diff --git a/Input-evdev-fall-back-to-vmalloc-for-client-event-buffer.patch b/Input-evdev-fall-back-to-vmalloc-for-client-event-buffer.patch
deleted file mode 100644
index da1b92ed8..000000000
--- a/Input-evdev-fall-back-to-vmalloc-for-client-event-buffer.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 92eb77d0ffbaa71b501a0a8dabf09a351bf4267f Mon Sep 17 00:00:00 2001
-From: Daniel Stone <daniel@fooishbar.org>
-Date: Thu, 31 Oct 2013 07:25:34 +0000
-Subject: Input: evdev - fall back to vmalloc for client event buffer
-
-evdev always tries to allocate the event buffer for clients using
-kzalloc rather than vmalloc, presumably to avoid mapping overhead where
-possible.  However, drivers like bcm5974, which claims support for
-reporting 16 fingers simultaneously, can have an extraordinarily large
-buffer.  The resultant contiguous order-4 allocation attempt fails due
-to fragmentation, and the device is thus unusable until reboot.
-
-Try kzalloc if we can to avoid the mapping overhead, but if that fails,
-fall back to vzalloc.
-
-Signed-off-by: Daniel Stone <daniels@collabora.com>
-Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
----
-diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
-index b6ded17..a06e125 100644
---- a/drivers/input/evdev.c
-+++ b/drivers/input/evdev.c
-@@ -18,6 +18,8 @@
- #include <linux/poll.h>
- #include <linux/sched.h>
- #include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/mm.h>
- #include <linux/module.h>
- #include <linux/init.h>
- #include <linux/input/mt.h>
-@@ -369,7 +371,11 @@ static int evdev_release(struct inode *inode, struct file *file)
- 	mutex_unlock(&evdev->mutex);
- 
- 	evdev_detach_client(evdev, client);
--	kfree(client);
-+
-+	if (is_vmalloc_addr(client))
-+		vfree(client);
-+	else
-+		kfree(client);
- 
- 	evdev_close_device(evdev);
- 
-@@ -389,12 +395,14 @@ static int evdev_open(struct inode *inode, struct file *file)
- {
- 	struct evdev *evdev = container_of(inode->i_cdev, struct evdev, cdev);
- 	unsigned int bufsize = evdev_compute_buffer_size(evdev->handle.dev);
-+	unsigned int size = sizeof(struct evdev_client) +
-+					bufsize * sizeof(struct input_event);
- 	struct evdev_client *client;
- 	int error;
- 
--	client = kzalloc(sizeof(struct evdev_client) +
--				bufsize * sizeof(struct input_event),
--			 GFP_KERNEL);
-+	client = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
-+	if (!client)
-+		client = vzalloc(size);
- 	if (!client)
- 		return -ENOMEM;
- 
---
-cgit v0.9.2
diff --git a/PatchList.txt b/PatchList.txt
index 2ee388846..e0a26a21c 100644
--- a/PatchList.txt
+++ b/PatchList.txt
@@ -1,20 +1,11 @@
 **** Backports and patches headed/already upsteram *****************************
 
-* btrfs-relocate-csums-properly-with-prealloc-ext.patch (rhbz 1011714)
-  - Still pending upstream
-
 * cpupower-Fix-segfault-due-to-incorrect-getopt_long-a.patch (rhbz 1000439)
   - Queued for next upstream release I believe.  Fixes a segfault in cpupower
 
 * dm-cache-policy-mq_fix-large-scale-table-allocation-bug.patch (rhbz 993744)
   - Still pending upstream
 
-* vfio-iommu-Fixed-interaction-of-VFIO_IOMMU_MAP_DMA.patch (rhbz 998732)
-  - Still pending upstream
-
-* iommu-Remove-stack-trace-from-broken-irq-remapping-warning.patch (rhbz 982153)
-  - Still pending upstream
-
 * ansi_cprng-Fix-off-by-one-error-in-non-block-size-request.patch (rhbz 1007690 1009136)
   - Fixes CVE-2013-4345
 
