diff --git a/drm-cirrus-qemu-fix-crash.patch b/drm-cirrus-qemu-fix-crash.patch
new file mode 100644
index 000000000..be6f13509
--- /dev/null
+++ b/drm-cirrus-qemu-fix-crash.patch
@@ -0,0 +1,101 @@
+diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.c b/drivers/gpu/drm/cirrus/cirrus_drv.c
+index d703823..7053140 100644
+--- a/drivers/gpu/drm/cirrus/cirrus_drv.c
++++ b/drivers/gpu/drm/cirrus/cirrus_drv.c
+@@ -35,9 +35,28 @@ static DEFINE_PCI_DEVICE_TABLE(pciidlist) = {
+ 	{0,}
+ };
+ 
++
++static void cirrus_kick_out_firmware_fb(struct pci_dev *pdev)
++{
++	struct apertures_struct *ap;
++	bool primary = false;
++
++	ap = alloc_apertures(1);
++	ap->ranges[0].base = pci_resource_start(pdev, 0);
++	ap->ranges[0].size = pci_resource_len(pdev, 0);
++
++#ifdef CONFIG_X86
++	primary = pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW;
++#endif
++	remove_conflicting_framebuffers(ap, "cirrusdrmfb", primary);
++	kfree(ap);
++}
++
+ static int __devinit
+ cirrus_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
++	cirrus_kick_out_firmware_fb(pdev);
++
+ 	return drm_get_pci_dev(pdev, ent, &driver);
+ }
+ 
+diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.h b/drivers/gpu/drm/cirrus/cirrus_drv.h
+index 21bdfa8..64ea597 100644
+--- a/drivers/gpu/drm/cirrus/cirrus_drv.h
++++ b/drivers/gpu/drm/cirrus/cirrus_drv.h
+@@ -145,7 +145,7 @@ struct cirrus_device {
+ 		struct ttm_bo_device bdev;
+ 		atomic_t validate_sequence;
+ 	} ttm;
+-
++	bool mm_inited;
+ };
+ 
+ 
+diff --git a/drivers/gpu/drm/cirrus/cirrus_ttm.c b/drivers/gpu/drm/cirrus/cirrus_ttm.c
+index 2ebcd11..50e170f 100644
+--- a/drivers/gpu/drm/cirrus/cirrus_ttm.c
++++ b/drivers/gpu/drm/cirrus/cirrus_ttm.c
+@@ -275,12 +275,17 @@ int cirrus_mm_init(struct cirrus_device *cirrus)
+ 				    pci_resource_len(dev->pdev, 0),
+ 				    DRM_MTRR_WC);
+ 
++	cirrus->mm_inited = true;
+ 	return 0;
+ }
+ 
+ void cirrus_mm_fini(struct cirrus_device *cirrus)
+ {
+ 	struct drm_device *dev = cirrus->dev;
++
++	if (!cirrus->mm_inited)
++		return;
++
+ 	ttm_bo_device_release(&cirrus->ttm.bdev);
+ 
+ 	cirrus_ttm_global_release(cirrus);
+diff --git a/drivers/gpu/drm/mgag200/mgag200_drv.c b/drivers/gpu/drm/mgag200/mgag200_drv.c
+index 3c8e04f..93e832d 100644
+--- a/drivers/gpu/drm/mgag200/mgag200_drv.c
++++ b/drivers/gpu/drm/mgag200/mgag200_drv.c
+@@ -41,9 +41,28 @@ static DEFINE_PCI_DEVICE_TABLE(pciidlist) = {
+ 
+ MODULE_DEVICE_TABLE(pci, pciidlist);
+ 
++static void mgag200_kick_out_firmware_fb(struct pci_dev *pdev)
++{
++	struct apertures_struct *ap;
++	bool primary = false;
++
++	ap = alloc_apertures(1);
++	ap->ranges[0].base = pci_resource_start(pdev, 0);
++	ap->ranges[0].size = pci_resource_len(pdev, 0);
++
++#ifdef CONFIG_X86
++	primary = pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW;
++#endif
++	remove_conflicting_framebuffers(ap, "mgag200drmfb", primary);
++	kfree(ap);
++}
++
++
+ static int __devinit
+ mga_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
++	mgag200_kick_out_firmware_fb(pdev);
++
+ 	return drm_get_pci_dev(pdev, ent, &driver);
+ }
+ 
diff --git a/kernel.spec b/kernel.spec
index 65c1b4d9a..66579de1f 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -62,7 +62,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 1
+%global baserelease 2
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -749,6 +749,9 @@ Patch22000: weird-root-dentry-name-debug.patch
 #selinux ptrace child permissions
 Patch22001: selinux-apply-different-permission-to-ptrace-child.patch
 
+#rhbz 826983
+Patch22002: drm-cirrus-qemu-fix-crash.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1444,6 +1447,9 @@ ApplyPatch selinux-apply-different-permission-to-ptrace-child.patch
 #Highbank clock functions
 ApplyPatch highbank-export-clock-functions.patch 
 
+# rhbz 826983
+ApplyPatch drm-cirrus-qemu-fix-crash.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2294,6 +2300,9 @@ fi
 #                 ||----w |
 #                 ||     ||
 %changelog
+* Thu May 31 2012 Josh Boyer <jwboyer@redhat.com> - 3.5.0-0.rc0.git10.2
+- Fix crash in cirrus qemu driver from Dave Airlie (rhbz 826983)
+
 * Thu May 31 2012 Josh Boyer <jwboyer@redhat.com> - 3.5.0-0.rc0.git10.1
 - Linux v3.4-9208-gaf56e0a