Here are some news about my small progresses.

I found out why commit 20abd1634a6e2eedb84ca977adea56b8aa06cc3e introduced a
bug: it would init the psw->vblank field only if acceleration is enabled even
if it is used in both cases; calling nv50_software_create even with
acceleration solves the problem.

I reverted a few more commits, however I'm stuck on

  commit ebb945a94bba2ce8dff7b0942ff2b3f2a52a0a69 
  Author: Ben Skeggs <bskeggs@redhat.com>
  Date:   Thu, 19 Jul 2012 22:17:34 +0000

It seems like the init issue was fixed, but the screen stays scrambled. After
some testing, it seems some of the work done by nouveau_channel_new (which is
only called when acceleration is enabled) is needed, and therefore also
n84_fence_create, but I couldn't find which parts. When enabling
nv84_fence_create and nouveau_channel_new for the NVAC card (boot hangs if
enabling it for the NV96 card), nv50_disp_intr spams lots of

  nouveau E[PFB][0000:03:00:0] trapped write at 0x0000546000 on channel
0x0000fee0 [unknown] BAR/PFIFO_WRITE/FB reason: PAGE_NOT_PRESENT

but it seems harmless, apart from getting a really big dmesg and, some times,
hanging on boot.

Booting with 'nouveau.accel=0 nouveau.modeset=0 3' results in a clean console
mode, and running startx manually after boot will also give a clean GUI.