diff --git a/btrfs-relocate-csums-properly-with-prealloc-ext.patch b/btrfs-relocate-csums-properly-with-prealloc-ext.patch
deleted file mode 100644
index e103f703a..000000000
--- a/btrfs-relocate-csums-properly-with-prealloc-ext.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-A user reported a problem where they were getting csum errors when running a
-balance and running systemd's journal.  This is because systemd is awesome and
-fallocate()'s its log space and writes into it.  Unfortunately we assume that
-when we read in all the csums for an extent that they are sequential starting at
-the bytenr we care about.  This obviously isn't the case for prealloc extents,
-where we could have written to the middle of the prealloc extent only, which
-means the csum would be for the bytenr in the middle of our range and not the
-front of our range.  Fix this by offsetting the new bytenr we are logging to
-based on the original bytenr the csum was for.  With this patch I no longer see
-the csum errors I was seeing.  Thanks,
-
-Cc: stable@xxxxxxxxxxxxxxx
-Reported-by: Chris Murphy <lists@xxxxxxxxxxxxxxxxx>
-Signed-off-by: Josef Bacik <jbacik@xxxxxxxxxxxx>
----
- fs/btrfs/relocation.c | 18 +++++++++++++++---
- 1 file changed, 15 insertions(+), 3 deletions(-)
-
-diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
-index 5ca7ea9..b7afeaa 100644
---- a/fs/btrfs/relocation.c
-+++ b/fs/btrfs/relocation.c
-@@ -4472,6 +4472,7 @@ int btrfs_reloc_clone_csums(struct inode *inode, u64 file_pos, u64 len)
- 	struct btrfs_root *root = BTRFS_I(inode)->root;
- 	int ret;
- 	u64 disk_bytenr;
-+	u64 new_bytenr;
- 	LIST_HEAD(list);
- 
- 	ordered = btrfs_lookup_ordered_extent(inode, file_pos);
-@@ -4483,13 +4484,24 @@ int btrfs_reloc_clone_csums(struct inode *inode, u64 file_pos, u64 len)
- 	if (ret)
- 		goto out;
- 
--	disk_bytenr = ordered->start;
- 	while (!list_empty(&list)) {
- 		sums = list_entry(list.next, struct btrfs_ordered_sum, list);
- 		list_del_init(&sums->list);
- 
--		sums->bytenr = disk_bytenr;
--		disk_bytenr += sums->len;
-+		/*
-+		 * We need to offset the new_bytenr based on where the csum is.
-+		 * We need to do this because we will read in entire prealloc
-+		 * extents but we may have written to say the middle of the
-+		 * prealloc extent, so we need to make sure the csum goes with
-+		 * the right disk offset.
-+		 *
-+		 * We can do this because the data reloc inode refers strictly
-+		 * to the on disk bytes, so we don't have to worry about
-+		 * disk_len vs real len like with real inodes since it's all
-+		 * disk length.
-+		 */
-+		new_bytenr = ordered->start + (sums->bytenr - disk_bytenr);
-+		sums->bytenr = new_bytenr;
- 
- 		btrfs_add_ordered_sum(inode, ordered, sums);
- 	}
--- 
-1.8.3.1
diff --git a/config-arm-generic b/config-arm-generic
index 5bc924bbb..39ea4d938 100644
--- a/config-arm-generic
+++ b/config-arm-generic
@@ -135,6 +135,10 @@ CONFIG_SMC911X=m
 # CONFIG_LEDS_RENESAS_TPU is not set
 # CONFIG_LOCK_STAT is not set
 
+# CONFIG_DRM_ARMADA is not set
+# CONFIG_DRM_TEGRA is not set
+# CONFIG_SHMOBILE_IOMMU is not set
+
 ### turn off things which make no sense on embedded SoC
 
 # core
diff --git a/config-armv7 b/config-armv7
index ebb51c650..843ffa7d6 100644
--- a/config-armv7
+++ b/config-armv7
@@ -50,6 +50,7 @@ CONFIG_SPI_ORION=m
 CONFIG_USB_MV_UDC=m
 CONFIG_MVEBU_MBUS=y
 CONFIG_ARMADA_THERMAL=m
+CONFIG_DRM_ARMADA=m
 
 # omap 
 CONFIG_ARCH_OMAP2PLUS_TYPICAL=y
@@ -537,6 +538,8 @@ CONFIG_SND_SOC_TEGRA20_AC97=m
 CONFIG_SND_SOC_TEGRA30_AHUB=m
 CONFIG_SND_SOC_TEGRA30_I2S=m
 
+# CONFIG_DRM_TEGRA is not set # bool only, for some reason??
+
 # AC100 (PAZ00)
 CONFIG_MFD_NVEC=y
 CONFIG_MFD_TPS80031=y
diff --git a/config-generic b/config-generic
index c791e0a92..571fc32d9 100644
--- a/config-generic
+++ b/config-generic
@@ -2087,6 +2087,7 @@ CONFIG_SERIO_ARC_PS2=m
 # CONFIG_SERIO_OLPC_APSP is not set
 # CONFIG_SERIO_PARKBD is not set
 # CONFIG_SERIO_PCIPS2 is not set
+# CONFIG_SERIO_LIBPS2 is not set
 
 #
 # Input Device Drivers
@@ -2094,6 +2095,7 @@ CONFIG_SERIO_ARC_PS2=m
 CONFIG_INPUT_KEYBOARD=y
 CONFIG_KEYBOARD_ATKBD=y
 # CONFIG_KEYBOARD_SUNKBD is not set
+# CONFIG_KEYBOARD_SH_KEYSC is not set
 # CONFIG_KEYBOARD_XTKBD is not set
 # CONFIG_KEYBOARD_MATRIX is not set
 # CONFIG_KEYBOARD_NEWTON is not set
@@ -2198,6 +2200,7 @@ CONFIG_TOUCHSCREEN_ATMEL_MXT=m
 # CONFIG_TOUCHSCREEN_MAX11801 is not set
 CONFIG_TOUCHSCREEN_AUO_PIXCIR=m
 CONFIG_TOUCHSCREEN_TI_AM335X_TSC=m
+CONFIG_TOUCHSCREEN_ZFORCE=m
 
