diff --git a/0106-qmp-access-the-local-QemuOptsLists-for-drive-option.patch b/0106-qmp-access-the-local-QemuOptsLists-for-drive-option.patch
new file mode 100644
index 0000000..7ffa62a
--- /dev/null
+++ b/0106-qmp-access-the-local-QemuOptsLists-for-drive-option.patch
@@ -0,0 +1,181 @@
+From dd733d7097c126ee3b8ee8a0f4c38b8ccac76504 Mon Sep 17 00:00:00 2001
+From: Amos Kong <akong@redhat.com>
+Date: Fri, 15 Nov 2013 18:53:14 +0100
+Subject: [PATCH] qmp: access the local QemuOptsLists for drive option
+
+Currently we have three QemuOptsList (qemu_common_drive_opts,
+qemu_legacy_drive_opts, and qemu_drive_opts), only qemu_drive_opts
+is added to vm_config_groups[].
+
+This patch changes query-command-line-options to access three local
+QemuOptsLists for drive option, and merge the description items
+together.
+
+Signed-off-by: Amos Kong <akong@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ blockdev.c                 |  1 -
+ include/qemu/config-file.h |  1 +
+ include/sysemu/sysemu.h    |  1 +
+ util/qemu-config.c         | 77 +++++++++++++++++++++++++++++++++++++++++++++-
+ vl.c                       |  2 ++
+ 5 files changed, 80 insertions(+), 2 deletions(-)
+
+diff --git a/blockdev.c b/blockdev.c
+index 097932c..1a6892e 100644
+--- a/blockdev.c
++++ b/blockdev.c
+@@ -45,7 +45,6 @@
+ #include "sysemu/arch_init.h"
+ 
+ static QTAILQ_HEAD(drivelist, DriveInfo) drives = QTAILQ_HEAD_INITIALIZER(drives);
+-extern QemuOptsList qemu_common_drive_opts;
+ extern QemuOptsList qemu_old_drive_opts;
+ 
+ static const char *const if_name[IF_COUNT] = {
+diff --git a/include/qemu/config-file.h b/include/qemu/config-file.h
+index ad4a9e5..508428f 100644
+--- a/include/qemu/config-file.h
++++ b/include/qemu/config-file.h
+@@ -8,6 +8,7 @@
+ QemuOptsList *qemu_find_opts(const char *group);
+ QemuOptsList *qemu_find_opts_err(const char *group, Error **errp);
+ void qemu_add_opts(QemuOptsList *list);
++void qemu_add_drive_opts(QemuOptsList *list);
+ int qemu_set_option(const char *str);
+ int qemu_global_option(const char *str);
+ void qemu_add_globals(void);
+diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h
+index 1a77c99..4962cef 100644
+--- a/include/sysemu/sysemu.h
++++ b/include/sysemu/sysemu.h
+@@ -190,6 +190,7 @@ QemuOpts *qemu_get_machine_opts(void);
+ 
+ bool usb_enabled(bool default_usb);
+ 
++extern QemuOptsList qemu_common_drive_opts;
+ extern QemuOptsList qemu_drive_opts;
+ extern QemuOptsList qemu_chardev_opts;
+ extern QemuOptsList qemu_device_opts;
+diff --git a/util/qemu-config.c b/util/qemu-config.c
+index a59568d..04da942 100644
+--- a/util/qemu-config.c
++++ b/util/qemu-config.c
+@@ -8,6 +8,7 @@
+ #include "qmp-commands.h"
+ 
+ static QemuOptsList *vm_config_groups[32];
++static QemuOptsList *drive_config_groups[4];
+ 
+ static QemuOptsList *find_list(QemuOptsList **lists, const char *group,
+                                Error **errp)
+@@ -77,6 +78,59 @@ static CommandLineParameterInfoList *query_option_descs(const QemuOptDesc *desc)
+     return param_list;
+ }
+ 
++/* remove repeated entry from the info list */
++static void cleanup_infolist(CommandLineParameterInfoList *head)
++{
++    CommandLineParameterInfoList *pre_entry, *cur, *del_entry;
++
++    cur = head;
++    while (cur->next) {
++        pre_entry = head;
++        while (pre_entry != cur->next) {
++            if (!strcmp(pre_entry->value->name, cur->next->value->name)) {
++                del_entry = cur->next;
++                cur->next = cur->next->next;
++                g_free(del_entry);
++                break;
++            }
++            pre_entry = pre_entry->next;
++        }
++        cur = cur->next;
++    }
++}
++
++/* merge the description items of two parameter infolists */
++static void connect_infolist(CommandLineParameterInfoList *head,
++                             CommandLineParameterInfoList *new)
++{
++    CommandLineParameterInfoList *cur;
++
++    cur = head;
++    while (cur->next) {
++        cur = cur->next;
++    }
++    cur->next = new;
++}
++
++/* access all the local QemuOptsLists for drive option */
++static CommandLineParameterInfoList *get_drive_infolist(void)
++{
++    CommandLineParameterInfoList *head = NULL, *cur;
++    int i;
++
++    for (i = 0; drive_config_groups[i] != NULL; i++) {
++        if (!head) {
++            head = query_option_descs(drive_config_groups[i]->desc);
++        } else {
++            cur = query_option_descs(drive_config_groups[i]->desc);
++            connect_infolist(head, cur);
++        }
++    }
++    cleanup_infolist(head);
++
++    return head;
++}
++
+ CommandLineOptionInfoList *qmp_query_command_line_options(bool has_option,
+                                                           const char *option,
+                                                           Error **errp)
