diff --git a/kvm-upstream-ppc.patch b/kvm-upstream-ppc.patch
index 5423ebe..12382ba 100644
--- a/kvm-upstream-ppc.patch
+++ b/kvm-upstream-ppc.patch
@@ -1,7 +1,7 @@
-From b16ca7f06c09f46cc6dda7c49a31edc9a3325956 Mon Sep 17 00:00:00 2001
+From d1f92ec1f31fa25b447c8c54ccb36f33da97af69 Mon Sep 17 00:00:00 2001
 From: Glauber Costa <glommer@redhat.com>
 Date: Wed, 24 Jun 2009 14:22:57 +0100
-Subject: [PATCH 1/7] use KVM_UPSTREAM for ppc.
+Subject: [PATCH] use KVM_UPSTREAM for ppc.
 
 ppc should compile with upstream qemu code, so, put these
 defines in ppc specific code that references kvm functions.
@@ -32,10 +32,10 @@ index 00d82e4..164c326 100644
  
  #define PPC440EP_PCI_CONFIG     0xeec00000
 diff --git a/hw/ppc440_bamboo.c b/hw/ppc440_bamboo.c
-index 6963309..cf5b35b 100644
+index 00aa2c7..565571d 100644
 --- a/hw/ppc440_bamboo.c
 +++ b/hw/ppc440_bamboo.c
-@@ -21,6 +21,7 @@
+@@ -19,6 +19,7 @@
  #include "boards.h"
  #include "sysemu.h"
  #include "ppc440.h"
@@ -44,7 +44,7 @@ index 6963309..cf5b35b 100644
  #include "kvm_ppc.h"
  #include "device_tree.h"
 diff --git a/hw/ppce500_mpc8544ds.c b/hw/ppce500_mpc8544ds.c
-index d946f03..4692c96 100644
+index d9ed36c..49cc135 100644
 --- a/hw/ppce500_mpc8544ds.c
 +++ b/hw/ppce500_mpc8544ds.c
 @@ -16,6 +16,7 @@
@@ -56,10 +56,10 @@ index d946f03..4692c96 100644
  #include "qemu-common.h"
  #include "net.h"
 diff --git a/target-ppc/helper.c b/target-ppc/helper.c
-index db765e3..721d467 100644
+index 5a7a935..c150432 100644
 --- a/target-ppc/helper.c
 +++ b/target-ppc/helper.c
-@@ -29,6 +29,7 @@
+@@ -28,6 +28,7 @@
  #include "exec-all.h"
  #include "helper_regs.h"
  #include "qemu-common.h"
diff --git a/qemu-avoid-harmless-msr-warnings.patch b/qemu-avoid-harmless-msr-warnings.patch
deleted file mode 100644
index 6e4fbc7..0000000
--- a/qemu-avoid-harmless-msr-warnings.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 3084ee6394248dd27946acb609c758d0778d7b9a Mon Sep 17 00:00:00 2001
-From: Marcelo Tosatti <mtosatti@redhat.com>
-Date: Wed, 24 Jun 2009 14:38:34 +0100
-Subject: [PATCH 6/7] Avoid harmless unhandled wrmsr 0xc0010117 messages
-
-Olders kernel which don't contain kvm.git commit
-61a6bd672bda3b9468bf5895c1be085c4e481138 display the following message:
-
-kvm: 32301: cpu0 unhandled wrmsr: 0xc0010117 data 0
-
-When kvm_arch_load_regs is called. This is confusing in bug reports.
-
-Avoid it by checking whether the host advertises the MSR, similarly to
-how MSR_STAR is handled.
