diff --git a/.gitignore b/.gitignore
index 87fe7ca..dfcc152 100644
--- a/.gitignore
+++ b/.gitignore
@@ -31,3 +31,4 @@
 /qemu-4.0.0-rc2.tar.xz
 /qemu-4.0.0-rc3.tar.xz
 /qemu-4.0.0.tar.xz
+/qemu-4.1.0-rc0.tar.xz
diff --git a/0001-NOT-UPSTREAM-Build-fix-with-latest-kernel.patch b/0001-NOT-UPSTREAM-Build-fix-with-latest-kernel.patch
new file mode 100644
index 0000000..3ae7186
--- /dev/null
+++ b/0001-NOT-UPSTREAM-Build-fix-with-latest-kernel.patch
@@ -0,0 +1,27 @@
+From f92845e4c93da43feb52261916a6a979eff7bd0d Mon Sep 17 00:00:00 2001
+From: Cole Robinson <crobinso@redhat.com>
+Date: Thu, 20 Jun 2019 17:20:13 -0400
+Subject: [PATCH] NOT UPSTREAM: Build fix with latest kernel
+
+From here: https://lkml.org/lkml/2019/6/3/988
+
+Some attempts at patches have been posted, check qemu thread logs
+for SIOCGSTAMP
+
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ linux-user/syscall.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
+index 39a37496fe..830dc876ed 100644
+--- a/linux-user/syscall.c
++++ b/linux-user/syscall.c
+@@ -34,6 +34,7 @@
+ #include <sys/resource.h>
+ #include <sys/swap.h>
+ #include <linux/capability.h>
++#include <linux/sockios.h>
+ #include <sched.h>
+ #include <sys/timex.h>
+ #include <sys/socket.h>
diff --git a/0001-Revert-target-i386-kvm-add-VMX-migration-blocker.patch b/0001-Revert-target-i386-kvm-add-VMX-migration-blocker.patch
deleted file mode 100644
index c550be2..0000000
--- a/0001-Revert-target-i386-kvm-add-VMX-migration-blocker.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From: Cole Robinson <crobinso@redhat.com>
-Date: Tue, 16 Apr 2019 20:14:12 -0400
-Subject: [PATCH] Revert "target/i386: kvm: add VMX migration blocker"
-
-This reverts commit d98f26073bebddcd3da0ba1b86c3a34e840c0fb8.
-
-As is, it rejects libvirt managedsave and virt-manager snapshots
-for default installed VMs on intel hosts. Upstream Paolo says that
-the missing kernel bits are already queued up, and until then it's
-fine to revert this.
-
-https://lists.gnu.org/archive/html/qemu-devel/2019-04/msg02326.html
----
- target/i386/kvm.c | 12 ------------
- 1 file changed, 12 deletions(-)
-
-diff --git a/target/i386/kvm.c b/target/i386/kvm.c
-index 3b29ce5c0d..6ad450d9f1 100644
---- a/target/i386/kvm.c
-+++ b/target/i386/kvm.c
-@@ -906,7 +906,6 @@ static int hyperv_init_vcpu(X86CPU *cpu)
- }
- 
- static Error *invtsc_mig_blocker;
--static Error *vmx_mig_blocker;
- 
- #define KVM_MAX_CPUID_ENTRIES  100
- 
-@@ -1270,17 +1269,6 @@ int kvm_arch_init_vcpu(CPUState *cs)
-                                   !!(c->ecx & CPUID_EXT_SMX);
-     }
- 
--    if ((env->features[FEAT_1_ECX] & CPUID_EXT_VMX) && !vmx_mig_blocker) {
--        error_setg(&vmx_mig_blocker,
--                   "Nested VMX virtualization does not support live migration yet");
--        r = migrate_add_blocker(vmx_mig_blocker, &local_err);
--        if (local_err) {
--            error_report_err(local_err);
--            error_free(vmx_mig_blocker);
--            return r;
--        }
--    }
--
-     if (env->mcg_cap & MCG_LMCE_P) {
-         has_msr_mcg_ext_ctl = has_msr_feature_control = true;
-     }
diff --git a/0002-target-i386-define-md-clear-bit.patch b/0002-target-i386-define-md-clear-bit.patch
deleted file mode 100644
index 57289e4..0000000
--- a/0002-target-i386-define-md-clear-bit.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Wed, 15 May 2019 15:10:10 +0100
