diff --git a/.gitignore b/.gitignore
index 0991da8c..fe64a289 100644
--- a/.gitignore
+++ b/.gitignore
@@ -58,6 +58,7 @@ tests/getclient
 tests/getstats
 tests/getversion
 tests/lock
+tests/mmfs_basic
 tests/openclose
 tests/setversion
 tests/updatedraw
diff --git a/linux-core/Makefile b/linux-core/Makefile
index 3af6f370..f2d44642 100644
--- a/linux-core/Makefile
+++ b/linux-core/Makefile
@@ -58,7 +58,7 @@ endif
 
 # Modules for all architectures
 MODULE_LIST := drm.o tdfx.o r128.o radeon.o mga.o sis.o savage.o via.o \
-               mach64.o nv.o nouveau.o xgi.o
+               mach64.o nv.o nouveau.o xgi.o mmfs.o
 
 # Modules only for ix86 architectures
 ifneq (,$(findstring 86,$(MACHINE)))
@@ -92,6 +92,7 @@ NVHEADERS =     nv_drv.h $(DRMHEADERS)
 FFBHEADERS = 	ffb_drv.h $(DRMHEADERS)
 NOUVEAUHEADERS = nouveau_drv.h nouveau_drm.h nouveau_reg.h $(DRMHEADERS)
 XGIHEADERS = xgi_cmdlist.h xgi_drv.h xgi_misc.h xgi_regs.h $(DRMHEADERS)
+MMFSHEADERS = mmfs.h mmfs_priv.h
 
 PROGS = dristat drmstat
 
diff --git a/linux-core/Makefile.kernel b/linux-core/Makefile.kernel
index f012262d..093552bf 100644
--- a/linux-core/Makefile.kernel
+++ b/linux-core/Makefile.kernel
@@ -41,6 +41,7 @@ mach64-objs := mach64_drv.o mach64_dma.o mach64_irq.o mach64_state.o
 nv-objs := nv_drv.o
 xgi-objs    := xgi_cmdlist.o xgi_drv.o xgi_fb.o xgi_misc.o xgi_pcie.o \
 		xgi_fence.o
+mmfs-objs   := mmfs_drv.o
 
 ifeq ($(CONFIG_COMPAT),y)
 drm-objs    += drm_ioc32.o
@@ -52,7 +53,7 @@ nouveau-objs += nouveau_ioc32.o
 xgi-objs    += xgi_ioc32.o
 endif
 
