTING_MMIO_RM_OFF2(off)    (off)
 
 /** The base port of the I/O range used for testing. */
Index: /trunk/include/VBox/VMMDevTesting.mac
===================================================================
--- /trunk/include/VBox/VMMDevTesting.mac	(revision 92522)
+++ /trunk/include/VBox/VMMDevTesting.mac	(revision 92523)
@@ -29,5 +29,5 @@
 %ifndef RT_WITHOUT_PRAGMA_ONCE
 %endif
-%define VMMDEV_TESTING_MMIO_BASE        0x00101000
+%define VMMDEV_TESTING_MMIO_BASE        0x000df000
 %define VMMDEV_TESTING_MMIO_SIZE        0x00001000
 %define VMMDEV_TESTING_MMIO_OFF_NOP         (0x000)
@@ -40,7 +40,7 @@
 %define VMMDEV_TESTING_MMIO_READBACK        (VMMDEV_TESTING_MMIO_BASE + VMMDEV_TESTING_MMIO_OFF_READBACK)
 %define VMMDEV_TESTING_MMIO_READBACK_R3     (VMMDEV_TESTING_MMIO_BASE + VMMDEV_TESTING_MMIO_OFF_READBACK_R3)
-%define VMMDEV_TESTING_MMIO_RM_SEL       0xffff
-%define VMMDEV_TESTING_MMIO_RM_OFF(val)  ((val) - 0xffff0)
-%define VMMDEV_TESTING_MMIO_RM_OFF2(off) ((off) + 16 + 0x1000)
+%define VMMDEV_TESTING_MMIO_RM_SEL       0xdf00
+%define VMMDEV_TESTING_MMIO_RM_OFF(val)  ((val) - VMMDEV_TESTING_MMIO_BASE)
+%define VMMDEV_TESTING_MMIO_RM_OFF2(off) (off)
 %define VMMDEV_TESTING_IOPORT_BASE      0x0510
 %define VMMDEV_TESTING_IOPORT_COUNT     0x0010
Index: /trunk/src/VBox/ValidationKit/bootsectors/bootsector2-cpu-a20-1-template.mac
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bootsector2-cpu-a20-1-template.mac	(revision 92522)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bootsector2-cpu-a20-1-template.mac	(revision 92523)
@@ -164,5 +164,5 @@
         mov     esi, 00000h
         mov     ds, ax
-        mov     ecx, 01000h             ; at 101000 there is a VMMDevTesting MMIO page.
+        mov     ecx, 01000h             ; at 101000 there was a VMMDevTesting MMIO page.
 %elifdef TMPL_16BIT
         ;; @todo need a selector we can modify.
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.c
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.c	(revision 92522)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.c	(revision 92523)
@@ -165,7 +165,7 @@
     /* Figure out which MMIO region we'll be using so we can correctly initialize FPUDS. */
 # if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
-    MmioReg.pv = BS3_FP_MAKE(0xffff, VMMDEV_TESTING_MMIO_BASE - _1M + 16);
+    MmioReg.pv = BS3_FP_MAKE(VMMDEV_TESTING_MMIO_RM_SEL, VMMDEV_TESTING_MMIO_RM_OFF2(0));
 # elif BS3_MODE_IS_16BIT_CODE(TMPL_MODE)
-    MmioReg.pv = BS3_FP_MAKE(BS3_SEL_VMMDEV_MMIO16, VMMDEV_TESTING_MMIO_BASE - _1M);
+    MmioReg.pv = BS3_FP_MAKE(BS3_SEL_VMMDEV_MMIO16, 0);
 # else
     MmioReg.pv = (uint8_t *)VMMDEV_TESTING_MMIO_BASE;
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-system-data.asm
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-system-data.asm	(revision 92522)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-system-data.asm	(revision 92523)
@@ -189,5 +189,5 @@
         dw  09f00h, 00000h
 BS3_GLOBAL_DATA Bs3Gdte_R0_MMIO16, 8            ; Entry 0f8h
-        dw  0ffffh, 00000h, 09310h, 00000h      ; 16-bit VMMDev MMIO segment with base 0100000h.
+        dw  0ffffh, 0f000h, 0930dh, 00000h      ; 16-bit VMMDev MMIO segment with base 0100000h.
 BS3GdtAssertOffset 0100h
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h	(revision 92522)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h	(revision 92523)
@@ -348,5 +348,5 @@
 #define BS3_SEL_X0TEXT16_CS         0x00e8 /**< Conforming code selector for accessing the BS3X0TEXT16 segment. Runtime config. */
 #define BS3_SEL_X1TEXT16_CS         0x00f0 /**< Conforming code selector for accessing the BS3X1TEXT16 segment. Runtime config. */
-#define BS3_SEL_VMMDEV_MMIO16       0x00f8 /**< Selector for accessing the VMMDev MMIO segment at 0100000h from 16-bit code. */
+#define BS3_SEL_VMMDEV_MMIO16       0x00f8 /**< Selector for accessing the VMMDev MMIO segment at 00df000h from 16-bit code. */
 
 /** Checks if @a uSel is in the BS3_SEL_RX_XXX range. */