-Subject: [PATCH] target/i386: define md-clear bit
-
-md-clear is a new CPUID bit which is set when microcode provides the
-mechanism to invoke a flush of various exploitable CPU buffers by invoking
-the VERW instruction.
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-Id: <20190515141011.5315-2-berrange@redhat.com>
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
-(cherry picked from commit b2ae52101fca7f9547ac2f388085dbc58f8fe1c0)
----
- target/i386/cpu.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index d6bb57d210..4ea78a4939 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1076,7 +1076,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-         .feat_names = {
-             NULL, NULL, "avx512-4vnniw", "avx512-4fmaps",
-             NULL, NULL, NULL, NULL,
--            NULL, NULL, NULL, NULL,
-+            NULL, NULL, "md-clear", NULL,
-             NULL, NULL, NULL, NULL,
-             NULL, NULL, NULL, NULL,
-             NULL, NULL, NULL, NULL,
diff --git a/0003-qxl-check-release-info-object.patch b/0003-qxl-check-release-info-object.patch
deleted file mode 100644
index d561406..0000000
--- a/0003-qxl-check-release-info-object.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Thu, 25 Apr 2019 12:05:34 +0530
-Subject: [PATCH] qxl: check release info object
-
-When releasing spice resources in release_resource() routine,
-if release info object 'ext.info' is null, it leads to null
-pointer dereference. Add check to avoid it.
-
-Reported-by: Bugs SysSec <bugs-syssec@rub.de>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Message-id: 20190425063534.32747-1-ppandit@redhat.com
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit d52680fc932efb8a2f334cc6993e705ed1e31e99)
----
- hw/display/qxl.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/hw/display/qxl.c b/hw/display/qxl.c
-index c8ce5781e0..632923add2 100644
---- a/hw/display/qxl.c
-+++ b/hw/display/qxl.c
-@@ -777,6 +777,9 @@ static void interface_release_resource(QXLInstance *sin,
-     QXLReleaseRing *ring;
-     uint64_t *item, id;
- 
-+    if (!ext.info) {
-+        return;
-+    }
-     if (ext.group_id == MEMSLOT_GROUP_HOST) {
-         /* host group -> vga mode update request */
-         QXLCommandExt *cmdext = (void *)(intptr_t)(ext.info->id);
diff --git a/0004-target-ppc-Fix-lxvw4x-lxvh8x-and-lxvb16x.patch b/0004-target-ppc-Fix-lxvw4x-lxvh8x-and-lxvb16x.patch
deleted file mode 100644
index e3cdb99..0000000
--- a/0004-target-ppc-Fix-lxvw4x-lxvh8x-and-lxvb16x.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From: Anton Blanchard <anton@ozlabs.org>
-Date: Fri, 24 May 2019 07:53:45 +0100
-Subject: [PATCH] target/ppc: Fix lxvw4x, lxvh8x and lxvb16x
-
-During the conversion these instructions were incorrectly treated as
-stores. We need to use set_cpu_vsr* and not get_cpu_vsr*.
-
-Fixes: 8b3b2d75c7c0 ("introduce get_cpu_vsr{l,h}() and set_cpu_vsr{l,h}() helpers for VSR register access")
-Signed-off-by: Anton Blanchard <anton@ozlabs.org>
-Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
-Tested-by: Greg Kurz <groug@kaod.org>
-Reviewed-by: Greg Kurz <groug@kaod.org>
-Message-Id: <20190524065345.25591-1-mark.cave-ayland@ilande.co.uk>
-Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
