diff --git a/qemu-add-ksm-support.patch b/qemu-add-ksm-support.patch
index efee853..c7254f7 100644
--- a/qemu-add-ksm-support.patch
+++ b/qemu-add-ksm-support.patch
@@ -1,4 +1,4 @@
-From 729b681039015c718e476b8f294480b179ed726d Mon Sep 17 00:00:00 2001
+From 4d64a615f69458c202561fcc01e8e0505fa46ee9 Mon Sep 17 00:00:00 2001
 From: Izik Eidus <ieidus@redhat.com>
 Date: Tue, 28 Jul 2009 19:14:26 +0300
 Subject: [PATCH] kvm userspace: ksm support
@@ -13,10 +13,10 @@ Fedora-patch: qemu-add-ksm-support.patch
  1 files changed, 3 insertions(+), 0 deletions(-)
 
 diff --git a/exec.c b/exec.c
-index 2134697..88bcff5 100644
+index 0655b4b..b93f7b8 100644
 --- a/exec.c
 +++ b/exec.c
-@@ -2578,6 +2578,9 @@ ram_addr_t qemu_ram_alloc(ram_addr_t size)
+@@ -2579,6 +2579,9 @@ ram_addr_t qemu_ram_alloc(ram_addr_t size)
      new_block->host = file_ram_alloc(size, mem_path);
      if (!new_block->host) {
          new_block->host = qemu_vmalloc(size);
diff --git a/qemu-allow-pulseaudio-to-be-the-default.patch b/qemu-allow-pulseaudio-to-be-the-default.patch
index d4c9995..7ff5477 100644
--- a/qemu-allow-pulseaudio-to-be-the-default.patch
+++ b/qemu-allow-pulseaudio-to-be-the-default.patch
@@ -1,4 +1,4 @@
-From 01c3198a8f0d933c9b219acaf087c675d729bbf7 Mon Sep 17 00:00:00 2001
+From 4f5019c88e710be0aa597c81017b683d494c532d Mon Sep 17 00:00:00 2001
 From: Mark McLoughlin <markmc@redhat.com>
 Date: Fri, 4 Sep 2009 11:24:03 +0100
 Subject: [PATCH] Allow pulseaudio backend to be the default
diff --git a/qemu-bios-bigger-roms.patch b/qemu-bios-bigger-roms.patch
index 582a14c..91ca8f2 100644
--- a/qemu-bios-bigger-roms.patch
+++ b/qemu-bios-bigger-roms.patch
@@ -1,4 +1,4 @@
-From 7f871498235ac7591bd4398a745735081290c1a2 Mon Sep 17 00:00:00 2001
+From f751c8937a81116469149357359c767a71ee8ebd Mon Sep 17 00:00:00 2001
 From: Glauber Costa <glommer@redhat.com>
 Date: Wed, 24 Jun 2009 14:31:41 +0100
 Subject: [PATCH] compute checksum for roms bigger than a segment
diff --git a/qemu-fix-extboot-signrom.patch b/qemu-fix-extboot-signrom.patch
deleted file mode 100644
index c2e9f29..0000000
--- a/qemu-fix-extboot-signrom.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From ee595f99ba7ff80b46a736a06f7e53998d926563 Mon Sep 17 00:00:00 2001
-From: Alexander Graf <agraf@suse.de>
-Date: Sat, 1 Aug 2009 11:48:31 +0200
-Subject: [PATCH] Fix checksum writing in signboot.sh
-
-The printf command takes an octal value after \, so we have to convert
-our decimal representation to octal first and then write it.
-
-This unbreaks extboot signing. Multiboot wasn't affected yet because
-the checksum was < 8.
-
-Spotted and first patch by Glauber Costa <glommer@redhat.com>.
-Printf idea by Paolo Bonzini <bonzini@gnu.org>.
-
-(cherry picked from commit d8b69b34761f7b3fb8f476712b631d1dd3f1b2a5)
-
-Signed-off-by: Alexander Graf <agraf@suse.de>
-CC: Glauber Costa <glommer@redhat.com>
-CC: Paolo Bonzini <bonzini@gnu.org>
-CC: Jan Ondrej <ondrejj@salstar.sk>
-Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
-Signed-off-by: Mark McLoughlin <markmc@redhat.com>
-Fedora-patch: qemu-fix-extboot-signrom.patch
----
- pc-bios/optionrom/signrom.sh |    3 ++-
- 1 files changed, 2 insertions(+), 1 deletions(-)
-
-diff --git a/pc-bios/optionrom/signrom.sh b/pc-bios/optionrom/signrom.sh
-index 4322811..975b27d 100755
---- a/pc-bios/optionrom/signrom.sh
-+++ b/pc-bios/optionrom/signrom.sh
-@@ -39,7 +39,8 @@ done
- 
- sum=$(( $sum % 256 ))
- sum=$(( 256 - $sum ))
-+sum_octal=$( printf "%o" $sum )
- 
- # and write the output file
- cp "$1" "$2"
--printf "\\$sum" | dd of="$2" bs=1 count=1 seek=$size conv=notrunc 2>/dev/null
-+printf "\\$sum_octal" | dd of="$2" bs=1 count=1 seek=$size conv=notrunc 2>/dev/null
--- 
-1.6.2.5
-
diff --git a/qemu-fix-linux-user-build-on-ppc.patch b/qemu-fix-linux-user-build-on-ppc.patch
index 76e4426..4afbf06 100644
--- a/qemu-fix-linux-user-build-on-ppc.patch
+++ b/qemu-fix-linux-user-build-on-ppc.patch
@@ -1,4 +1,4 @@
-From 1cdc8e879b1e2140cc48c1a76718c336f42b0a7d Mon Sep 17 00:00:00 2001
+From 22c6c8c5dfe66a5e7f81dd4a296e1b2b245c5d28 Mon Sep 17 00:00:00 2001
 From: Mark McLoughlin <markmc@redhat.com>
 Date: Mon, 29 Jun 2009 14:49:03 +0100
 Subject: [PATCH] Fix linux-user build on ppc
@@ -58,7 +58,7 @@ index b042002..14f8aa1 100644
  /* ARM specific declarations */
  