-
-Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
-Signed-off-by: Avi Kivity <avi@redhat.com>
-Signed-off-by: Mark McLoughlin <markmc@redhat.com>
----
- qemu-kvm-x86.c |   15 +++++++++++----
- 1 files changed, 11 insertions(+), 4 deletions(-)
-
-diff --git a/qemu-kvm-x86.c b/qemu-kvm-x86.c
-index 856b70c..505cc4c 100644
---- a/qemu-kvm-x86.c
-+++ b/qemu-kvm-x86.c
-@@ -25,6 +25,7 @@
- static struct kvm_msr_list *kvm_msr_list;
- extern unsigned int kvm_shadow_memory;
- static int kvm_has_msr_star;
-+static int kvm_has_vm_hsave_pa;
- 
- static int lm_capable_kernel;
- 
-@@ -54,10 +55,14 @@ int kvm_arch_qemu_create_context(void)
-     kvm_msr_list = kvm_get_msr_list(kvm_context);
-     if (!kvm_msr_list)
- 		return -1;
--    for (i = 0; i < kvm_msr_list->nmsrs; ++i)
-+    for (i = 0; i < kvm_msr_list->nmsrs; ++i) {
- 	if (kvm_msr_list->indices[i] == MSR_STAR)
- 	    kvm_has_msr_star = 1;
--	return 0;
-+        if (kvm_msr_list->indices[i] == MSR_VM_HSAVE_PA)
-+            kvm_has_vm_hsave_pa = 1;
-+    }
-+
-+    return 0;
- }
- 
- static void set_msr_entry(struct kvm_msr_entry *entry, uint32_t index,
-@@ -260,7 +265,8 @@ void kvm_arch_load_regs(CPUState *env)
-     set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_EIP, env->sysenter_eip);
-     if (kvm_has_msr_star)
- 	set_msr_entry(&msrs[n++], MSR_STAR,              env->star);
--    set_msr_entry(&msrs[n++], MSR_VM_HSAVE_PA, env->vm_hsave);
-+    if (kvm_has_vm_hsave_pa)
-+        set_msr_entry(&msrs[n++], MSR_VM_HSAVE_PA, env->vm_hsave);
- #ifdef TARGET_X86_64
-     if (lm_capable_kernel) {
-         set_msr_entry(&msrs[n++], MSR_CSTAR,             env->cstar);
-@@ -435,7 +441,8 @@ void kvm_arch_save_regs(CPUState *env)
-     if (kvm_has_msr_star)
- 	msrs[n++].index = MSR_STAR;
-     msrs[n++].index = MSR_IA32_TSC;
--    msrs[n++].index = MSR_VM_HSAVE_PA;
-+    if (kvm_has_vm_hsave_pa)
-+        msrs[n++].index = MSR_VM_HSAVE_PA;
- #ifdef TARGET_X86_64
-     if (lm_capable_kernel) {
-         msrs[n++].index = MSR_CSTAR;
--- 
-1.6.2.2
-
diff --git a/qemu-bios-bigger-roms.patch b/qemu-bios-bigger-roms.patch
index bef763a..aa76735 100644
--- a/qemu-bios-bigger-roms.patch
+++ b/qemu-bios-bigger-roms.patch
@@ -1,7 +1,7 @@
-From 3a9288fab031a820afa7be96e355c28ded1546bf Mon Sep 17 00:00:00 2001
+From f5042b31db5e1270f7bd96a6f4b20fd63dcb013b Mon Sep 17 00:00:00 2001
 From: Glauber Costa <glommer@redhat.com>
 Date: Wed, 24 Jun 2009 14:31:41 +0100
-Subject: [PATCH 2/7] compute checksum for roms bigger than a segment
+Subject: [PATCH] compute checksum for roms bigger than a segment
 
 Some option roms (e1000 provided by gpxe project as an example)
 are bigger than a segment. The current algorithm to compute the
diff --git a/qemu-disable-preadv.patch b/qemu-disable-preadv.patch
deleted file mode 100644
index 184a052..0000000
--- a/qemu-disable-preadv.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From e03d1ce64cffe26b196cf4c9943bc5a9c24d9e8d Mon Sep 17 00:00:00 2001
-From: Mark McLoughlin <markmc@redhat.com>
-Date: Wed, 24 Jun 2009 16:34:48 +0100
-Subject: [PATCH 4/7] Disable preadv()/pwritev() until bug corruption is fixed
-
-See https://bugzilla.redhat.com/497429
-
-Signed-off-by: Mark McLoughlin <markmc@redhat.com>
----
- configure |    6 +++---
- 1 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/configure b/configure
-index dcb9ff9..3463ec2 100755
---- a/configure
-+++ b/configure
-@@ -1264,9 +1264,9 @@ cat > $TMPC <<EOF
- int main(void) { preadv; }
- EOF
- preadv=no
--if $cc $ARCH_CFLAGS -o $TMPE $TMPC > /dev/null 2> /dev/null ; then
--  preadv=yes
--fi
-+#if $cc $ARCH_CFLAGS -o $TMPE $TMPC > /dev/null 2> /dev/null ; then
-+#  preadv=yes
-+#fi
- 
- ##########################################
- # fdt probe
--- 
-1.6.2.2
-
diff --git a/qemu-fix-arm-framebuffer-build.patch b/qemu-fix-arm-framebuffer-build.patch
deleted file mode 100644
index aa32c06..0000000
--- a/qemu-fix-arm-framebuffer-build.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From f23654c39f867d906239a6b773ea2997cd55fc46 Mon Sep 17 00:00:00 2001
-From: Mark McLoughlin <markmc@redhat.com>
-Date: Mon, 27 Apr 2009 10:18:14 +0100
-Subject: [PATCH 3/7] kvm: qemu: framebuffer: build fix for target-arm
-
-Include qemu-kvm.h for non-KVM_UPSTREAM building and surround the
-kvm code with USE_KVM guards.
