Well done, Andrew. Can you send me a copy of your kernel, or at least make it available someplace, if it is too big to send via e-mail? Complete with instructions on how to attach it to the bochs simulator, please. And as usual, if you choose to send the things to me, off list as per the way the other item got to me.
The kernel doesn't matter (I am not using one... yet).
Bochs was straightforward once I read the documentation a little more thoroughly. I have a 256k ROM image, with the first 64k being the etherboot ELF image, the next 128k empty, and the last 64k being the LinuxBIOS image. 256k down from 0xf0000 is 0xc0000, so I tell bochs that my video BIOS is a 0-byte file I call "nullrom" and the system BIOS is the romimage from LinuxBIOS, installed at 0xc0000.
(Since the video BIOS is at 0xc0000, I could have also put romimage where the video bios is asked for, and put nullrom at 0x00000.)
Start up two shells, one to run Bochs in, and one to receive the serial messages. On the latter, run tty to find out the device it's using. Tell Bochs that COM1 exists, and that its device is what was specified when you ran tty. Now run something like "sleep 1000000" on the sacrificial terminal.
Start up Bochs. On my particular system (since I have to override pci_set_method()'s analysis of my PCI access methods :-) I set a breakpoint on pci_set_method() and trace through until pci_check_direct returns. For me it returns with EAX=0 since neither direct method works in bochs. I override that with a set $eax=[address of pci_direct_conf1] and continue. There will be all kinds of text on the serial console.
And that's where I'm at. elfboot() finds my ELF image at 0xc0000, likes it, so elfload() loads it and tries to run it but gets nowhere. It copies something (the ELF image?) into high memory and tries to jump there to continue but EAX ends up in low memory anyway and we don't get to actually run the ELF image. :-(
Regards, Andrew