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_PCSPKR=m
@@ -2818,6 +2821,7 @@ CONFIG_DRM_MGAG200=m  # do not enable on f17 or older
 # CONFIG_DRM_SAVAGE is not set
 CONFIG_DRM_I915=m
 CONFIG_DRM_I915_KMS=y
+CONFIG_DRM_I915_FBDEV=y
 # CONFIG_DRM_I915_PRELIMINARY_HW_SUPPORT is not set
 CONFIG_DRM_VIA=m
 CONFIG_DRM_NOUVEAU=m
@@ -3508,6 +3512,7 @@ CONFIG_HID_ROCCAT=m
 CONFIG_HID_ROCCAT_KONE=m
 CONFIG_HID_SAMSUNG=m
 CONFIG_HID_SONY=m
+CONFIG_SONY_FF=y
 CONFIG_HID_SUNPLUS=m
 CONFIG_HID_STEELSERIES=m
 CONFIG_HID_GREENASIA=m
@@ -3878,6 +3883,7 @@ CONFIG_MFD_VIPERBOARD=m
 # CONFIG_HTC_I2CPLD is not set
 # CONFIG_MFD_MAX8925 is not set
 # CONFIG_MFD_ASIC3 is not set
+# CONFIG_MFD_AS3722 is not set
 # CONFIG_HTC_EGPIO is not set
 # CONFIG_TPS6507X is not set
 # CONFIG_ABX500_CORE is not set
diff --git a/config-powerpc64 b/config-powerpc64
index 27cdb2dfd..3d4bc1532 100644
--- a/config-powerpc64
+++ b/config-powerpc64
@@ -140,6 +140,7 @@ CONFIG_CMA=y
 # CONFIG_CMA_DEBUG is not set
 CONFIG_KVM_BOOK3S_64=m
 CONFIG_KVM_BOOK3S_64_HV=y
+# CONFIG_KVM_BOOK3S_64_PR is not set
 # CONFIG_KVM_EXIT_TIMING is not set
 CONFIG_KVM_XICS=y
 
diff --git a/config-powerpc64p7 b/config-powerpc64p7
index 8bf0e4464..c0f8d9e0f 100644
--- a/config-powerpc64p7
+++ b/config-powerpc64p7
@@ -131,6 +131,7 @@ CONFIG_CMA=y
 # CONFIG_CMA_DEBUG is not set
 CONFIG_KVM_BOOK3S_64=m
 CONFIG_KVM_BOOK3S_64_HV=y
+# CONFIG_KVM_BOOK3S_64_PR is not set
 # CONFIG_KVM_EXIT_TIMING is not set
 CONFIG_KVM_XICS=y
 
diff --git a/config-x86-generic b/config-x86-generic
index d120a3ef5..34b4747fb 100644
--- a/config-x86-generic
+++ b/config-x86-generic
@@ -418,6 +418,7 @@ CONFIG_HYPERV_NET=m
 CONFIG_HYPERV_STORAGE=m
 CONFIG_HYPERV_BALLOON=m
 CONFIG_FB_HYPERV=m
+CONFIG_HYPERV_KEYBOARD=m
 
 # Depends on HOTPLUG_PCI_PCIE
 CONFIG_BLK_DEV_PCIESSD_MTIP32XX=m
diff --git a/drm-i915-dp-stfu.patch b/drm-i915-dp-stfu.patch
index fb2e58ee9..c9132f6d3 100644
--- a/drm-i915-dp-stfu.patch
+++ b/drm-i915-dp-stfu.patch
@@ -1,17 +1,17 @@
 diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
-index fb2fbc1..0aaf67d 100644
+index eb8139d..463e373 100644
 --- a/drivers/gpu/drm/i915/intel_dp.c
 +++ b/drivers/gpu/drm/i915/intel_dp.c
-@@ -283,7 +283,7 @@ intel_dp_check_edp(struct intel_dp *intel_dp)
- 	pp_ctrl_reg = IS_VALLEYVIEW(dev) ? PIPEA_PP_CONTROL : PCH_PP_CONTROL;
+@@ -320,7 +320,7 @@ intel_dp_check_edp(struct intel_dp *intel_dp)
+ 		return;
  
