Rebase from mainline QEMU