+@@ -89,7 +143,12 @@ CommandLineOptionInfoList *qmp_query_command_line_options(bool has_option,
+         if (!has_option || !strcmp(option, vm_config_groups[i]->name)) {
+             info = g_malloc0(sizeof(*info));
+             info->option = g_strdup(vm_config_groups[i]->name);
+-            info->parameters = query_option_descs(vm_config_groups[i]->desc);
++            if (!strcmp("drive", vm_config_groups[i]->name)) {
++                info->parameters = get_drive_infolist();
++            } else {
++                info->parameters =
++                    query_option_descs(vm_config_groups[i]->desc);
++            }
+             entry = g_malloc0(sizeof(*entry));
+             entry->value = info;
+             entry->next = conf_list;
+@@ -109,6 +168,22 @@ QemuOptsList *qemu_find_opts_err(const char *group, Error **errp)
+     return find_list(vm_config_groups, group, errp);
+ }
+ 
++void qemu_add_drive_opts(QemuOptsList *list)
++{
++    int entries, i;
++
++    entries = ARRAY_SIZE(drive_config_groups);
++    entries--; /* keep list NULL terminated */
++    for (i = 0; i < entries; i++) {
++        if (drive_config_groups[i] == NULL) {
++            drive_config_groups[i] = list;
++            return;
++        }
++    }
++    fprintf(stderr, "ran out of space in drive_config_groups");
++    abort();
++}
++
+ void qemu_add_opts(QemuOptsList *list)
+ {
+     int entries, i;
+diff --git a/vl.c b/vl.c
+index 2160933..63ecf16 100644
+--- a/vl.c
++++ b/vl.c
+@@ -2942,6 +2942,8 @@ int main(int argc, char **argv, char **envp)
+     module_call_init(MODULE_INIT_QOM);
+ 
+     qemu_add_opts(&qemu_drive_opts);
++    qemu_add_drive_opts(&qemu_common_drive_opts);
++    qemu_add_drive_opts(&qemu_drive_opts);
+     qemu_add_opts(&qemu_chardev_opts);
+     qemu_add_opts(&qemu_device_opts);
+     qemu_add_opts(&qemu_netdev_opts);
diff --git a/0107-seccomp-fine-tuning-whitelist-by-adding-times.patch b/0107-seccomp-fine-tuning-whitelist-by-adding-times.patch
new file mode 100644
index 0000000..6818b37
--- /dev/null
+++ b/0107-seccomp-fine-tuning-whitelist-by-adding-times.patch
@@ -0,0 +1,28 @@
+From aafda3de0ce3589fa69472bd4a1782c65c8c7ade Mon Sep 17 00:00:00 2001
+From: Eduardo Otubo <otubo@linux.vnet.ibm.com>
+Date: Tue, 24 Sep 2013 14:50:44 -0300
+Subject: [PATCH] seccomp: fine tuning whitelist by adding times()
+
+This was causing Qemu process to hang when using -sandbox on as
+discribed on RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1004175
+
+Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
+Tested-by: Paul Moore <pmoore@redhat.com>
+Acked-by: Paul Moore <pmoore@redhat.com>
+(cherry picked from commit c236f4519c9838801798f3705c17dce9ab9e3b9d)
+---
+ qemu-seccomp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/qemu-seccomp.c b/qemu-seccomp.c
+index 37d38f8..69cee44 100644
+--- a/qemu-seccomp.c
++++ b/qemu-seccomp.c
+@@ -90,6 +90,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
+     { SCMP_SYS(getuid), 245 },
+     { SCMP_SYS(geteuid), 245 },
+     { SCMP_SYS(timer_create), 245 },
++    { SCMP_SYS(times), 245 },
+     { SCMP_SYS(exit), 245 },
+     { SCMP_SYS(clock_gettime), 245 },
+     { SCMP_SYS(time), 245 },
diff --git a/qemu.spec b/qemu.spec
index 18937f1..1c04dab 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -139,7 +139,7 @@
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 1.6.1
-Release: 1%{?dist}
+Release: 2%{?dist}
 Epoch: 2
 License: GPLv2+ and LGPLv2+ and BSD
 Group: Development/Tools
@@ -216,6 +216,11 @@ Patch0103: 0103-hw-9pfs-Fix-errno-value-for-xattr-functions.patch
 Patch0104: 0104-Fix-pc-migration-from-qemu-1.5.patch
 # Reduce CPU usage when audio is playing (bz #1017644)
 Patch0105: 0105-audio-honor-QEMU_AUDIO_TIMER_PERIOD-instead-of-wakin.patch
+# Fix drive discard options via libvirt (bz #1029953)
+# Patch queued upstream
+Patch0106: 0106-qmp-access-the-local-QemuOptsLists-for-drive-option.patch
+# Fix process exit with -sandbox on (bz #1027421)
+Patch0107: 0107-seccomp-fine-tuning-whitelist-by-adding-times.patch
 
 BuildRequires: SDL-devel
 BuildRequires: zlib-devel
@@ -764,6 +769,11 @@ CAC emulation development files.
 %patch0104 -p1
 # Reduce CPU usage when audio is playing (bz #1017644)
 %patch0105 -p1
+# Fix drive discard options via libvirt (bz #1029953)
+# Patch queued upstream
+%patch0106 -p1
+# Fix process exit with -sandbox on (bz #1027421)
+%patch0107 -p1
 
 
 %build
@@ -1471,6 +1481,10 @@ getent passwd qemu >/dev/null || \
 %endif
 
 %changelog
+* Sun Nov 17 2013 Cole Robinson <crobinso@redhat.com> - 2:1.6.1-2
+- Fix drive discard options via libvirt (bz #1029953)
+- Fix process exit with -sandbox on (bz #1027421)
+
 * Tue Nov 05 2013 Cole Robinson <crobinso@redhat.com> - 2:1.6.1-1
 - Reduce CPU usage when audio is playing (bz #1017644)
 - Base on qemu 1.6.1 tarball