-obj-m			+= drm.o
+obj-m			+= drm.o mmfs.o
 obj-$(CONFIG_DRM_TDFX)	+= tdfx.o
 obj-$(CONFIG_DRM_R128)	+= r128.o
 obj-$(CONFIG_DRM_RADEON)+= radeon.o
diff --git a/linux-core/mmfs.h b/linux-core/mmfs.h
new file mode 100644
index 00000000..bdc148b9
--- /dev/null
+++ b/linux-core/mmfs.h
@@ -0,0 +1,176 @@
+/*
+ * Copyright © 2008 Intel Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Eric Anholt <eric@anholt.net>
+ *
+ */
+
+/** @file mmfs.h
+ * This file provides ioctl and ioctl argument definitions for using the
+ * mmfs device.
+ */
+#ifdef __KERNEL__
+#include <linux/spinlock.h>
+#include <linux/idr.h>
+
+/** @file mmfs_priv.h
+ * This file provides internal structure definitions for mmfs..
+ */
+
+/**
+ * This structure defines the mmfs memory object, which will be used by the
+ * DRM for its buffer objects.
+ */
+struct mmfs_object {
+	/** File representing the shmem storage */
+	struct file *filp;
+
+	spinlock_t lock;
+
+	size_t size;
+	/** Reference count of this object, protected by object_lock */
+	int refcount;
+};
+
+/**
+ * This structure defines the process (actually per-fd) mapping of object
+ * handles to mmfs objects.
+ */
+struct mmfs_file {
+	/** Mapping of object handles to object pointers. */
+	struct idr object_idr;
+	/**
+	 * Lock for synchronization of access to object->refcount and
+	 * object_idr.  See note in mmfs_unreference_ioctl.
+	 */
+	spinlock_t delete_lock;
+};
+
+void mmfs_object_reference(struct mmfs_object *obj);
+void mmfs_object_unreference(struct mmfs_object *obj);
+
+#endif /* __KERNEL__ */
+
+#define MMFS_DEVICE_PATH		"/dev/mmfs"
+/* XXX: Choose non-experimental major */
+#define MMFS_DEVICE_MAJOR		246
+
+struct mmfs_alloc_args {
+	/**
+	 * Requested size for the object.
+	 *
+	 * The (page-aligned) allocated size for the object will be returned.
+	 */
+	uint32_t size;
+	/** Returned handle for the object. */
+	uint32_t handle;
+};
+
+struct mmfs_unreference_args {
+	/** Handle of the object to be unreferenced. */
+	uint32_t handle;
+};
+
+struct mmfs_link_args {
+	/** Handle for the object being given a name. */
+	uint32_t handle;
+	/** Requested file name to export the object under. */
+	char *name;
+	/** Requested file mode to export the object under. */
+	mode_t mode;
+};
+
+struct mmfs_pread_args {
+	/** Handle for the object being read. */
+	uint32_t handle;
+	/** Offset into the object to read from */
+	off_t offset;
+	/** Length of data to read */
+	size_t size;
+	/** Pointer to write the data into. */
+	void *data;
+};
+
+struct mmfs_pwrite_args {
+	/** Handle for the object being written to. */
+	uint32_t handle;
+	/** Offset into the object to write to */
+	off_t offset;
+	/** Length of data to write */
+	size_t size;
+	/** Pointer to read the data from. */
+	void *data;
+};
+
+struct mmfs_mmap_args {
+	/** Handle for the object being mapped. */
+	uint32_t handle;
+	/** Offset in the object to map. */
+	off_t offset;
+	/**
+	 * Length of data to map.
+	 *
+	 * The value will be page-aligned.
+	 */
+	size_t size;
+	/** Returned pointer the data was mapped at */
+	void *addr;
+};
+
+/**
+ * \name Ioctls Definitions
+ */
+/* @{ */
+
+#define MMFS_IOCTL_BASE			'm'
+#define MMFS_IO(nr)			_IO(MMFS_IOCTL_BASE, nr)
+#define MMFS_IOR(nr,type)		_IOR(MMFS_IOCTL_BASE, nr, type)
+#define MMFS_IOW(nr,type)		_IOW(MMFS_IOCTL_BASE, nr, type)
+#define MMFS_IOWR(nr,type)		_IOWR(MMFS_IOCTL_BASE, nr, type)
+
+/** This ioctl allocates an object and returns a handle referencing it. */
+#define MMFS_IOCTL_ALLOC		MMFS_IOWR(0x00, struct mmfs_alloc_args)
+
+/**
+ * This ioctl releases the reference on the handle returned from
+ * MMFS_IOCTL_ALLOC.
+ */
+#define MMFS_IOCTL_UNREFERENCE		MMFS_IOR(0x01, struct mmfs_unreference_args)
+
+/**
+ * This ioctl creates a file in the mmfs filesystem representing an object.
+ *
+ * XXX: Need a way to get handle from fd or name.
+ */
+#define MMFS_IOCTL_LINK			MMFS_IOWR(0x02, struct mmfs_link_args)
+
+/** This ioctl copies data from an object into a user address. */
+#define MMFS_IOCTL_PREAD		MMFS_IOWR(0x03, struct mmfs_pread_args)
+
+/** This ioctl copies data from a user address into an object. */
+#define MMFS_IOCTL_PWRITE		MMFS_IOWR(0x04, struct mmfs_pwrite_args)
+
+/** This ioctl maps data from the object into the user address space. */
+#define MMFS_IOCTL_MMAP			MMFS_IOWR(0x05, struct mmfs_mmap_args)
+
+/* }@ */
diff --git a/linux-core/mmfs_drv.c b/linux-core/mmfs_drv.c
new file mode 100644
index 00000000..f4b07117
--- /dev/null
+++ b/linux-core/mmfs_drv.c
@@ -0,0 +1,299 @@
+/*
+ * Copyright © 2008 Intel Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Eric Anholt <eric@anholt.net>
+ *
+ */
+
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/mm.h>
+#include <linux/uaccess.h>
+#include <linux/fs.h>
+#include <linux/file.h>
+#include <linux/module.h>
+#include "mmfs.h"
+
+/** @file mmfs.c
+ *
+ * This file provides the filesystem for memory manager objects used by the
+ * DRM.
+ *
+ * The goal is to have swap-backed object allocation managed through
+ * struct file.  However, file descriptors as handles to a struct file have
+ * two major failings:
+ * - Process limits prevent more than 1024 or so being used at a time by
+ *   default.
+ * - Inability to allocate high fds will aggravate the X Server's select()
+ *   handling, and likely that of many GL client applications as well.
+ *
+ * This led to a plan of using our own integer IDs (called handles, following
+ * DRM terminology) to mimic fds, and implement the fd syscalls we need as
+ * ioctls.  The objects themselves will still include the struct file so
+ * that we can transition to fds if the required kernel infrastructure shows
+ * up at a later data, and as our interface with shmfs for memory allocation.
+ */
+
+static struct mmfs_object *
+mmfs_object_alloc(size_t size)
+{
