diff --git a/sys/dev/ic/ct65550.c b/sys/dev/ic/ct65550.c
index 18d5f9f4ec4b..194c70e4c4e8 100644
--- a/sys/dev/ic/ct65550.c
+++ b/sys/dev/ic/ct65550.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ct65550.c,v 1.1 2011/02/09 21:18:04 macallan Exp $	*/
+/*	$NetBSD: ct65550.c,v 1.2 2011/03/23 04:02:43 macallan Exp $	*/
 
 /*
  * Copyright (c) 2006 Michael Lorenz
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ct65550.c,v 1.1 2011/02/09 21:18:04 macallan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ct65550.c,v 1.2 2011/03/23 04:02:43 macallan Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -130,13 +130,13 @@ struct wsdisplay_accessops chipsfb_accessops = {
 static inline void
 chipsfb_write32(struct chipsfb_softc *sc, uint32_t reg, uint32_t val)
 {
-	bus_space_write_4(sc->sc_fbt, sc->sc_fbh, reg, val);
+	bus_space_write_4(sc->sc_memt, sc->sc_mmregh, reg, val);
 }
 
 static inline uint32_t
 chipsfb_read32(struct chipsfb_softc *sc, uint32_t reg)
 {
-	return bus_space_read_4(sc->sc_fbt, sc->sc_fbh, reg);
+	return bus_space_read_4(sc->sc_memt, sc->sc_mmregh, reg);
 }
 
 static inline void
@@ -203,10 +203,8 @@ chipsfb_do_attach(struct chipsfb_softc *sc)
 #ifdef CHIPSFB_DEBUG
 	printf(prop_dictionary_externalize(dict));
 #endif
-
 	chipsfb_init(sc);
 
-	/* we should read these from the chip instead of depending on OF */
 	width = height = -1;
 
 	/* detect panel size */
@@ -218,7 +216,12 @@ chipsfb_do_attach(struct chipsfb_softc *sc)
 	height |= (chipsfb_read_indexed(sc, CT_FP_INDEX, FP_VERT_OVERFLOW_1)
 	    & 0x0f) << 8;
 	height++;
-	aprint_verbose("Panel size: %d x %d\n", width, height);
+	if ((width < 640) || ( width > 1280) || (height < 480) ||
+	    (height > 1024)) {
+		/* no sane values in the panel registers */
+		width = height = -1;
+	} else
+		aprint_verbose("Panel size: %d x %d\n", width, height);
 
 	if (!prop_dictionary_get_uint32(dict, "width", &sc->width))
 		sc->width = width;
@@ -255,9 +258,6 @@ chipsfb_do_attach(struct chipsfb_softc *sc)
 		 * since we're not the console we can postpone the rest
 		 * until someone actually allocates a screen for us
 		 */
-#ifdef notyet
-		chipsfb_set_videomode(sc, &videomode_list[0]);
-#endif
 	}
 
 	rasops_unpack_attr(defattr, &fg, &bg, &ul);
@@ -269,7 +269,7 @@ chipsfb_do_attach(struct chipsfb_softc *sc)
 
 	aprint_normal_dev(sc->sc_dev, "%d MB aperture, %d MB VRAM at 0x%08x\n",
 	    (u_int)(sc->sc_fbsize >> 20),
-	    sc->memsize >> 20, (u_int)sc->sc_fb);
+	    (int)sc->memsize >> 20, (u_int)sc->sc_fb);
 #ifdef CHIPSFB_DEBUG
 	aprint_debug("fb: %08lx\n", (ulong)ri->ri_bits);
 #endif
@@ -644,7 +644,7 @@ chipsfb_feed(struct chipsfb_softc *sc, int count, uint8_t *data)
 		bork = data[i];
 		latch |= (bork << shift);
 		if (shift == 24) {
-			chipsfb_write32(sc, CT_OFF_DATA, latch);
+			chipsfb_write32(sc, CT_OFF_DATA - CT_OFF_BITBLT, latch);
 			latch = 0;
 			shift = 0;
 		} else
@@ -652,12 +652,12 @@ chipsfb_feed(struct chipsfb_softc *sc, int count, uint8_t *data)
 	}
 
 	if (shift != 0) {
-		chipsfb_write32(sc, CT_OFF_DATA, latch);
+		chipsfb_write32(sc, CT_OFF_DATA - CT_OFF_BITBLT, latch);
 	}
 