 diff --git a/linux-user/elfload.c b/linux-user/elfload.c
-index d31cca7..3ccfdda 100644
+index 3a8268b..d283f73 100644
 --- a/linux-user/elfload.c
 +++ b/linux-user/elfload.c
 @@ -134,6 +134,7 @@ static inline void init_thread(struct target_pt_regs *regs, struct image_info *i
diff --git a/qemu-fix-msix-error-handling-on-older-kernels.patch b/qemu-fix-msix-error-handling-on-older-kernels.patch
index 5ff858e..691d8bf 100644
--- a/qemu-fix-msix-error-handling-on-older-kernels.patch
+++ b/qemu-fix-msix-error-handling-on-older-kernels.patch
@@ -1,4 +1,4 @@
-From 057fb1b4b227bc49aa00b08da5f177b50c020693 Mon Sep 17 00:00:00 2001
+From 0b341eda83cd2f01134d5b13300d97c07a3abced Mon Sep 17 00:00:00 2001
 From: Michael S. Tsirkin <mst@redhat.com>
 Date: Thu, 23 Jul 2009 16:34:13 +0300
 Subject: [PATCH] Fix error handling in msix vector add
diff --git a/qemu-fix-no-kvm-segfault.patch b/qemu-fix-no-kvm-segfault.patch
index 8333a9c..4a3b29b 100644
--- a/qemu-fix-no-kvm-segfault.patch
+++ b/qemu-fix-no-kvm-segfault.patch
@@ -1,37 +1,78 @@
-From aa1620047bb49079f4c114326d43fb9aa7a26065 Mon Sep 17 00:00:00 2001
-From: Richard Jones <rjones@redhat.com>
-Date: Thu, 20 Aug 2009 13:52:20 +0100
-Subject: [PATCH] Workaround segfault when qemu-kvm runs inside a VM (RHBZ#516543).
+From 00782050707fbb999bfffe722794490d2211a0a9 Mon Sep 17 00:00:00 2001
+From: Dustin Kirkland <kirkland@canonical.com>
+Date: Fri, 4 Sep 2009 14:38:30 -0500
+Subject: [PATCH] qemu-kvm: fix segfault when running kvm without /dev/kvm
 
-Regression was introduced by this commit:
-http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=commitdiff;h=b8083e930efc1ee85a7ad7e700dbd0f52ebb32dd
+qemu-kvm segfaults on systems without access to /dev/kvm.
+The global kvm_allowed is being set too late in vl.c.
 
-Upstream discussion:
-http://www.mail-archive.com/kvm@vger.kernel.org/msg19890.html
+This patch moves the kvm initialization a bit higher in the
+vl.c main, just after the daemonize fork.
 
-Note: NOT UPSTREAM and this is something of a hack.  Upstream are
-still debating how they really want to fix this.
+This fix is intended to be a short term solution, solving the
+segfaults.
 