+	struct mmfs_object *obj;
+
+	BUG_ON((size & (PAGE_SIZE - 1)) != 0);
+
+	obj = kcalloc(1, sizeof(*obj), GFP_KERNEL);
+
+	obj->filp = shmem_file_setup("mmfs object", size, 0);
+	if (IS_ERR(obj->filp)) {
+		kfree(obj);
+		return NULL;
+	}
+
+	obj->refcount = 1;
+
+	return obj;
+}
+
+/**
+ * Removes the mapping from handle to filp for this object.
+ */
+static int
+mmfs_handle_delete(struct mmfs_file *mmfs_filp, int handle)
+{
+	struct mmfs_object *obj;
+
+	/* This is gross. The idr system doesn't let us try a delete and
+	 * return an error code.  It just spews if you fail at deleting.
+	 * So, we have to grab a lock around finding the object and then
+	 * doing the delete on it and dropping the refcount, or the user
+	 * could race us to double-decrement the refcount and cause a
+	 * use-after-free later.  Given the frequency of our handle lookups,
+	 * we may want to use ida for number allocation and a hash table
+	 * for the pointers, anyway.
+	 */
+	spin_lock(&mmfs_filp->delete_lock);
+
+	/* Check if we currently have a reference on the object */
+	obj = idr_find(&mmfs_filp->object_idr, handle);
+	if (obj == NULL) {
+		spin_unlock(&mmfs_filp->delete_lock);
+		return -EINVAL;
+	}
+
+	/* Release reference and decrement refcount. */
+	idr_remove(&mmfs_filp->object_idr, handle);
+	mmfs_object_unreference(obj);
+
+	spin_unlock(&mmfs_filp->delete_lock);
+
+	return 0;
+}
+
+/**
+ * Allocates a new mmfs object and returns a handle to it.
+ */
+static int
+mmfs_alloc_ioctl(struct inode *inode, struct file *filp,
+		 unsigned int cmd, unsigned long arg)
+{
+	struct mmfs_file *mmfs_filp = filp->private_data;
+	struct mmfs_alloc_args args;
+	struct mmfs_object *obj;
+	int handle, ret;
+
+	if (copy_from_user(&args, (void __user *)arg, sizeof(args)))
+		return -EFAULT;
+
+	/* Round requested size up to page size */
+	args.size = (args.size + PAGE_SIZE - 1) & ~(PAGE_SIZE - 1);
+
+	/* Allocate the new object */
+	obj = mmfs_object_alloc(args.size);
+	if (obj == NULL)
+		return -ENOMEM;
+
+	/* Get the user-visible handle using idr.
+	 *
+	 * I'm not really sure why the idr api needs us to do this in two
+	 * repeating steps.  It handles internal locking of its data
+	 * structure, yet insists that we keep its memory allocation step
+	 * separate from its slot-finding step for locking purposes.
+	 */
+	do {
+		if (idr_pre_get(&mmfs_filp->object_idr, GFP_KERNEL) == 0) {
+			kfree(obj);
+			return -EFAULT;
+		}
+
+		ret = idr_get_new(&mmfs_filp->object_idr, obj, &handle);
+	} while (ret == -EAGAIN);
+
+	if (ret != 0) {
+		mmfs_object_unreference(obj);
+		return -EFAULT;
+	}
+
+	args.handle = handle;
+
+	if (copy_to_user((void __user *)arg, &args, sizeof(args))) {
+		mmfs_handle_delete(mmfs_filp, args.handle);
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
+/**
+ * Allocates a new mmfs object and returns a handle to it.
+ */
+static int
+mmfs_unreference_ioctl(struct inode *inode, struct file *filp,
+		       unsigned int cmd, unsigned long arg)
+{
+	struct mmfs_file *mmfs_filp = filp->private_data;
+	struct mmfs_unreference_args args;
+	int ret;
+
+	if (copy_from_user(&args, (void __user *)arg, sizeof(args)))
+		return -EFAULT;
+
+	ret = mmfs_handle_delete(mmfs_filp, args.handle);
+
+	return ret;
+}
+
+static int
+mmfs_ioctl(struct inode *inode, struct file *filp,
+	   unsigned int cmd, unsigned long arg)
+{
+
+	switch (cmd) {
+	case MMFS_IOCTL_ALLOC:
+		return mmfs_alloc_ioctl(inode, filp, cmd, arg);
+	case MMFS_IOCTL_UNREFERENCE:
+		return mmfs_unreference_ioctl(inode, filp, cmd, arg);
+	default:
+		return -EINVAL;
+	}
+}
+
+/**
+ * Sets up the file private for keeping track of our mappings of handles to
+ * mmfs objects.
+ */
+int
+mmfs_open(struct inode *inode, struct file *filp)
+{
+	struct mmfs_file *mmfs_filp;
+
+	if (filp->f_flags & O_EXCL)
+		return -EBUSY;	/* No exclusive opens */
+
+	mmfs_filp = kcalloc(1, sizeof(*mmfs_filp), GFP_KERNEL);
+	if (mmfs_filp == NULL)
+		return -ENOMEM;
+	filp->private_data = mmfs_filp;
+
+	idr_init(&mmfs_filp->object_idr);
+
+	return 0;
+}
+
+/** Called at device close to release the file's references on objects. */
+static int
+mmfs_object_release(int id, void *ptr, void *data)
+{
+	struct mmfs_object *obj = ptr;
+
+	mmfs_object_unreference(obj);
+
+	return 0;
+}
+
+/**
+ * Called at close time when the filp is going away.
+ *
+ * Releases any remaining references on objects by this filp.
+ */
+int
+mmfs_close(struct inode *inode, struct file *filp)
+{
+	struct mmfs_file *mmfs_filp = filp->private_data;
+
+	idr_for_each(&mmfs_filp->object_idr, &mmfs_object_release, NULL);
+
+	idr_destroy(&mmfs_filp->object_idr);
+
+	kfree(mmfs_filp);
+	filp->private_data = NULL;
+
+	return 0;
+}
+
+void
+mmfs_object_reference(struct mmfs_object *obj)
+{
+	spin_lock(&obj->lock);
+	obj->refcount++;
+	spin_unlock(&obj->lock);
+}
+
+void
+mmfs_object_unreference(struct mmfs_object *obj)
+{
+	spin_lock(&obj->lock);
+	obj->refcount--;
+	spin_unlock(&obj->lock);
+	if (obj->refcount == 0) {
+		fput(obj->filp);
+		kfree(obj);
+	}
+}
+
+/** File operations structure */
+static const struct file_operations mmfs_dev_fops = {
+	.owner = THIS_MODULE,
+	.open = mmfs_open,
+	.release = mmfs_close,
+	.ioctl = mmfs_ioctl,
+};
+
+static int __init mmfs_init(void)
+{
+	int ret;
+
+	ret = register_chrdev(MMFS_DEVICE_MAJOR, "mmfs", &mmfs_dev_fops);
+	if (ret != 0)
+		return ret;
+
+	return 0;
+}
+
+static void __exit mmfs_exit(void)
+{
+	unregister_chrdev(MMFS_DEVICE_MAJOR, "mmfs");
+}
+
+module_init(mmfs_init);
+module_exit(mmfs_exit);
+MODULE_LICENSE("GPL and additional rights");
diff --git a/tests/Makefile.am b/tests/Makefile.am
index dce1754e..4a7b0119 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -1,4 +1,5 @@
 AM_CFLAGS = \
+	-I $(top_srcdir)/linux-core \
 	-I $(top_srcdir)/shared-core \
 	-I $(top_srcdir)/libdrm
 
