diff --git a/0053-net-remove-NICInfo.bootable-field.patch b/0053-net-remove-NICInfo.bootable-field.patch
new file mode 100644
index 0000000..02c110b
--- /dev/null
+++ b/0053-net-remove-NICInfo.bootable-field.patch
@@ -0,0 +1,43 @@
+From 30397a024f57f14800975bbb4312be54cc75202b Mon Sep 17 00:00:00 2001
+From: Eduardo Habkost <ehabkost@redhat.com>
+Date: Tue, 6 Apr 2010 19:38:51 -0300
+Subject: [PATCH] net: remove NICInfo.bootable field
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=561078
+
+It is just set by net_set_boot_mask() and never used. The logic for rom loading
+changed a lot since this field was introduced. It is not needed anymore.
+
+Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+---
+ net.c |    1 -
+ net.h |    1 -
+ 2 files changed, 0 insertions(+), 2 deletions(-)
+
+diff --git a/net.c b/net.c
+index de7d626..5cebb1a 100644
+--- a/net.c
++++ b/net.c
+@@ -1204,7 +1204,6 @@ void net_set_boot_mask(int net_boot_mask)
+
+     for (i = 0; i < nb_nics; i++) {
+         if (net_boot_mask & (1 << i)) {
+-            nd_table[i].bootable = 1;
+             net_boot_mask &= ~(1 << i);
+         }
+     }
+diff --git a/net.h b/net.h
+index 33a1eaf..5b6e814 100644
+--- a/net.h
++++ b/net.h
+@@ -135,7 +135,6 @@ struct NICInfo {
+     VLANState *vlan;
+     VLANClientState *netdev;
+     int used;
+-    int bootable;
+     int nvectors;
+ };
+
+-- 
+1.6.6.1
+
diff --git a/0054-net-remove-broken-net_set_boot_mask-boot-device-vali.patch b/0054-net-remove-broken-net_set_boot_mask-boot-device-vali.patch
new file mode 100644
index 0000000..09b5ee3
--- /dev/null
+++ b/0054-net-remove-broken-net_set_boot_mask-boot-device-vali.patch
@@ -0,0 +1,100 @@
+From 905a4bcaf9d4ed3662b901a2820b6e6ca80dc285 Mon Sep 17 00:00:00 2001
+From: Eduardo Habkost <ehabkost@redhat.com>
+Date: Tue, 6 Apr 2010 19:38:52 -0300
+Subject: [PATCH] net: remove broken net_set_boot_mask() boot device validation
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=561078
+
+There are many problems with net_set_boot_mask():
+
+1) It is broken when using the device model instead of "-net nic". Example:
+   $ qemu-system-x86_64 -device rtl8139,vlan=0,id=net0,mac=52:54:00:82:41:fd,bus=pci.0,addr=0x4 -net user,vlan=0,name=hostnet0 -vnc 0.0.0.0:0 -boot n
+   Cannot boot from non-existent NIC
+   $
+2) The mask was previously used to set which boot ROMs were supposed to be
+   loaded, but this was changed long time ago. Now all ROM images are loaded,
+   and SeaBIOS takes care of jumping to the right boot entry point depending on
+   the boot settings.
+3) Interpretation and validation of the boot parameter letters is done on
+   the machine type code. Examples: PC accepts only a,b,c,d,n as valid boot
+   device letters. mac99 accepts only a,b,c,d,e,f.
+
+As a side-effect of this change, qemu-kvm won't abort anymore if using "-boot n"
+on a machine with no network devices. Checking if the requested boot device is
+valid is now a task for the BIOS or the machine-type code.