  	if (!ironlake_edp_have_panel_power(intel_dp) && !ironlake_edp_have_panel_vdd(intel_dp)) {
 -		WARN(1, "eDP powered off while attempting aux channel communication.\n");
 +		DRM_ERROR("eDP powered off while attempting aux channel communication.\n");
  		DRM_DEBUG_KMS("Status 0x%08x Control 0x%08x\n",
- 				I915_READ(pp_stat_reg),
- 				I915_READ(pp_ctrl_reg));
-@@ -376,7 +376,7 @@ intel_dp_aux_ch(struct intel_dp *intel_dp,
+ 			      I915_READ(_pp_stat_reg(intel_dp)),
+ 			      I915_READ(_pp_ctrl_reg(intel_dp)));
+@@ -436,7 +436,7 @@ intel_dp_aux_ch(struct intel_dp *intel_dp,
  	}
  
  	if (try == 3) {
@@ -20,28 +20,28 @@ index fb2fbc1..0aaf67d 100644
  		     I915_READ(ch_ctl));
  		ret = -EBUSY;
  		goto out;
-@@ -995,8 +995,8 @@ void ironlake_edp_panel_vdd_on(struct intel_dp *intel_dp)
+@@ -1084,8 +1084,8 @@ void ironlake_edp_panel_vdd_on(struct intel_dp *intel_dp)
+ 	if (!is_edp(intel_dp))
  		return;
- 	DRM_DEBUG_KMS("Turn eDP VDD on\n");
  
 -	WARN(intel_dp->want_panel_vdd,
 -	     "eDP VDD already requested on\n");
 +	if (intel_dp->want_panel_vdd)
-+		DRM_ERROR("eDP VDD already requested on\n");
++	     DRM_ERROR("eDP VDD already requested on\n");
  
  	intel_dp->want_panel_vdd = true;
  
-@@ -1070,7 +1070,8 @@ void ironlake_edp_panel_vdd_off(struct intel_dp *intel_dp, bool sync)
+@@ -1160,7 +1160,8 @@ void ironlake_edp_panel_vdd_off(struct intel_dp *intel_dp, bool sync)
+ 	if (!is_edp(intel_dp))
  		return;
  
- 	DRM_DEBUG_KMS("Turn eDP VDD off %d\n", intel_dp->want_panel_vdd);
 -	WARN(!intel_dp->want_panel_vdd, "eDP VDD not forced on");
 +	if (!intel_dp->want_panel_vdd)
 +		DRM_ERROR("eDP VDD not forced on");
  
  	intel_dp->want_panel_vdd = false;
  
-@@ -1144,7 +1145,8 @@ void ironlake_edp_panel_off(struct intel_dp *intel_dp)
+@@ -1233,7 +1234,8 @@ void ironlake_edp_panel_off(struct intel_dp *intel_dp)
  
  	DRM_DEBUG_KMS("Turn eDP power off\n");
  