@@ -22,7 +23,8 @@ TESTS = auth \
 	getstats \
 	lock \
 	setversion \
-	updatedraw
+	updatedraw \
+	mmfs_basic
 
 EXTRA_PROGRAMS = $(TESTS)
 CLEANFILES = $(EXTRA_PROGRAMS) $(EXTRA_LTLIBRARIES)
diff --git a/tests/mmfs_basic.c b/tests/mmfs_basic.c
new file mode 100644
index 00000000..907dc585
--- /dev/null
+++ b/tests/mmfs_basic.c
@@ -0,0 +1,68 @@
+/*
+ * Copyright © 2008 Intel Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Eric Anholt <eric@anholt.net>
+ *
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <assert.h>
+#include <fcntl.h>
+#include <inttypes.h>
+#include <sys/stat.h>
+#include "mmfs.h"
+
+static void
+create_mmfs_device()
+{
+	struct stat sb;
+	int ret;
+
+	ret = stat(MMFS_DEVICE_PATH, &sb);
+
+	if (ret == 0)
+		return;
+
+	ret = mknod(MMFS_DEVICE_PATH, S_IFCHR | S_IRUSR | S_IWUSR,
+		    makedev(MMFS_DEVICE_MAJOR, 0));
+
+	if (ret != 0)
+		errx(1, "mknod()");
+}
+
+
+int main(int argc, char **argv)
+{
+	int fd;
+
+	create_mmfs_device();
+
+	fd = open(MMFS_DEVICE_PATH, O_RDWR);
+	if (fd == -1)
+		errx(1, "open()");
+
+	close(fd);
+
+	return 0;
+}