+
+Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+---
+ net.c |   19 -------------------
+ net.h |    1 -
+ vl.c  |    5 +----
+ 3 files changed, 1 insertions(+), 24 deletions(-)
+
+diff --git a/net.c b/net.c
+index 5cebb1a..71c0f08 100644
+--- a/net.c
++++ b/net.c
+@@ -1195,25 +1195,6 @@ void net_host_device_remove(Monitor *mon, const QDict *qdict)
+     qemu_del_vlan_client(vc);
+ }
+
+-void net_set_boot_mask(int net_boot_mask)
+-{
+-    int i;
+-
+-    /* Only the first four NICs may be bootable */
+-    net_boot_mask = net_boot_mask & 0xF;
+-
+-    for (i = 0; i < nb_nics; i++) {
+-        if (net_boot_mask & (1 << i)) {
+-            net_boot_mask &= ~(1 << i);
+-        }
+-    }
+-
+-    if (net_boot_mask) {
+-        fprintf(stderr, "Cannot boot from non-existent NIC\n");
+-        exit(1);
+-    }
+-}
+-
+ void do_info_network(Monitor *mon)
+ {
+     VLANState *vlan;
+diff --git a/net.h b/net.h
+index 5b6e814..2b2ee4c 100644
+--- a/net.h
++++ b/net.h
+@@ -165,7 +165,6 @@ int net_client_parse(QemuOptsList *opts_list, const char *str);
+ int net_init_clients(void);
+ void net_check_clients(void);
+ void net_cleanup(void);
+-void net_set_boot_mask(int boot_mask);
+ void net_host_device_add(Monitor *mon, const QDict *qdict);
+ void net_host_device_remove(Monitor *mon, const QDict *qdict);
+
+diff --git a/vl.c b/vl.c
+index c75f891..349f945 100644
+--- a/vl.c
++++ b/vl.c
+@@ -4922,7 +4922,7 @@ int main(int argc, char **argv, char **envp)
+     const char *gdbstub_dev = NULL;
+     uint32_t boot_devices_bitmap = 0;
+     int i;
+-    int snapshot, linux_boot, net_boot;
++    int snapshot, linux_boot;
+     const char *initrd_filename;
+     const char *kernel_filename, *kernel_cmdline;
+     char boot_devices[33] = "cad"; /* default to HD->floppy->CD-ROM */
+@@ -5961,9 +5961,6 @@ int main(int argc, char **argv, char **envp)
+         exit(1);
+     }
+
+-    net_boot = (boot_devices_bitmap >> ('n' - 'a')) & 0xF;
+-    net_set_boot_mask(net_boot);
+-
+     /* init the bluetooth world */
+     if (foreach_device_config(DEV_BT, bt_parse))
+         exit(1);
+-- 
+1.6.6.1
+
diff --git a/0055-boot-remove-unused-boot_devices_bitmap-variable.patch b/0055-boot-remove-unused-boot_devices_bitmap-variable.patch
new file mode 100644
index 0000000..e84aa13
--- /dev/null
+++ b/0055-boot-remove-unused-boot_devices_bitmap-variable.patch
@@ -0,0 +1,63 @@
+From dfbaa3059414b158ff7ce7a74ffff80b0fa2db9c Mon Sep 17 00:00:00 2001
+From: Eduardo Habkost <ehabkost@redhat.com>
+Date: Tue, 6 Apr 2010 19:38:53 -0300
+Subject: [PATCH] boot: remove unused boot_devices_bitmap variable
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=561078
+
+In addition to removing the variable, this also renames the parse_bootdevices()
+function to validate_bootdevices(), as we don't need its return value anymore.