-(cherry picked from commit 2a1224359008e23b051b7b45be4789afa0269f8c)
----
- target/ppc/translate/vsx-impl.inc.c | 13 +++++++------
- 1 file changed, 7 insertions(+), 6 deletions(-)
-
-diff --git a/target/ppc/translate/vsx-impl.inc.c b/target/ppc/translate/vsx-impl.inc.c
-index 489b2436e4..1df688cc32 100644
---- a/target/ppc/translate/vsx-impl.inc.c
-+++ b/target/ppc/translate/vsx-impl.inc.c
-@@ -102,8 +102,7 @@ static void gen_lxvw4x(DisasContext *ctx)
-     }
-     xth = tcg_temp_new_i64();
-     xtl = tcg_temp_new_i64();
--    get_cpu_vsrh(xth, xT(ctx->opcode));
--    get_cpu_vsrl(xtl, xT(ctx->opcode));
-+
-     gen_set_access_type(ctx, ACCESS_INT);
-     EA = tcg_temp_new();
- 
-@@ -126,6 +125,8 @@ static void gen_lxvw4x(DisasContext *ctx)
-         tcg_gen_addi_tl(EA, EA, 8);
-         tcg_gen_qemu_ld_i64(xtl, EA, ctx->mem_idx, MO_BEQ);
-     }
-+    set_cpu_vsrh(xT(ctx->opcode), xth);
-+    set_cpu_vsrl(xT(ctx->opcode), xtl);
-     tcg_temp_free(EA);
-     tcg_temp_free_i64(xth);
-     tcg_temp_free_i64(xtl);
-@@ -185,8 +186,6 @@ static void gen_lxvh8x(DisasContext *ctx)
-     }
-     xth = tcg_temp_new_i64();
-     xtl = tcg_temp_new_i64();
--    get_cpu_vsrh(xth, xT(ctx->opcode));
--    get_cpu_vsrl(xtl, xT(ctx->opcode));
-     gen_set_access_type(ctx, ACCESS_INT);
- 
-     EA = tcg_temp_new();
-@@ -197,6 +196,8 @@ static void gen_lxvh8x(DisasContext *ctx)
-     if (ctx->le_mode) {
-         gen_bswap16x8(xth, xtl, xth, xtl);
-     }
-+    set_cpu_vsrh(xT(ctx->opcode), xth);
-+    set_cpu_vsrl(xT(ctx->opcode), xtl);
-     tcg_temp_free(EA);
-     tcg_temp_free_i64(xth);
-     tcg_temp_free_i64(xtl);
-@@ -214,14 +215,14 @@ static void gen_lxvb16x(DisasContext *ctx)
-     }
-     xth = tcg_temp_new_i64();
-     xtl = tcg_temp_new_i64();
--    get_cpu_vsrh(xth, xT(ctx->opcode));
--    get_cpu_vsrl(xtl, xT(ctx->opcode));
-     gen_set_access_type(ctx, ACCESS_INT);
-     EA = tcg_temp_new();
-     gen_addr_reg_index(ctx, EA);
-     tcg_gen_qemu_ld_i64(xth, EA, ctx->mem_idx, MO_BEQ);
-     tcg_gen_addi_tl(EA, EA, 8);
-     tcg_gen_qemu_ld_i64(xtl, EA, ctx->mem_idx, MO_BEQ);
-+    set_cpu_vsrh(xT(ctx->opcode), xth);
-+    set_cpu_vsrl(xT(ctx->opcode), xtl);
-     tcg_temp_free(EA);
-     tcg_temp_free_i64(xth);
-     tcg_temp_free_i64(xtl);
diff --git a/0005-NOT-UPSTREAM-Build-fix-with-latest-kernel.patch b/0005-NOT-UPSTREAM-Build-fix-with-latest-kernel.patch
deleted file mode 100644
index 4a6e49a..0000000
--- a/0005-NOT-UPSTREAM-Build-fix-with-latest-kernel.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From: Cole Robinson <crobinso@redhat.com>
-Date: Thu, 20 Jun 2019 17:20:13 -0400
-Subject: [PATCH] NOT UPSTREAM: Build fix with latest kernel
-
-From here: https://lkml.org/lkml/2019/6/3/988
-
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- linux-user/syscall.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/linux-user/syscall.c b/linux-user/syscall.c
-index 96cd4bf86d..c7625858eb 100644
---- a/linux-user/syscall.c
-+++ b/linux-user/syscall.c
-@@ -34,6 +34,7 @@
- #include <sys/resource.h>
- #include <sys/swap.h>
- #include <linux/capability.h>
-+#include <linux/sockios.h>
- #include <sched.h>
- #include <sys/timex.h>
- #include <sys/socket.h>
diff --git a/qemu.spec b/qemu.spec
index ac3778a..9debed0 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -138,7 +138,7 @@
 %{obsoletes_block_rbd}
 