-
-Fixes target-arm:
-
- hw/framebuffer.c: In function 'framebuffer_update_display':
- hw/framebuffer.c:53: warning: implicit declaration of function 'kvm_enabled'
- hw/framebuffer.c:54: warning: implicit declaration of function 'kvm_physical_sync_dirty_bitmap'
-
-Signed-off-by: Mark McLoughlin <markmc@redhat.com>
----
- hw/framebuffer.c |    3 +++
- 1 files changed, 3 insertions(+), 0 deletions(-)
-
-diff --git a/hw/framebuffer.c b/hw/framebuffer.c
-index 1086ba9..e2d7604 100644
---- a/hw/framebuffer.c
-+++ b/hw/framebuffer.c
-@@ -18,6 +18,7 @@
- #include "console.h"
- #include "framebuffer.h"
- #include "kvm.h"
-+#include "qemu-kvm.h"
- 
- /* Render an image from a shared memory framebuffer.  */
-    
-@@ -50,9 +51,11 @@ void framebuffer_update_display(
-     *first_row = -1;
-     src_len = src_width * rows;
- 
-+#ifdef USE_KVM
-     if (kvm_enabled()) {
-         kvm_physical_sync_dirty_bitmap(base, src_len);
-     }
-+#endif
-     pd = cpu_get_physical_page_desc(base);
-     pd2 = cpu_get_physical_page_desc(base + src_len - 1);
-     /* We should reall check that this is a continuous ram region.
--- 
-1.6.2.2
-
diff --git a/qemu-fix-cpuid-trimming.patch b/qemu-fix-cpuid-trimming.patch
deleted file mode 100644
index 0abe407..0000000
--- a/qemu-fix-cpuid-trimming.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 5ce45fee67cca7b2a7dc240f71898cbfab0ab917 Mon Sep 17 00:00:00 2001
-From: Mark McLoughlin <markmc@redhat.com>
-Date: Tue, 12 May 2009 12:42:42 +0100
-Subject: [PATCH 7/7] Work around supported cpuid ioctl() brokenness
-
-KVM_GET_SUPPORTED_CPUID has been known to fail to return -E2BIG
-when it runs out of entries. Detect this by always trying again
-with a bigger table if the ioctl() fills the table.
-
-(cherry picked from commit 8fa3b3ce6ed2a12062422b75d5b4ab9eab0ae4e9)
-
-Signed-off-by: Mark McLoughlin <markmc@redhat.com>
-Signed-off-by: Avi Kivity <avi@redhat.com>
----
- kvm/libkvm/libkvm-x86.c |    2 ++
- 1 files changed, 2 insertions(+), 0 deletions(-)
-
-diff --git a/kvm/libkvm/libkvm-x86.c b/kvm/libkvm/libkvm-x86.c
-index a2f6320..4f9539a 100644
---- a/kvm/libkvm/libkvm-x86.c
-+++ b/kvm/libkvm/libkvm-x86.c
-@@ -575,6 +575,8 @@ static struct kvm_cpuid2 *try_get_cpuid(kvm_context_t kvm, int max)
- 	r = ioctl(kvm->fd, KVM_GET_SUPPORTED_CPUID, cpuid);
- 	if (r == -1)
- 		r = -errno;
-+	else if (r == 0 && cpuid->nent >= max)
-+		r = -E2BIG;
- 	if (r < 0) {
- 		if (r == -E2BIG) {
- 			free(cpuid);
--- 
-1.6.2.2
-
diff --git a/qemu-prevent-cdrom-media-eject-while-device-is-locked.patch b/qemu-prevent-cdrom-media-eject-while-device-is-locked.patch
deleted file mode 100644
index b1ee1a0..0000000
--- a/qemu-prevent-cdrom-media-eject-while-device-is-locked.patch
+++ /dev/null
@@ -1,123 +0,0 @@
-From b9052762b5ae94ff7027f0fd0916b1c289bfffef Mon Sep 17 00:00:00 2001
-From: Mark McLoughlin <markmc@redhat.com>
-Date: Wed, 27 May 2009 10:06:11 +0100
-Subject: [PATCH 5/7] Prevent CD-ROM media eject while device is locked
-
-Section 10.8.25 ("START/STOP UNIT Command") of SFF-8020i states that
-if the device is locked we should refuse to eject if the device is
-locked.
