diff --git a/ksm.init b/ksm.init
index 9b57587..6f6cb0c 100644
--- a/ksm.init
+++ b/ksm.init
@@ -56,6 +56,19 @@ stop() {
     echo
 }
 
+status() {
+    if [ ! -f /sys/kernel/mm/ksm/run ] ; then
+        echo $"$prog not supported"
+        RETVAL=1
+    else if [ "$(cat /sys/kernel/mm/ksm/run 2>/dev/null)" != "1" ]; then
+        echo $"$prog is not running"
+        RETVAL=1
+    else
+        echo $"$prog is running"
+        RETVAL=0
+    fi; fi
+}
+
 case "$1" in
   start)
 	start
@@ -64,13 +77,7 @@ case "$1" in
 	stop
 	;;
   status)
-        is_run=`cat /sys/kernel/mm/ksm/run`
-	RETVAL=$?
-        if [ $is_run -eq 1 ]; then
-            echo $"$prog is running"
-        else
-            echo $"$prog is not running"
-        fi
+        status
 	;;
   restart)
 	stop
diff --git a/qemu-fix-qcow2-backing-file-with-virtio.patch b/qemu-fix-qcow2-backing-file-with-virtio.patch
new file mode 100644
index 0000000..2dc56ac
--- /dev/null
+++ b/qemu-fix-qcow2-backing-file-with-virtio.patch
@@ -0,0 +1,140 @@
+From 1df18d4a961a66b9ea28ab83b409f4d9d470f148 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Thu, 8 Oct 2009 15:02:08 +0200
+Subject: [PATCH] qcow2: Bring synchronous read/write back to life
+
+When the synchronous read and write functions were dropped, they were replaced
+by generic emulation functions. Unfortunately, these emulation functions don't
+provide the same semantics as the original functions did.
+
+The original bdrv_read would mean that we read some data synchronously and that
+we won't be interrupted during this read. The latter assumption is no longer
+true with the emulation function which needs to use qemu_aio_poll and therefore
+allows the callback of any other concurrent AIO request to be run during the
+read. Which in turn means that (meta)data read earlier could have changed and
+be invalid now. qcow2 is not prepared to work in this way and it's just scary
+how many places there are where other requests could run.
+
+I'm not sure yet where exactly it breaks, but you'll see breakage with virtio
+on qcow2 with a backing file. Providing synchronous functions again fixes the
+problem for me.
+
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Mark McLoughlin <markmc@redhat.com>
+Fedora-patch: qemu-fix-qcow2-backing-file-with-virtio.patch
+---
+ block/qcow2-cluster.c |    6 ++--
+ block/qcow2.c         |   51 +++++++++++++++++++++++++++++++++++++++++++++++-
+ block/qcow2.h         |    3 ++
+ 3 files changed, 55 insertions(+), 5 deletions(-)
+
+diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
+index d4631c3..4d0ce16 100644
+--- a/block/qcow2-cluster.c
++++ b/block/qcow2-cluster.c
+@@ -306,8 +306,8 @@ void qcow2_encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
+ }
+ 
+ 
+-static int qcow_read(BlockDriverState *bs, int64_t sector_num,
+-                     uint8_t *buf, int nb_sectors)
++int qcow2_read(BlockDriverState *bs, int64_t sector_num, uint8_t *buf,
++    int nb_sectors)
+ {
+     BDRVQcowState *s = bs->opaque;
+     int ret, index_in_cluster, n, n1;
+@@ -358,7 +358,7 @@ static int copy_sectors(BlockDriverState *bs, uint64_t start_sect,
+     n = n_end - n_start;
+     if (n <= 0)
+         return 0;
+-    ret = qcow_read(bs, start_sect + n_start, s->cluster_data, n);
++    ret = qcow2_read(bs, start_sect + n_start, s->cluster_data, n);
+     if (ret < 0)
+         return ret;
+     if (s->crypt_method) {
+diff --git a/block/qcow2.c b/block/qcow2.c
+index dd32ea2..ced257e 100644
+--- a/block/qcow2.c
++++ b/block/qcow2.c
+@@ -855,6 +855,51 @@ static int qcow_make_empty(BlockDriverState *bs)
+     return 0;
+ }
+ 
++static int qcow2_write(BlockDriverState *bs, int64_t sector_num,
++                     const uint8_t *buf, int nb_sectors)