-Signed-off-by: Richard Jones <rjones@redhat.com>
+In the longer term, the suggested approach requires a bit more
+development and testing:
+ * If no arg given          => try kvm, try kqemu, try tcg
+ * If --accelmode arg given => try $arg, and fail if unavailable
+
+(cherry picked from commit c06b44bfc9814930b6a94db7bbeb3be1cd39c0d2)
+
+Signed-off-by: Dustin Kirkland <kirkland@canonical.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Mark McLoughlin <markmc@redhat.com>
 Fedora-patch: qemu-fix-no-kvm-segfault.patch
 ---
- exec.c |    3 ---
- 1 files changed, 0 insertions(+), 3 deletions(-)
-
-diff --git a/exec.c b/exec.c
-index 88bcff5..721fcff 100644
---- a/exec.c
-+++ b/exec.c
-@@ -421,9 +421,6 @@ static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE];
+ vl.c |   28 ++++++++++++++--------------
+ 1 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/vl.c b/vl.c
+index db75470..26bced8 100644
+--- a/vl.c
++++ b/vl.c
+@@ -5831,6 +5831,20 @@ int main(int argc, char **argv, char **envp)
+     }
+ #endif
  
- static void code_gen_alloc(unsigned long tb_size)
- {
--    if (kvm_enabled())
--        return;
++    if (kvm_enabled()) {
++        int ret;
++
++        ret = kvm_init(smp_cpus);
++        if (ret < 0) {
++#if defined(KVM_UPSTREAM) || defined(NO_CPU_EMULATION)
++            fprintf(stderr, "failed to initialize KVM\n");
++            exit(1);
++#endif
++            fprintf(stderr, "Could not initialize KVM, will disable KVM support\n");
++            kvm_allowed = 0;
++        }
++    }
++
+ #ifdef CONFIG_KQEMU
+     if (smp_cpus > 1)
+         kqemu_allowed = 0;
+@@ -6002,20 +6016,6 @@ int main(int argc, char **argv, char **envp)
+         }
+     }
+ 
+-    if (kvm_enabled()) {
+-        int ret;
+-
+-        ret = kvm_init(smp_cpus);
+-        if (ret < 0) {
+-#if defined(KVM_UPSTREAM) || defined(NO_CPU_EMULATION)
+-            fprintf(stderr, "failed to initialize KVM\n");
+-            exit(1);
+-#endif
+-            fprintf(stderr, "Could not initialize KVM, will disable KVM support\n");
+-	     kvm_allowed = 0;
+-        }
+-    }
 -
- #ifdef USE_STATIC_CODE_GEN_BUFFER
-     code_gen_buffer = static_code_gen_buffer;
-     code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
+     if (monitor_device) {
+         monitor_hd = qemu_chr_open("monitor", monitor_device, NULL);
+         if (!monitor_hd) {
 -- 
 1.6.2.5
 
diff --git a/qemu-fix-optionrom-install.patch b/qemu-fix-optionrom-install.patch
deleted file mode 100644
index e617256..0000000
--- a/qemu-fix-optionrom-install.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From b3f4aa7dc9fcee229a0f6943f9fae1a02daf3497 Mon Sep 17 00:00:00 2001
-From: Mark McLoughlin <markmc@redhat.com>
-Date: Thu, 30 Jul 2009 17:17:43 +0100
-Subject: [PATCH] Revert "Don't copy multiboot.bin into pc-bios after built"
-
-This reverts commit 24d904eab3e806dc4d1ccdabbc3b4dcb64ddf497.
-
-This ensures:
-
-  a) extboot.bin is copied to pc-bios and installed
-
-  b) the built mutliboot.bin overwrites the multiboot.bin
-     shipped in the tarball
-
-Signed-of-by: Mark McLoughlin <markmc@redhat.com>
-Fedora-patch: qemu-fix-optionrom-install.patch
----
- pc-bios/optionrom/Makefile |    1 +
- 1 files changed, 1 insertions(+), 0 deletions(-)
-
-diff --git a/pc-bios/optionrom/Makefile b/pc-bios/optionrom/Makefile
-index 4cc3dae..e06ca72 100644
---- a/pc-bios/optionrom/Makefile
-+++ b/pc-bios/optionrom/Makefile
-@@ -41,6 +41,7 @@ build-all: multiboot.bin extboot.bin
- 
- %.bin: %.raw
- 	$(SRC_PATH)/pc-bios/optionrom/signrom.sh $< $@
-+	cp $@ $(SRC_PATH)/pc-bios/
- 
- clean:
- 	$(RM) *.o *.img *.bin *~
--- 
-1.6.2.5
-
diff --git a/qemu-fix-vnet-hdr-slirp-bustage.patch b/qemu-fix-vnet-hdr-slirp-bustage.patch
deleted file mode 100644
index e647b24..0000000
--- a/qemu-fix-vnet-hdr-slirp-bustage.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 97064ad88123744056d141e96247348dd2d9621c Mon Sep 17 00:00:00 2001
-From: Mark McLoughlin <markmc@redhat.com>
-Date: Fri, 7 Aug 2009 09:39:51 +0100
-Subject: [PATCH] net: fix vnet_hdr bustage with slirp
-
-slirp has started using VLANClientState::opaque and this has caused the
-kvm specific tap_has_vnet_hdr() hack to break because we blindly use
-this opaque pointer even if it is not a tap client.
-
-Add yet another hack to check that we're actually getting called with a
-tap client.
-
-[Needed on stable-0.11 too]
-
-Signed-off-by: Mark McLoughlin <markmc@redhat.com>
-Fedora-patch: qemu-fix-vnet-hdr-slirp-bustage.patch
----
- net.c |    6 ++++++
- 1 files changed, 6 insertions(+), 0 deletions(-)
-
-diff --git a/net.c b/net.c
-index c7702f8..2428f63 100644
---- a/net.c
-+++ b/net.c
-@@ -1521,6 +1521,9 @@ int tap_has_vnet_hdr(void *opaque)
-     VLANClientState *vc = opaque;
-     TAPState *s = vc->opaque;
- 
-+    if (vc->receive != tap_receive)
-+        return 0;
-+
-     return s ? s->has_vnet_hdr : 0;
- }
- 
-@@ -1529,6 +1532,9 @@ void tap_using_vnet_hdr(void *opaque, int using_vnet_hdr)
-     VLANClientState *vc = opaque;
-     TAPState *s = vc->opaque;
- 
-+    if (vc->receive != tap_receive)
-+        return;
-+
-     if (!s || !s->has_vnet_hdr)
-         return;
- 
--- 
-1.6.2.5
-
diff --git a/qemu.spec b/qemu.spec
index 2f977e7..7c7597e 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -1,10 +1,9 @@
-%define kvmvertag  rc1
-%define kvmverfull kvm-0.11.0-rc1
+%define kvmverfull kvm-0.11.0-rc2
 