 # Release candidate version tracking
-# global rcver rc3
+%global rcver rc0
 %if 0%{?rcver:1}
 %global rcrel .%{rcver}
 %global rcstr -%{rcver}
@@ -147,8 +147,8 @@
 
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
-Version: 4.0.0
-Release: 5%{?rcrel}%{?dist}
+Version: 4.1.0
+Release: 0.1%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -172,20 +172,9 @@ Source20: kvm-x86.modprobe.conf
 # /etc/security/limits.d/95-kvm-ppc64-memlock.conf
 Source21: 95-kvm-ppc64-memlock.conf
 
-# Don't block migration with nested VMX (bz #1697997)
-# Not upstream: temporary workaround until kernel supports lands for nested
-# VMX migration
-Patch0001: 0001-Revert-target-i386-kvm-add-VMX-migration-blocker.patch
-# CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
-Patch0002: 0002-target-i386-define-md-clear-bit.patch
-# CVE-2019-12155: qxl: null pointer dereference while releasing spice
-# resources (bz #1712727, bz #1712670)
-Patch0003: 0003-qxl-check-release-info-object.patch
-# qemu-4.0.0-2.fc31 ppc64le: rpm hash calculation buggy (bz #1715017)
-Patch0004: 0004-target-ppc-Fix-lxvw4x-lxvh8x-and-lxvb16x.patch
 # Fix rawhide build (bz #1718926)
-# Not upstream, might be a kernel fix
-Patch0005: 0005-NOT-UPSTREAM-Build-fix-with-latest-kernel.patch
+# Not upstream, some mailing list patches have been proposed
+Patch0001: 0001-NOT-UPSTREAM-Build-fix-with-latest-kernel.patch
 
 # documentation deps
 BuildRequires: texinfo
@@ -272,7 +261,7 @@ BuildRequires: glusterfs-api-devel >= 3.4.0
 # Needed for usb passthrough for qemu >= 1.5
 BuildRequires: libusbx-devel
 # SSH block driver
-BuildRequires: libssh2-devel
+BuildRequires: libssh-devel
 # GTK frontend
 BuildRequires: gtk3-devel
 BuildRequires: vte291-devel
@@ -298,7 +287,7 @@ BuildRequires: libtasn1-devel
 BuildRequires: libcacard-devel >= 2.5.0
 # qemu 2.5: virgl 3d support
 BuildRequires: virglrenderer-devel
-# qemu 2.6: Needed for gtk GL support
+# qemu 2.6: Needed for gtk GL support, vhost-user-gpu
 BuildRequires: mesa-libgbm-devel
 # qemu 2.11: preferred disassembler for TCG
 BuildRequires: capstone-devel
@@ -1004,7 +993,7 @@ run_configure_disable_everything() {
         --disable-libiscsi \
         --disable-libnfs \
         --disable-libpmem \
-        --disable-libssh2 \
+        --disable-libssh \
         --disable-libusb \
         --disable-libxml2 \
         --disable-linux-aio \
@@ -1069,6 +1058,24 @@ run_configure_disable_everything() {
 }
 
 
+
+# Build for qemu-user-static
+%if %{user_static}
+mkdir build-static
+pushd build-static
+
+run_configure_disable_everything \
+    --disable-pie \
+    --enable-linux-user \
+    --static
+
+make V=1 %{?_smp_mflags} $buildldflags
+
+popd
+%endif # user_static
+
+
+
 # Build for non-static qemu-*
 mkdir build-dynamic
 pushd build-dynamic
@@ -1099,22 +1106,6 @@ make V=1 %{?_smp_mflags} $buildldflags
 popd
 
 
-# Build for qemu-user-static
-%if %{user_static}
-mkdir build-static
-pushd build-static
-
-run_configure_disable_everything \
-    --disable-pie \
-    --enable-linux-user \
-    --static
-
-make V=1 %{?_smp_mflags} $buildldflags
-
-popd
-%endif # user_static
-
-
 
