... private buffer ... secret bytes ...
Nothing secretive there. If it looks like a line frame buffer, and if it functions like a line frame buffer, and if it sits where you expect a line frame buffer, then it is most likely a linear buffer buffer. In the future I will call it LFB.
To get the LFB address on the GMA950, you can use this code:
mov di, 0018h ;Offset for GMADR
mov bx, 0010h ;[15-8] Bus=0, [7-3] Device=2, [2-0] Function=0
mov ax, B10Ah ;Read PCI dword
int 1Ah
and ecx, F0000000h ; --> ECX is linear address of the LFB
In 16-color graphics modes, the LFB is organized as follows:
--------------------------------- 1st byte of bit-plane 0
| ----------------------------- 1st byte of bit-plane 1
| | ------------------------- 1st byte of bit-plane 2
| | | --------------------- 1st byte of bit-plane 3
| | | | ----------------- 2nd byte of bit-plane 0
| | | | | ------------- 2nd byte of bit-plane 1
| | | | | | --------- 2nd byte of bit-plane 2
| | | | | | | ----- 2nd byte of bit-plane 3
| | | | | | | |
00h,00h,00h,00h,00h,00h,00h,00h
(a) (b) (c) (d) (e) (f) (g) (h)
, (c) (g) 2, . - 2 !
, Intel (e) (f), Odd/Even?
, - , :