 	/* apparently the chip wants 64bit-aligned data or it won't go idle */
 	if ((count + 3) & 0x04) {
-		chipsfb_write32(sc, CT_OFF_DATA, 0);
+		chipsfb_write32(sc, CT_OFF_DATA - CT_OFF_BITBLT, 0);
 	}
 #ifdef CHIPSFB_WAIT
 	chipsfb_wait_idle(sc);
@@ -760,10 +760,13 @@ chipsfb_mmap(void *v, void *vs, off_t offset, int prot)
 	struct chipsfb_softc *sc = vd->cookie;
 	paddr_t pa;
 
+	if (sc->sc_mmap != NULL)
+		return sc->sc_mmap(v, vs, offset, prot);
+
 	/* 'regular' framebuffer mmap()ing */
 	if (offset < sc->memsize) {
-		pa = bus_space_mmap(sc->sc_fbt, offset, 0, prot,
-		    BUS_SPACE_MAP_LINEAR);
+		pa = bus_space_mmap(sc->sc_memt, offset, 0, prot,
+		    BUS_SPACE_MAP_LINEAR | BUS_SPACE_MAP_PREFETCHABLE);
 		return pa;
 	}
 
@@ -809,7 +812,7 @@ chipsfb_init_screen(void *cookie, struct vcons_screen *scr,
 	ri->ri_stride = sc->width;
 	ri->ri_flg = RI_CENTER | RI_FULLCLEAR;
 
-	ri->ri_bits = bus_space_vaddr(sc->sc_fbt, sc->sc_fbh);
+	ri->ri_bits = bus_space_vaddr(sc->sc_memt, sc->sc_fbh);
 
 #ifdef CHIPSFB_DEBUG
 	aprint_debug("addr: %08lx\n", (ulong)ri->ri_bits);
@@ -866,14 +869,14 @@ chipsfb_probe_vram(struct chipsfb_softc *sc)
 	 * if what we wrote to 0 is left untouched. Max. fb size is 4MB so
 	 * we voluntarily stop there.
 	 */
-	chipsfb_write32(sc, 0, 0xf0f0f0f0);
-	chipsfb_write32(sc, ofs, 0x0f0f0f0f);
-	while ((chipsfb_read32(sc, 0) == 0xf0f0f0f0) &&
-	    (chipsfb_read32(sc, ofs) == 0x0f0f0f0f) &&
+	bus_space_write_4(sc->sc_memt, sc->sc_fbh, 0, 0xf0f0f0f0);
+	bus_space_write_4(sc->sc_memt, sc->sc_fbh, ofs, 0x0f0f0f0f);
+	while ((bus_space_read_4(sc->sc_memt, sc->sc_fbh, 0) == 0xf0f0f0f0) &&
+	    (bus_space_read_4(sc->sc_memt, sc->sc_fbh, ofs) == 0x0f0f0f0f) &&
 	    (ofs < 0x00400000)) {
 
 		ofs += 0x00080000;
-		chipsfb_write32(sc, ofs, 0x0f0f0f0f);
+		bus_space_write_4(sc->sc_memt, sc->sc_fbh, ofs, 0x0f0f0f0f);
 	}
 
 	return ofs;
diff --git a/sys/dev/ic/ct65550reg.h b/sys/dev/ic/ct65550reg.h
index b57c6cf17f89..35d169219cda 100644
--- a/sys/dev/ic/ct65550reg.h
+++ b/sys/dev/ic/ct65550reg.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: ct65550reg.h,v 1.1 2011/02/09 21:18:04 macallan Exp $	*/
+/*	$NetBSD: ct65550reg.h,v 1.2 2011/03/23 04:02:43 macallan Exp $	*/
 