 
 %install
@@ -1240,6 +1231,9 @@ rm -rf %{buildroot}%{_datadir}/%{name}/bios.bin
 rm -rf %{buildroot}%{_datadir}/%{name}/bios-256k.bin
 # Provided by package sgabios
 rm -rf %{buildroot}%{_datadir}/%{name}/sgabios.bin
+# Provided by package edk2
+rm -rf %{buildroot}%{_datadir}/%{name}/edk2*
+rm -rf %{buildroot}%{_datadir}/%{name}/firmware/*edk2*.json
 
 pxe_link() {
   ln -s ../ipxe/$2.rom %{buildroot}%{_datadir}/%{name}/pxe-$1.rom
@@ -1267,6 +1261,7 @@ rom_link ../seavgabios/vgabios-vmware.bin vgabios-vmware.bin
 rom_link ../seavgabios/vgabios-virtio.bin vgabios-virtio.bin
 rom_link ../seavgabios/vgabios-ramfb.bin vgabios-ramfb.bin
 rom_link ../seavgabios/vgabios-bochs-display.bin vgabios-bochs-display.bin
+rom_link ../seavgabios/vgabios-ati.bin vgabios-ati.bin
 rom_link ../seabios/bios.bin bios.bin
 rom_link ../seabios/bios-256k.bin bios-256k.bin
 rom_link ../sgabios/sgabios.bin sgabios.bin
@@ -1377,6 +1372,7 @@ getent passwd qemu >/dev/null || \
 %doc %{qemudocdir}/qemu-qmp-ref.txt
 %doc %{qemudocdir}/README
 %doc %{qemudocdir}/interop
+%doc %{qemudocdir}/specs
 %dir %{_datadir}/%{name}/
 %{_datadir}/applications/qemu.desktop
 %{_datadir}/icons/hicolor/*/apps/*
@@ -1390,6 +1386,7 @@ getent passwd qemu >/dev/null || \
 %{_datadir}/%{name}/vgabios-virtio.bin
 %{_datadir}/%{name}/vgabios-ramfb.bin
 %{_datadir}/%{name}/vgabios-bochs-display.bin
+%{_datadir}/%{name}/vgabios-ati.bin
 %{_datadir}/%{name}/pxe-e1000.rom
 %{_datadir}/%{name}/efi-e1000.rom
 %{_datadir}/%{name}/pxe-e1000e.rom
@@ -1406,6 +1403,7 @@ getent passwd qemu >/dev/null || \
 %{_datadir}/%{name}/efi-virtio.rom
 %{_datadir}/%{name}/pxe-vmxnet3.rom
 %{_datadir}/%{name}/efi-vmxnet3.rom
+%{_datadir}/%{name}/vhost-user/50-qemu-gpu.json
 %{_mandir}/man1/qemu.1*
 %{_mandir}/man1/qemu-trace-stap.1*
 %{_mandir}/man1/virtfs-proxy-helper.1*
@@ -1422,6 +1420,7 @@ getent passwd qemu >/dev/null || \
 %{_unitdir}/qemu-pr-helper.service
 %{_unitdir}/qemu-pr-helper.socket
 %attr(4755, root, root) %{_libexecdir}/qemu-bridge-helper
+%{_libexecdir}/vhost-user-gpu
 %config(noreplace) %{_sysconfdir}/sasl2/qemu.conf
 %dir %{_sysconfdir}/qemu
 %config(noreplace) %{_sysconfdir}/qemu/bridge.conf
@@ -1853,6 +1852,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Thu Jul 11 2019 Cole Robinson <aintdiscole@gmail.com> - 2:4.1.0-0.1.rc0
+- Update to qemu-4.1.0-rc0
+
 * Fri Jun 28 2019 Kevin Fenzi <kevin@scrye.com> - 2:4.0.0-5
 - Rebuild for new brltty.
 
diff --git a/sources b/sources
index e43b6a0..84145f7 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (qemu-4.0.0.tar.xz) = 952e94194ce9e64c15388c59035cb31fb9f761d30095c2fb9441012b609c18c9976285727b93bf37b95e15675802d73f8e1c4619ebecd23606675bb503646b13
+SHA512 (qemu-4.1.0-rc0.tar.xz) = 12758acc4a9f9875a566c499751dbff356b5e7f39002dfc6d457483ab6a7f360fc8306ace76d501a80eb5ae4bbece9ae6fa2e81a81668bcbcbe8f95cfa90e4a9