diff --git a/drm-qxl-backport-fixes-for-Fedora.patch b/drm-qxl-backport-fixes-for-Fedora.patch
deleted file mode 100644
index c46060d64..000000000
--- a/drm-qxl-backport-fixes-for-Fedora.patch
+++ /dev/null
@@ -1,226 +0,0 @@
-Bugzilla: N/A
-Upstream-status: Queued for 3.13
-
-From db8edc33193879f39c1b52521e20f4d6eb4e9858 Mon Sep 17 00:00:00 2001
-From: Dave Airlie <airlied@redhat.com>
-Date: Fri, 08 Nov 2013 06:36:45 +0000
-Subject: drm/qxl: backport fixes for Fedora
-
-This pulls these changes from drm-next back into Fedora.
-
-drm/qxl: prefer the monitor config resolution (b080742393e2c1)
-drm/qxl: remove unnecessary check (a40a60d912a101e8dfb08ee1)
-drm/qxl: fix disabling extra monitors from client (5cab51cb3381157)
-qxl: avoid an oops in the deferred io code. (cc87509d87696d7cd39)
-drm/qxl: support 64bit surface bar (35541782dcc1e502)
-qxl: add a connector property to denote hotplug should rescan modes. (4695b03970df37)
-
-Signed-off-by: Dave Airlie <airlied@redhat.com>
----
-diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
-index 835caba..1d975eb 100644
---- a/drivers/gpu/drm/qxl/qxl_display.c
-+++ b/drivers/gpu/drm/qxl/qxl_display.c
-@@ -110,7 +110,9 @@ void qxl_display_read_client_monitors_config(struct qxl_device *qdev)
- 	drm_helper_hpd_irq_event(qdev->ddev);
- }
- 
--static int qxl_add_monitors_config_modes(struct drm_connector *connector)
-+static int qxl_add_monitors_config_modes(struct drm_connector *connector,
-+                                         unsigned *pwidth,
-+                                         unsigned *pheight)
- {
- 	struct drm_device *dev = connector->dev;
- 	struct qxl_device *qdev = dev->dev_private;
-@@ -126,11 +128,15 @@ static int qxl_add_monitors_config_modes(struct drm_connector *connector)
- 	mode = drm_cvt_mode(dev, head->width, head->height, 60, false, false,
- 			    false);
- 	mode->type |= DRM_MODE_TYPE_PREFERRED;
-+	*pwidth = head->width;
-+	*pheight = head->height;
- 	drm_mode_probed_add(connector, mode);
- 	return 1;
- }
- 
--static int qxl_add_common_modes(struct drm_connector *connector)
-+static int qxl_add_common_modes(struct drm_connector *connector,
-+                                unsigned pwidth,
-+                                unsigned pheight)
- {
- 	struct drm_device *dev = connector->dev;
- 	struct drm_display_mode *mode = NULL;
-@@ -159,12 +165,9 @@ static int qxl_add_common_modes(struct drm_connector *connector)
- 	};
- 
- 	for (i = 0; i < ARRAY_SIZE(common_modes); i++) {
--		if (common_modes[i].w < 320 || common_modes[i].h < 200)
--			continue;
--
- 		mode = drm_cvt_mode(dev, common_modes[i].w, common_modes[i].h,
- 				    60, false, false, false);
--		if (common_modes[i].w == 1024 && common_modes[i].h == 768)
-+		if (common_modes[i].w == pwidth && common_modes[i].h == pheight)
- 			mode->type |= DRM_MODE_TYPE_PREFERRED;
- 		drm_mode_probed_add(connector, mode);
- 	}
-@@ -720,16 +723,18 @@ static int qxl_conn_get_modes(struct drm_connector *connector)
- {
- 	int ret = 0;
- 	struct qxl_device *qdev = connector->dev->dev_private;
-+	unsigned pwidth = 1024;
-+	unsigned pheight = 768;
- 
- 	DRM_DEBUG_KMS("monitors_config=%p\n", qdev->monitors_config);
- 	/* TODO: what should we do here? only show the configured modes for the
- 	 * device, or allow the full list, or both? */
- 	if (qdev->monitors_config && qdev->monitors_config->count) {
--		ret = qxl_add_monitors_config_modes(connector);
-+		ret = qxl_add_monitors_config_modes(connector, &pwidth, &pheight);
- 		if (ret < 0)
- 			return ret;
- 	}
--	ret += qxl_add_common_modes(connector);
-+	ret += qxl_add_common_modes(connector, pwidth, pheight);
- 	return ret;
- }
- 
-@@ -793,7 +798,10 @@ static enum drm_connector_status qxl_conn_detect(
- 		     qdev->client_monitors_config->count > output->index &&
- 		     qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]));
- 
--	DRM_DEBUG("\n");
-+	DRM_DEBUG("#%d connected: %d\n", output->index, connected);
-+	if (!connected)
-+		qxl_monitors_config_set(qdev, output->index, 0, 0, 0, 0, 0);
-+
- 	return connected ? connector_status_connected
- 			 : connector_status_disconnected;
- }
-@@ -835,8 +843,21 @@ static const struct drm_encoder_funcs qxl_enc_funcs = {
- 	.destroy = qxl_enc_destroy,
- };
- 
-+static int qxl_mode_create_hotplug_mode_update_property(struct qxl_device *qdev)
-+{
-+	if (qdev->hotplug_mode_update_property)
-+		return 0;
-+
-+	qdev->hotplug_mode_update_property =
-+		drm_property_create_range(qdev->ddev, DRM_MODE_PROP_IMMUTABLE,
-+					  "hotplug_mode_update", 0, 1);
-+
-+	return 0;
-+}
-+
- static int qdev_output_init(struct drm_device *dev, int num_output)
- {
-+	struct qxl_device *qdev = dev->dev_private;
- 	struct qxl_output *qxl_output;
- 	struct drm_connector *connector;
- 	struct drm_encoder *encoder;
-@@ -863,6 +884,8 @@ static int qdev_output_init(struct drm_device *dev, int num_output)
- 	drm_encoder_helper_add(encoder, &qxl_enc_helper_funcs);
- 	drm_connector_helper_add(connector, &qxl_connector_helper_funcs);
- 
-+	drm_object_attach_property(&connector->base,
-+				   qdev->hotplug_mode_update_property, 0);
- 	drm_sysfs_connector_add(connector);
- 	return 0;
- }
-@@ -975,6 +998,9 @@ int qxl_modeset_init(struct qxl_device *qdev)
- 	qdev->ddev->mode_config.max_height = 8192;
- 
- 	qdev->ddev->mode_config.fb_base = qdev->vram_base;
-+
-+	qxl_mode_create_hotplug_mode_update_property(qdev);
-+
- 	for (i = 0 ; i < qxl_num_crtc; ++i) {
- 		qdev_crtc_init(qdev->ddev, i);
- 		qdev_output_init(qdev->ddev, i);
-diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
-index 7e96f4f..18c599d 100644
---- a/drivers/gpu/drm/qxl/qxl_drv.h
-+++ b/drivers/gpu/drm/qxl/qxl_drv.h
-@@ -323,6 +323,8 @@ struct qxl_device {
- 	struct work_struct gc_work;
- 
- 	struct work_struct fb_work;
-+
-+	struct drm_property *hotplug_mode_update_property;
- };
- 
- /* forward declaration for QXL_INFO_IO */
-diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c
-index 88722f2..f437b30 100644
---- a/drivers/gpu/drm/qxl/qxl_fb.c
-+++ b/drivers/gpu/drm/qxl/qxl_fb.c
-@@ -108,7 +108,7 @@ static void qxl_fb_dirty_flush(struct fb_info *info)
- 	u32 x1, x2, y1, y2;
- 