 /*
  * Copyright 2006 by Michael Lorenz.
@@ -62,15 +62,15 @@
 #define CT_OFF_BE	0x00800000
 
 /* blitter registers */
-#define CT_BLT_STRIDE	CT_OFF_BITBLT
+#define CT_BLT_STRIDE	0x00000000
 	/* 
 	 * upper 16 bit are destination stride in bytes
 	 * lower 16 bit are source stride in bytes
 	 */
 	 
-#define CT_BLT_BG	CT_OFF_BITBLT + 0x04
-#define CT_BLT_FG	CT_OFF_BITBLT + 0x08
-#define CT_BLT_EXPCTL	CT_OFF_BITBLT + 0x0c	/* expansion control */
+#define CT_BLT_BG	0x04
+#define CT_BLT_FG	0x08
+#define CT_BLT_EXPCTL	0x0c	/* expansion control */
 	#define LEFT_CLIPPING_MSK	0x0000003f
 	#define MONO_RIGHT_CLIPPING_MSK	0x00003f00
 	#define MONO_INITIAL_DISCARD	0x003f0000
@@ -82,7 +82,7 @@
 	#define MONO_SRC_ALIGN_LONGLONG	0x05000000
 	#define MONO_SELECT_ALT_FG_BG	0x08000000 /* use CT_SRC_EXP_* */
 	
-#define CT_BLT_CONTROL	CT_OFF_BITBLT + 0x10
+#define CT_BLT_CONTROL	0x10
 	#define BLT_ROP_MASK		0x000000ff
 	#define BLT_START_RIGHT		0x00000100 /* 0 for start left */
 	#define BLT_START_BOTTOM	0x00000200 /* 0 for start top */
@@ -101,18 +101,18 @@
 #define ROP_NOT_DST	0x55
 #define ROP_PAT		0xf0
 
-#define CT_BLT_PATTERN	CT_OFF_BITBLT + 0x14 /* address in vram */
-#define CT_BLT_SRCADDR	CT_OFF_BITBLT + 0x18
-#define CT_BLT_DSTADDR	CT_OFF_BITBLT + 0x1c
+#define CT_BLT_PATTERN	0x14 /* address in vram */
+#define CT_BLT_SRCADDR	0x18
+#define CT_BLT_DSTADDR	0x1c
 
-#define CT_BLT_SIZE	CT_OFF_BITBLT + 0x20	/* width and height */
+#define CT_BLT_SIZE	0x20	/* width and height */
 /*
  * upper 16 bit are destination height
  * lower 16 bit are destination width in bytes
  */
 
-#define CT_SRC_EXP_BG	CT_OFF_BITBLT + 0x24
-#define CT_SRC_EXP_FG	CT_OFF_BITBLT + 0x28
+#define CT_SRC_EXP_BG	0x24
+#define CT_SRC_EXP_FG	0x28
 
 /* extension registers ( via CT_CONF */
 #define XR_VENDOR_LO		0x00
diff --git a/sys/dev/ic/ct65550var.h b/sys/dev/ic/ct65550var.h
index 4285da919ef7..f079c170be05 100644
--- a/sys/dev/ic/ct65550var.h
+++ b/sys/dev/ic/ct65550var.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: ct65550var.h,v 1.1 2011/02/09 21:18:04 macallan Exp $	*/
+/*	$NetBSD: ct65550var.h,v 1.2 2011/03/23 04:02:43 macallan Exp $	*/
 
 /*
  * Copyright (c) 2006 Michael Lorenz
@@ -40,19 +40,16 @@ struct chipsfb_softc {
 
 	bus_space_tag_t sc_memt;
 	bus_space_tag_t sc_iot;
-	bus_space_handle_t sc_memh;
 