-
-ASC_MEDIA_REMOVAL_PREVENTED is the appropriate return in this case.
-
-In order to stop itself from ejecting the media it is running from,
-Fedora's installer (anaconda) requires the CDROMEJECT ioctl() to fail
-if the drive has been previously locked.
-
-See also https://bugzilla.redhat.com/501412
-
-(cherry picked from commit aea2a33c73f28ecd8f10b242ecadddcc79c1c28b)
-
-Signed-off-by: Mark McLoughlin <markmc@redhat.com>
-Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
----
- block.c  |    9 ++++++++-
- block.h  |    2 +-
- hw/ide.c |   26 ++++++++++++++++++--------
- 3 files changed, 27 insertions(+), 10 deletions(-)
-
-diff --git a/block.c b/block.c
-index acb8976..b619147 100644
---- a/block.c
-+++ b/block.c
-@@ -1591,11 +1591,15 @@ int bdrv_media_changed(BlockDriverState *bs)
- /**
-  * If eject_flag is TRUE, eject the media. Otherwise, close the tray
-  */
--void bdrv_eject(BlockDriverState *bs, int eject_flag)
-+int bdrv_eject(BlockDriverState *bs, int eject_flag)
- {
-     BlockDriver *drv = bs->drv;
-     int ret;
- 
-+    if (bs->locked) {
-+        return -EBUSY;
-+    }
-+
-     if (!drv || !drv->bdrv_eject) {
-         ret = -ENOTSUP;
-     } else {
-@@ -1604,7 +1608,10 @@ void bdrv_eject(BlockDriverState *bs, int eject_flag)
-     if (ret == -ENOTSUP) {
-         if (eject_flag)
-             bdrv_close(bs);
-+        ret = 0;
-     }
-+
-+    return ret;
- }
- 
- int bdrv_is_locked(BlockDriverState *bs)
-diff --git a/block.h b/block.h
-index 5aef076..a4789b2 100644
---- a/block.h
-+++ b/block.h
-@@ -136,7 +136,7 @@ int bdrv_is_inserted(BlockDriverState *bs);
- int bdrv_media_changed(BlockDriverState *bs);
- int bdrv_is_locked(BlockDriverState *bs);
- void bdrv_set_locked(BlockDriverState *bs, int locked);
--void bdrv_eject(BlockDriverState *bs, int eject_flag);
-+int bdrv_eject(BlockDriverState *bs, int eject_flag);
- void bdrv_set_change_cb(BlockDriverState *bs,
-                         void (*change_cb)(void *opaque), void *opaque);
- void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size);
-diff --git a/hw/ide.c b/hw/ide.c
-index b2a1288..2c918df 100644
---- a/hw/ide.c
-+++ b/hw/ide.c
-@@ -359,6 +359,7 @@
- #define ASC_INCOMPATIBLE_FORMAT              0x30
- #define ASC_MEDIUM_NOT_PRESENT               0x3a
- #define ASC_SAVING_PARAMETERS_NOT_SUPPORTED  0x39
-+#define ASC_MEDIA_REMOVAL_PREVENTED          0x53
- 
- #define CFA_NO_ERROR            0x00
- #define CFA_MISC_ERROR          0x09
-@@ -1822,18 +1823,27 @@ static void ide_atapi_cmd(IDEState *s)
-         break;
-     case GPCMD_START_STOP_UNIT:
-         {
--            int start, eject;
-+            int start, eject, err = 0;
-             start = packet[4] & 1;
-             eject = (packet[4] >> 1) & 1;
- 
--            if (eject && !start) {
--                /* eject the disk */
--                bdrv_eject(s->bs, 1);
--            } else if (eject && start) {
--                /* close the tray */
--                bdrv_eject(s->bs, 0);