- 	/* TODO: hard coding 32 bpp */
--	int stride = qfbdev->qfb.base.pitches[0] * 4;
-+	int stride = qfbdev->qfb.base.pitches[0];
- 
- 	x1 = qfbdev->dirty.x1;
- 	x2 = qfbdev->dirty.x2;
-diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c
-index 9e8da9e..e0ddd5b 100644
---- a/drivers/gpu/drm/qxl/qxl_kms.c
-+++ b/drivers/gpu/drm/qxl/qxl_kms.c
-@@ -120,7 +120,7 @@ int qxl_device_init(struct qxl_device *qdev,
- 		    struct pci_dev *pdev,
- 		    unsigned long flags)
- {
--	int r;
-+	int r, sb;
- 
- 	qdev->dev = &pdev->dev;
- 	qdev->ddev = ddev;
-@@ -136,21 +136,39 @@ int qxl_device_init(struct qxl_device *qdev,
- 	qdev->rom_base = pci_resource_start(pdev, 2);
- 	qdev->rom_size = pci_resource_len(pdev, 2);
- 	qdev->vram_base = pci_resource_start(pdev, 0);
--	qdev->surfaceram_base = pci_resource_start(pdev, 1);
--	qdev->surfaceram_size = pci_resource_len(pdev, 1);
- 	qdev->io_base = pci_resource_start(pdev, 3);
- 
- 	qdev->vram_mapping = io_mapping_create_wc(qdev->vram_base, pci_resource_len(pdev, 0));
--	qdev->surface_mapping = io_mapping_create_wc(qdev->surfaceram_base, qdev->surfaceram_size);
--	DRM_DEBUG_KMS("qxl: vram %llx-%llx(%dM %dk), surface %llx-%llx(%dM %dk)\n",
-+
-+	if (pci_resource_len(pdev, 4) > 0) {
-+		/* 64bit surface bar present */
-+		sb = 4;
-+		qdev->surfaceram_base = pci_resource_start(pdev, sb);
-+		qdev->surfaceram_size = pci_resource_len(pdev, sb);
-+		qdev->surface_mapping =
-+			io_mapping_create_wc(qdev->surfaceram_base,
-+					     qdev->surfaceram_size);
-+	}
-+	if (qdev->surface_mapping == NULL) {
-+		/* 64bit surface bar not present (or mapping failed) */
-+		sb = 1;
-+		qdev->surfaceram_base = pci_resource_start(pdev, sb);
-+		qdev->surfaceram_size = pci_resource_len(pdev, sb);
-+		qdev->surface_mapping =
-+			io_mapping_create_wc(qdev->surfaceram_base,
-+					     qdev->surfaceram_size);
-+	}
-+
-+	DRM_DEBUG_KMS("qxl: vram %llx-%llx(%dM %dk), surface %llx-%llx(%dM %dk, %s)\n",
- 		 (unsigned long long)qdev->vram_base,
- 		 (unsigned long long)pci_resource_end(pdev, 0),
- 		 (int)pci_resource_len(pdev, 0) / 1024 / 1024,
- 		 (int)pci_resource_len(pdev, 0) / 1024,
- 		 (unsigned long long)qdev->surfaceram_base,
--		 (unsigned long long)pci_resource_end(pdev, 1),
-+		 (unsigned long long)pci_resource_end(pdev, sb),
- 		 (int)qdev->surfaceram_size / 1024 / 1024,
--		 (int)qdev->surfaceram_size / 1024);
-+		 (int)qdev->surfaceram_size / 1024,
-+		 (sb == 4) ? "64bit" : "32bit");
- 
- 	qdev->rom = ioremap(qdev->rom_base, qdev->rom_size);
- 	if (!qdev->rom) {
---
-cgit v0.9.0.2-2-gbebe
diff --git a/fix-arm-xen-driver-build.patch b/fix-arm-xen-driver-build.patch
new file mode 100644
index 000000000..9e29ea699
--- /dev/null
+++ b/fix-arm-xen-driver-build.patch
@@ -0,0 +1,14 @@
+diff --git a/arch/arm/xen/p2m.c b/arch/arm/xen/p2m.c
+index 23732cd..7772fa8 100644
+--- a/arch/arm/xen/p2m.c
++++ b/arch/arm/xen/p2m.c
+@@ -27,7 +27,9 @@ struct xen_p2m_entry {
+ 
+ rwlock_t p2m_lock;
+ struct rb_root phys_to_mach = RB_ROOT;
++EXPORT_SYMBOL_GPL(phys_to_mach);
+ static struct rb_root mach_to_phys = RB_ROOT;
++EXPORT_SYMBOL_GPL(mach_to_phys);
+ 
+ static int xen_add_phys_to_mach_entry(struct xen_p2m_entry *new)
+ {
diff --git a/iommu-Remove-stack-trace-from-broken-irq-remapping-warning.patch b/iommu-Remove-stack-trace-from-broken-irq-remapping-warning.patch
deleted file mode 100644
index 9e88893ae..000000000
--- a/iommu-Remove-stack-trace-from-broken-irq-remapping-warning.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 05104a4e8713b27291c7bb49c1e7e68b4e243571 Mon Sep 17 00:00:00 2001
-From: Neil Horman <nhorman@tuxdriver.com>
-Date: Fri, 27 Sep 2013 16:53:35 +0000
-Subject: iommu: Remove stack trace from broken irq remapping warning
-
-The warning for the irq remapping broken check in intel_irq_remapping.c is
-pretty pointless.  We need the warning, but we know where its comming from, the
-stack trace will always be the same, and it needlessly triggers things like
-Abrt.  This changes the warning to just print a text warning about BIOS being
-broken, without the stack trace, then sets the appropriate taint bit.  Since we
-automatically disable irq remapping, theres no need to contiue making Abrt jump
-at this problem
-
-Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
-CC: Joerg Roedel <joro@8bytes.org>
-CC: Bjorn Helgaas <bhelgaas@google.com>
-CC: Andy Lutomirski <luto@amacapital.net>
-CC: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-CC: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
-Signed-off-by: Joerg Roedel <joro@8bytes.org>
----
-diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
-index f71673d..b97d70b 100644
---- a/drivers/iommu/intel_irq_remapping.c
-+++ b/drivers/iommu/intel_irq_remapping.c
-@@ -525,12 +525,13 @@ static int __init intel_irq_remapping_supported(void)
- 	if (disable_irq_remap)
- 		return 0;
- 	if (irq_remap_broken) {
--		WARN_TAINT(1, TAINT_FIRMWARE_WORKAROUND,
--			   "This system BIOS has enabled interrupt remapping\n"
--			   "on a chipset that contains an erratum making that\n"
--			   "feature unstable.  To maintain system stability\n"
--			   "interrupt remapping is being disabled.  Please\n"
--			   "contact your BIOS vendor for an update\n");
-+		printk(KERN_WARNING
-+			"This system BIOS has enabled interrupt remapping\n"
-+			"on a chipset that contains an erratum making that\n"
-+			"feature unstable.  To maintain system stability\n"
-+			"interrupt remapping is being disabled.  Please\n"
-+			"contact your BIOS vendor for an update\n");
-+		add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
- 		disable_irq_remap = 1;
- 		return 0;
- 	}
---
-cgit v0.9.2
diff --git a/kernel.spec b/kernel.spec
index 160fe91d3..7243ea20d 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -95,7 +95,7 @@ Summary: The Linux kernel
 # The rc snapshot level
 %define rcrev 0
 # The git snapshot level
-%define gitrev 4
+%define gitrev 5
 # Set rpm version accordingly
 %define rpmversion 3.%{upstream_sublevel}.0
 %endif
@@ -692,6 +692,8 @@ Patch21020: arm-tegra-usb-no-reset-linux33.patch
 # http://www.spinics.net/lists/devicetree/msg08276.html
 Patch21030: arm-imx6-utilite.patch
 