+
+Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+---
+ vl.c |    8 +++-----
+ 1 files changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/vl.c b/vl.c
+index 349f945..a71127c 100644
+--- a/vl.c
++++ b/vl.c
+@@ -2517,7 +2517,7 @@ int qemu_boot_set(const char *boot_devices)
+     return boot_set_handler(boot_set_opaque, boot_devices);
+ }
+
+-static int parse_bootdevices(char *devices)
++static void validate_bootdevices(char *devices)
+ {
+     /* We just do some generic consistency checks */
+     const char *p;
+@@ -2543,7 +2543,6 @@ static int parse_bootdevices(char *devices)
+         }
+         bitmap |= 1 << (*p - 'a');
+     }
+-    return bitmap;
+ }
+
+ static void restore_boot_devices(void *opaque)
+@@ -4920,7 +4919,6 @@ static int virtcon_parse(const char *devname)
+ int main(int argc, char **argv, char **envp)
+ {
+     const char *gdbstub_dev = NULL;
+-    uint32_t boot_devices_bitmap = 0;
+     int i;
+     int snapshot, linux_boot;
+     const char *initrd_filename;
+@@ -5215,13 +5213,13 @@ int main(int argc, char **argv, char **envp)
+
+                     if (legacy ||
+                         get_param_value(buf, sizeof(buf), "order", optarg)) {
+-                        boot_devices_bitmap = parse_bootdevices(buf);
++                        validate_bootdevices(buf);
+                         pstrcpy(boot_devices, sizeof(boot_devices), buf);
+                     }
+                     if (!legacy) {
+                         if (get_param_value(buf, sizeof(buf),
+                                             "once", optarg)) {
+-                            boot_devices_bitmap |= parse_bootdevices(buf);
++                            validate_bootdevices(buf);
+                             standard_boot_devices = qemu_strdup(boot_devices);
+                             pstrcpy(boot_devices, sizeof(boot_devices), buf);
+                             qemu_register_reset(restore_boot_devices,
+-- 
+1.6.6.1
+
diff --git a/qemu.spec b/qemu.spec
index 309b6f0..e1fb131 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -1,7 +1,7 @@
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 0.12.3
-Release: 5%{?dist}
+Release: 6%{?dist}
 # Epoch because we pushed a qemu-1.0 package
 Epoch: 2
 License: GPLv2+ and LGPLv2+ and BSD
@@ -86,6 +86,9 @@ Patch49: 0049-migration-Clear-fd-also-in-error-cases.patch
 Patch50: 0050-raw-posix-Detect-CDROM-via-ioctl-on-linux.patch
 Patch51: 0051-usb-linux-increase-buffer-for-USB-control-requests.patch
 Patch52: 0052-virtio-console-patches.patch
+Patch53: 0053-net-remove-NICInfo.bootable-field.patch
+Patch54: 0054-net-remove-broken-net_set_boot_mask-boot-device-vali.patch
+Patch55: 0055-boot-remove-unused-boot_devices_bitmap-variable.patch
 
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -177,7 +180,7 @@ Requires: %{name}-common = %{epoch}:%{version}-%{release}
 Provides: kvm = 85
 Obsoletes: kvm < 85
 Requires: vgabios
-Requires: seabios
+Requires: seabios-bin
 Requires: /usr/share/gpxe/e1000-0x100e.rom
 Requires: /usr/share/gpxe/rtl8029.rom
 Requires: /usr/share/gpxe/pcnet32.rom
@@ -330,6 +333,9 @@ such as kvmtrace and kvm_stat.
 %patch50 -p1
 %patch51 -p1
 %patch52 -p1
+%patch53 -p1
+%patch54 -p1
+%patch55 -p1
 
 %build
 # By default we build everything, but allow x86 to build a minimal version
@@ -522,6 +528,7 @@ fi
 
 %files common
 %defattr(-,root,root)
+%dir %{qemudocdir}
 %doc %{qemudocdir}/Changelog
 %doc %{qemudocdir}/README
 %doc %{qemudocdir}/TODO
@@ -632,6 +639,11 @@ fi
 %{_mandir}/man1/qemu-img.1*
 
 %changelog
+* Fri Apr 23 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-6
+- Change requires to the noarch seabios-bin
+- Add ownership of docdir to qemu-common (#572110)
+- Fix "Cannot boot from non-existent NIC" error when using virt-install (#577851)
+
 * Thu Apr 15 2010 Justin M. Forbes <jforbes@redhat.com> - 2:0.12.3-5
 - Update virtio console patches from upstream