-+            if (eject) {
-+                err = bdrv_eject(s->bs, !start);
-+            }
-+
-+            switch (err) {
-+            case 0:
-+                ide_atapi_cmd_ok(s);
-+                break;
-+            case -EBUSY:
-+                ide_atapi_cmd_error(s, SENSE_NOT_READY,
-+                                    ASC_MEDIA_REMOVAL_PREVENTED);
-+                break;
-+            default:
-+                ide_atapi_cmd_error(s, SENSE_NOT_READY,
-+                                    ASC_MEDIUM_NOT_PRESENT);
-+                break;
-             }
--            ide_atapi_cmd_ok(s);
-         }
-         break;
-     case GPCMD_MECHANISM_STATUS:
--- 
-1.6.2.2
-
diff --git a/qemu.spec b/qemu.spec
index 84744c7..c052899 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -1,11 +1,11 @@
-%define kvmvernum  86
+%define kvmvernum  87
 %define kvmvertag  kvm%{kvmvernum}
 %define kvmverfull kvm-devel-%{kvmvernum}
 
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 0.10.50
-Release: 6.%{kvmvertag}%{?dist}
+Release: 7.%{kvmvertag}%{?dist}
 # Epoch because we pushed a qemu-1.0 package
 Epoch: 2
 License: GPLv2+ and LGPLv2+ and BSD
@@ -22,21 +22,6 @@ Patch01: kvm-upstream-ppc.patch
 # Not upstream, why?
 Patch02: qemu-bios-bigger-roms.patch
 
-# kvm-85 build fix, submitted upstream
-Patch03: qemu-fix-arm-framebuffer-build.patch
-
-# Disable preadv()/pwritev() until bug #497429 is fixed
-Patch04: qemu-disable-preadv.patch
-
-# Fix hang at end of anaconda cd installs (#50142)
-Patch05: qemu-prevent-cdrom-media-eject-while-device-is-locked.patch
-
-# Avoid harmless "unhandled wrmsr" warnings (#499712)
-Patch06: qemu-avoid-harmless-msr-warnings.patch
-
-# Fix from upstream for "kernel requires an x86-64 CPU" error
-Patch07: qemu-fix-cpuid-trimming.patch
-
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: SDL-devel zlib-devel which texi2html gnutls-devel cyrus-sasl-devel
 BuildRequires: rsync dev86 iasl
@@ -219,11 +204,6 @@ such as kvmtrace and kvm_stat.
 
 %patch01 -p1 -b .kvm-upstream-ppc
 %patch02 -p1 -b .bios-bigger-roms
-%patch03 -p1 -b .framebuffer-build-fix
-%patch04 -p1 -b .disable-preadv
-%patch05 -p1 -b .prevent-cdrom-eject
-%patch06 -p1 -b .wrmsr-warnings
-%patch07 -p1 -b .cpuid-trimming
 
 %build
 # systems like rhel build system does not have a recent enough linker so
@@ -467,6 +447,11 @@ fi
 %{_mandir}/man1/qemu-img.1*
 
 %changelog
+* Sat Jun 27 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-7.kvm87
+- Update to kvm-87
+- Drop upstreamed patches
+- Re-enable preadv()/pwritev() since #497429 is long since fixed
+
 * Fri Jun  5 2009 Mark McLoughlin <markmc@redhat.com> - 2:0.10.50-6.kvm86
 - Fix 'kernel requires an x86-64 CPU' error
 - BuildRequires ncurses-devel to enable '-curses' option (#504226)
diff --git a/sources b/sources
index 1cdd9a9..6f4727c 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-58ba34e20886041e0cc2b5a11340f637  qemu-kvm-devel-86.tar.gz
+949e6e072fe1f24361d1b17dea52be7f  qemu-kvm-devel-87.tar.gz