++{
++    BDRVQcowState *s = bs->opaque;
++    int ret, index_in_cluster, n;
++    uint64_t cluster_offset;
++    int n_end;
++    QCowL2Meta l2meta;
++
++    while (nb_sectors > 0) {
++        memset(&l2meta, 0, sizeof(l2meta));
++
++        index_in_cluster = sector_num & (s->cluster_sectors - 1);
++        n_end = index_in_cluster + nb_sectors;
++        if (s->crypt_method &&
++            n_end > QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors)
++            n_end = QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors;
++        cluster_offset = qcow2_alloc_cluster_offset(bs, sector_num << 9,
++                                              index_in_cluster,
++                                              n_end, &n, &l2meta);
++        if (!cluster_offset)
++            return -1;
++        if (s->crypt_method) {
++            qcow2_encrypt_sectors(s, sector_num, s->cluster_data, buf, n, 1,
++                            &s->aes_encrypt_key);
++            ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512,
++                              s->cluster_data, n * 512);
++        } else {
++            ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512);
++        }
++        if (ret != n * 512 || qcow2_alloc_cluster_link_l2(bs, cluster_offset, &l2meta) < 0) {
++            qcow2_free_any_clusters(bs, cluster_offset, l2meta.nb_clusters);
++            return -1;
++        }
++        nb_sectors -= n;
++        sector_num += n;
++        buf += n * 512;
++        if (l2meta.nb_clusters != 0) {
++            LIST_REMOVE(&l2meta, next_in_flight);
++        }
++    }
++    s->cluster_cache_offset = -1; /* disable compressed cache */
++    return 0;
++}
++
+ /* XXX: put compressed sectors first, then all the cluster aligned
+    tables to avoid losing bytes in alignment */
+ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
+@@ -1037,8 +1082,10 @@ static BlockDriver bdrv_qcow2 = {
+     .bdrv_set_key	= qcow_set_key,
+     .bdrv_make_empty	= qcow_make_empty,
+ 
+-    .bdrv_aio_readv	= qcow_aio_readv,
+-    .bdrv_aio_writev	= qcow_aio_writev,
++    .bdrv_read          = qcow2_read,
++    .bdrv_write         = qcow2_write,
++    .bdrv_aio_readv     = qcow_aio_readv,
++    .bdrv_aio_writev    = qcow_aio_writev,
+     .bdrv_write_compressed = qcow_write_compressed,
+ 
+     .bdrv_snapshot_create   = qcow2_snapshot_create,
+diff --git a/block/qcow2.h b/block/qcow2.h
+index 965a2f4..b41aa63 100644
+--- a/block/qcow2.h
++++ b/block/qcow2.h
+@@ -202,6 +202,9 @@ uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
+ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, uint64_t cluster_offset,
+     QCowL2Meta *m);
+ 
++int qcow2_read(BlockDriverState *bs, int64_t sector_num, uint8_t *buf,
++    int nb_sectors);
++
+ /* qcow2-snapshot.c functions */
+ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info);
+ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id);
+-- 
+1.6.2.5
+
diff --git a/qemu-improve-error-reporting-on-file-access.patch b/qemu-improve-error-reporting-on-file-access.patch
index 9154351..7451a6c 100644
--- a/qemu-improve-error-reporting-on-file-access.patch
+++ b/qemu-improve-error-reporting-on-file-access.patch
@@ -1,4 +1,4 @@
-From a40f520f7b94d2a5de04c7ca3a7513a99c84e9ef Mon Sep 17 00:00:00 2001
+From 565c62123258970d9254bc7b8eaa8f4c66ab2a21 Mon Sep 17 00:00:00 2001
 From: Justin M. Forbes <jforbes@redhat.com>
 Date: Thu, 1 Oct 2009 16:13:56 -0500
 Subject: [PATCH] Improve error reporting on file access
@@ -7,7 +7,10 @@ By making the error reporting include strerror(errno), it gives the user
 a bit more indication as to why qemu failed.  This is particularly
 important for people running qemu as a non root user.
 