-	bus_space_tag_t sc_fbt;
-	bus_space_tag_t sc_ioregt;
 	bus_space_handle_t sc_fbh;
+	bus_space_handle_t sc_mmregh;
 	bus_space_handle_t sc_ioregh;
-	bus_addr_t sc_fb, sc_ioreg;
+	bus_addr_t sc_fb;
 	bus_size_t sc_fbsize, sc_ioregsize;
 
 	int (*sc_ioctl)(void *, void *, u_long, void *, int, struct lwp *);
-	paddr_t	(*chipsfb_mmap)(void *, void *, off_t, int);
+	paddr_t	(*sc_mmap)(void *, void *, off_t, int);
 
-	void *sc_ih;
 
 	size_t memsize;
 
diff --git a/sys/dev/pci/chipsfb.c b/sys/dev/pci/chipsfb.c
index 0a38173e25e1..154c2611c90d 100644
--- a/sys/dev/pci/chipsfb.c
+++ b/sys/dev/pci/chipsfb.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: chipsfb.c,v 1.26 2011/02/09 21:21:32 macallan Exp $	*/
+/*	$NetBSD: chipsfb.c,v 1.27 2011/03/23 04:02:43 macallan Exp $	*/
 
 /*
  * Copyright (c) 2006 Michael Lorenz
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: chipsfb.c,v 1.26 2011/02/09 21:21:32 macallan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: chipsfb.c,v 1.27 2011/03/23 04:02:43 macallan Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -99,7 +99,8 @@ chipsfb_pci_attach(device_t parent, device_t self, void *aux)
 	screg = pci_conf_read(scp->sc_pc, scp->sc_pcitag,
 	    PCI_COMMAND_STATUS_REG);
 	screg |= PCI_FLAGS_IO_ENABLED | PCI_FLAGS_MEM_ENABLED;
-	pci_conf_write(scp->sc_pc, scp->sc_pcitag,PCI_COMMAND_STATUS_REG, screg);
+	pci_conf_write(scp->sc_pc, scp->sc_pcitag, PCI_COMMAND_STATUS_REG, 
+	    screg);
 
 	pci_devinfo(pa->pa_id, pa->pa_class, 0, devinfo, sizeof(devinfo));
 	aprint_normal(": %s (rev. 0x%02x)\n", devinfo,
@@ -111,12 +112,23 @@ chipsfb_pci_attach(device_t parent, device_t self, void *aux)
 	sc->sc_memt = pa->pa_memt;
 	sc->sc_iot = pa->pa_iot;
 	sc->sc_ioctl = chipsfb_pci_ioctl;
+	sc->sc_mmap = NULL;
 	
 	/* the framebuffer */
-	if (pci_mapreg_map(pa, 0x10, PCI_MAPREG_TYPE_MEM,
-	    BUS_SPACE_MAP_LINEAR,
-	    &sc->sc_fbt, &sc->sc_fbh, &sc->sc_fb, &sc->sc_fbsize)) {
-		aprint_error_dev(sc->sc_dev, "failed to map the frame buffer.\n");
+	sc->sc_fb = (pci_conf_read(scp->sc_pc, scp->sc_pcitag, PCI_BAR0) & 
+	    ~PCI_MAPREG_MEM_TYPE_MASK);
+	sc->sc_fbsize = 0x01000000;	/* 16MB aperture */
+
+	if (bus_space_map(sc->sc_memt, sc->sc_fb, 0x400000,
+	    BUS_SPACE_MAP_LINEAR, &sc->sc_fbh)) {
+		aprint_error_dev(sc->sc_dev,
+		    "failed to map the frame buffer.\n");
+	}
+
+	if (bus_space_map(sc->sc_memt, sc->sc_fb + CT_OFF_BITBLT, 0x20000,
+	    BUS_SPACE_MAP_LINEAR, &sc->sc_mmregh)) {
+		aprint_error_dev(sc->sc_dev,
+		    "failed to map MMIO registers.\n");
 	}
 
 	/* IO-mapped registers */