+Patch21031: fix-arm-xen-driver-build.patch
+
 #rhbz 754518
 Patch21235: scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch
 
@@ -708,25 +710,12 @@ Patch25047: drm-radeon-Disable-writeback-by-default-on-ppc.patch
 #CVE-2013-4345 rhbz 1007690 1009136
 Patch25104: ansi_cprng-Fix-off-by-one-error-in-non-block-size-request.patch
 
-#rhbz 982153
-Patch25123: iommu-Remove-stack-trace-from-broken-irq-remapping-warning.patch
-
-#rhbz 998732
-Patch25124: vfio-iommu-Fixed-interaction-of-VFIO_IOMMU_MAP_DMA.patch
-
 #rhbz 993744
 Patch25128: dm-cache-policy-mq_fix-large-scale-table-allocation-bug.patch
 
 #rhbz 1000439
 Patch25129: cpupower-Fix-segfault-due-to-incorrect-getopt_long-a.patch
 
-#rhbz 1011714
-Patch25131: btrfs-relocate-csums-properly-with-prealloc-ext.patch
-
-Patch25140: drm-qxl-backport-fixes-for-Fedora.patch
-
-Patch25141: Input-evdev-fall-back-to-vmalloc-for-client-event-buffer.patch
-
 Patch25142: 0001-staging-imx-drm-Fix-modular-build-of-DRM_IMX_IPUV3.patch
 