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
-Version: 0.10.91
-Release: 0.10.%{kvmvertag}%{?dist}
+Version: 0.10.92
+Release: 1%{?dist}
 # Epoch because we pushed a qemu-1.0 package
 Epoch: 2
 License: GPLv2+ and LGPLv2+ and BSD
@@ -22,26 +21,17 @@ Patch01: qemu-bios-bigger-roms.patch
 # Works around broken linux-user build on ppc
 Patch02: qemu-fix-linux-user-build-on-ppc.patch
 
-# Make sure multiboot.bin/extboot.bin gets installed
-Patch03: qemu-fix-optionrom-install.patch
+# Allow the pulseudio backend to be the default
+Patch03: qemu-allow-pulseaudio-to-be-the-default.patch
 
 # Add KSM support - see https://fedoraproject.org/wiki/Features/KSM
 Patch04: qemu-add-ksm-support.patch
 
-# Fix extboot checksum (bug #514899)
-Patch05: qemu-fix-extboot-signrom.patch
-
-# Fix virtio_net with -net user (bug #516022)
-Patch06: qemu-fix-vnet-hdr-slirp-bustage.patch
+# Fix MSI-X error handling on older kernels (#519787)
+Patch05: qemu-fix-msix-error-handling-on-older-kernels.patch
 
 # Fix segfault when qemu-kvm is invoked inside a VM (bug #516543)
-Patch07: qemu-fix-no-kvm-segfault.patch
-
-# Allow the pulseudio backend to be the default
-Patch08: qemu-allow-pulseaudio-to-be-the-default.patch
-
-# Fix MSI-X error handling on older kernels (#519787)
-Patch09: qemu-fix-msix-error-handling-on-older-kernels.patch
+Patch06: qemu-fix-no-kvm-segfault.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: SDL-devel zlib-devel which texi2html gnutls-devel cyrus-sasl-devel
@@ -229,9 +219,6 @@ such as kvmtrace and kvm_stat.
 %patch04 -p1
 %patch05 -p1
 %patch06 -p1
-%patch07 -p1
-%patch08 -p1
-%patch09 -p1
 
 %build
 # systems like rhel build system does not have a recent enough linker so
@@ -496,6 +483,12 @@ getent passwd qemu >/dev/null || \
 %{_mandir}/man1/qemu-img.1*
 
 %changelog
+* Mon Sep  7 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.92-1
+- Update to qemu-kvm-0.11.0-rc2
+- Drop upstreamed patches
+- extboot install now fixed upstream
+- Re-place TCG init fix (#516543) with the one gone upstream
+
 * Mon Sep  7 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.91-0.10.rc1
 - Fix MSI-X error handling on older kernels (#519787)
 
diff --git a/sources b/sources
index 0e38c8d..74af1c7 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-bef21a81a3e81cfbaf92e9f2c4219575  qemu-kvm-0.11.0-rc1.tar.gz
+35294f8c77250eae6ef48c713fe92803  qemu-kvm-0.11.0-rc2.tar.gz