+(cherry-picked from commit 850810d01b45e6ce99ac6696773e967890db2937)
+
 Signed-off-by: Justin M. Forbes <jforbes@redhat.com>
+Fedora-patch: qemu-improve-error-reporting-on-file-access.patch
 ---
  hw/pc.c |   12 ++++++------
  vl.c    |   20 ++++++++++----------
@@ -27,9 +30,9 @@ index 3b226f4..7a184cd 100644
 +		kernel_filename, strerror(errno));
  	exit(1);
      }
-
+ 
 @@ -947,8 +947,8 @@ static void load_linux(void *fw_cfg,
-
+ 
  	fi = fopen(initrd_filename, "rb");
  	if (!fi) {
 -	    fprintf(stderr, "qemu: could not load initial ram disk '%s'\n",
@@ -38,10 +41,10 @@ index 3b226f4..7a184cd 100644
 +		    initrd_filename, strerror(errno));
  	    exit(1);
  	}
-
+ 
 @@ -956,8 +956,8 @@ static void load_linux(void *fw_cfg,
  	initrd_addr = (initrd_max-initrd_size) & ~4095;
-
+ 
  	if (!fread_targphys_ok(initrd_addr, initrd_size, fi)) {
 -	    fprintf(stderr, "qemu: read error on initial ram disk '%s'\n",
 -		    initrd_filename);
diff --git a/qemu.spec b/qemu.spec
index 8e54b6d..4a0946b 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -1,7 +1,7 @@
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 0.11.0
-Release: 5%{?dist}
+Release: 6%{?dist}
 # Epoch because we pushed a qemu-1.0 package
 Epoch: 2
 License: GPLv2+ and LGPLv2+ and BSD
@@ -46,6 +46,9 @@ Patch07: qemu-do-not-exit-on-pci-hotplug-invalid-nic2.patch
 # Improve error reporting on file access
 Patch08: qemu-improve-error-reporting-on-file-access.patch
 
+# Fix fs errors with virtio and qcow2 backing file (#524734)
+Patch09: qemu-fix-qcow2-backing-file-with-virtio.patch
+
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: SDL-devel zlib-devel which texi2html gnutls-devel cyrus-sasl-devel
 BuildRequires: rsync dev86 iasl
@@ -105,6 +108,9 @@ This package provides the command line tool for manipulating disk images
 %package  common
 Summary: QEMU common files needed by all QEMU targets
 Group: Development/Tools
+Requires(post): /usr/bin/getent
+Requires(post): /usr/sbin/groupadd
+Requires(post): /usr/sbin/useradd
 Requires(post): /sbin/chkconfig
 Requires(preun): /sbin/service /sbin/chkconfig
 Requires(postun): /sbin/service
@@ -241,6 +247,7 @@ such as kvmtrace and kvm_stat.
 %patch06 -p1
 %patch07 -p1
 %patch08 -p1
+%patch09 -p1
 
 %build
 # systems like rhel build system does not have a recent enough linker so
@@ -534,6 +541,11 @@ fi
 %{_mandir}/man1/qemu-img.1*
 
 %changelog
+* Fri Oct  9 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-6
+- Fix fs errors with virtio and qcow2 backing file (#524734)
+- Fix ksm initscript errors on kernel missing ksm (#527653)
+- Add missing Requires(post): getent, useradd, groupadd (#527087)
+
 * Tue Oct  6 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.11.0-5
 - Add 'retune' verb to ksmtuned init script