 # END OF PATCH DEFINITIONS
@@ -1284,6 +1273,8 @@ ApplyPatch arm-omap-load-tfp410.patch
 ApplyPatch arm-tegra-usb-no-reset-linux33.patch
 ApplyPatch arm-imx6-utilite.patch
 
+ApplyPatch fix-arm-xen-driver-build.patch
+
 #
 # bugfixes to drivers and filesystems
 #
@@ -1404,25 +1395,12 @@ ApplyPatch drm-radeon-Disable-writeback-by-default-on-ppc.patch
 #CVE-2013-4345 rhbz 1007690 1009136
 ApplyPatch ansi_cprng-Fix-off-by-one-error-in-non-block-size-request.patch
 
-#rhbz 982153
-ApplyPatch iommu-Remove-stack-trace-from-broken-irq-remapping-warning.patch
-
-#rhbz 998732
-ApplyPatch vfio-iommu-Fixed-interaction-of-VFIO_IOMMU_MAP_DMA.patch
-
 #rhbz 993744
 ApplyPatch dm-cache-policy-mq_fix-large-scale-table-allocation-bug.patch
 
 #rhbz 1000439
 ApplyPatch cpupower-Fix-segfault-due-to-incorrect-getopt_long-a.patch
 
-#rhbz 1011714
-ApplyPatch btrfs-relocate-csums-properly-with-prealloc-ext.patch
-
-ApplyPatch drm-qxl-backport-fixes-for-Fedora.patch
-
-ApplyPatch Input-evdev-fall-back-to-vmalloc-for-client-event-buffer.patch
-
 ApplyPatch 0001-staging-imx-drm-Fix-modular-build-of-DRM_IMX_IPUV3.patch
 
 # END OF PATCH APPLICATIONS
@@ -2237,6 +2215,9 @@ fi
 #                                    ||----w |
 #                                    ||     ||
 %changelog
+* Sat Nov 16 2013 Josh Boyer <jwboyer@fedoraproject.org> - 3.13.0-0.rc0.git5.1
+- Linux v3.12-9888-gf63c482
+
 * Thu Nov 14 2013 Josh Boyer <jwboyer@fedoraproject.org> - 3.13.0-0.rc0.git4.1
 - Linux v3.12-8333-g4fbf888
 - Build tmon in kernel-tools
diff --git a/sources b/sources
index 69f65b2b0..3c72736cd 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 cc6ee608854e0da4b64f6c1ff8b6398c  linux-3.12.tar.xz
-05d693b6ed484423101e9625af6c9089  patch-3.12-git4.xz
+5949525d241ffdab192e73aa5dcd7450  patch-3.12-git5.xz
diff --git a/vfio-iommu-Fixed-interaction-of-VFIO_IOMMU_MAP_DMA.patch b/vfio-iommu-Fixed-interaction-of-VFIO_IOMMU_MAP_DMA.patch
deleted file mode 100644
index 0b5fa8a7a..000000000
--- a/vfio-iommu-Fixed-interaction-of-VFIO_IOMMU_MAP_DMA.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From: Julian Stecklina <jsteckli@os.info.tu-dresden.de>
-Subject: [PATCH] vfio, iommu: Fixed interaction of VFIO_IOMMU_MAP_DMA with IOMMU address limits
-
-The BUG_ON in drivers/iommu/intel-iommu.c:785 can be triggered from userspace via
-VFIO by calling the VFIO_IOMMU_MAP_DMA ioctl on a vfio device with any address
-beyond the addressing capabilities of the IOMMU. The problem is that the ioctl code
-calls iommu_iova_to_phys before it calls iommu_map. iommu_map handles the case that
-it gets addresses beyond the addressing capabilities of its IOMMU.
-intel_iommu_iova_to_phys does not.
-
-This patch fixes iommu_iova_to_phys to return NULL for addresses beyond what the
-IOMMU can handle. This in turn causes the ioctl call to fail in iommu_map and
-(correctly) return EFAULT to the user with a helpful warning message in the kernel
-log.
-
-Signed-off-by: Julian Stecklina <jsteckli@os.inf.tu-dresden.de>
----
- drivers/iommu/intel-iommu.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
-index eec0d3e..61303db 100644
---- a/drivers/iommu/intel-iommu.c
-+++ b/drivers/iommu/intel-iommu.c
-@@ -782,7 +782,11 @@ static struct dma_pte *pfn_to_dma_pte(struct dmar_domain *domain,
- 	int offset;
- 
- 	BUG_ON(!domain->pgd);
--	BUG_ON(addr_width < BITS_PER_LONG && pfn >> addr_width);
-+
-+	if (addr_width < BITS_PER_LONG && pfn >> addr_width)
-+		/* Address beyond IOMMU's addressing capabilities. */
-+		return NULL;
-+
- 	parent = domain->pgd;
- 
- 	while (level > 0) {
--- 
-1.8.3.1