diff --git a/build b/build
index dfaea6f..679947f 100755
--- a/build
+++ b/build
@@ -21,7 +21,7 @@ post_script_args=
 qemu_sdl='--enable-sdl --with-sdlabi=2.0'
 suffix=
 v=0
-while getopts 'a:B:b:C:c:fGgj:hIiK:kL:lM:p:qSst::v' OPT; do
+while getopts 'a:B:b:C:c:fGgj:hIiK:kL:lM:p:Q:qSst::v' OPT; do
   case "$OPT" in
     a)
       arch="$OPTARG"
@@ -88,6 +88,9 @@ BR2_TARGET_ROOTFS_INITRAMFS=n
     p)
       post_script_args="$OPTARG"
       ;;
+    Q)
+      common_qemu_variant="$OPTARG"
+      ;;
     q)
       extra_make_args="${extra_make_args} host-qemu-reconfigure \\
 "
@@ -191,15 +194,24 @@ echo
 
 common_mkdir
 
-# Manage Linux kernel variants.
-if [ -h "$common_linux_custom_dir" ]; then
-  rm "$common_linux_custom_dir"
-elif [ -d "$common_linux_custom_dir" ]; then
-  # Migration for existing builds.
-  mv "$common_linux_custom_dir" "$common_linux_variant_dir"
-fi
-mkdir -p "$common_linux_variant_dir"
-ln -s "$common_linux_variant_dir" "$common_linux_custom_dir"
+# Manage Linux kernel and QEMU variants.
+symlink_buildroot_variant() (
+  custom_dir="$1"
+  variant_dir="$2"
+  if [ -h "$custom_dir" ]; then
+    rm "$custom_dir"
+  elif [ -d "$custom_dir" ]; then
+    # Migration for existing builds.
+    mv "$custom_dir" "$variant_dir"
+  fi
+  mkdir -p "$variant_dir"
+  ln -s "$variant_dir" "$custom_dir"
+)
+symlink_buildroot_variant "$common_linux_custom_dir" "$common_linux_variant_dir"
+symlink_buildroot_variant "$common_qemu_custom_dir" "$common_qemu_variant_dir"
+# TODO: this breaks the build. But then I noticed that it wouldn't make sense,
+# because this is a guest tool, and we don't have image variants yet. Some other day maybe.
+#symlink_buildroot_variant "$common_qemu_guest_custom_dir" "$common_qemu_guest_variant_dir"
 
 # Manage gem5 variants.
 if "$gem5"; then
diff --git a/common b/common
index f8e1d1e..c5d79d1 100644
--- a/common
+++ b/common
@@ -72,6 +72,10 @@ set_common_vars() {
   common_qemu_termout_file="${common_qemu_run_dir}/termout.txt"
   common_linux_custom_dir="${build_dir}/linux-custom"
   common_linux_variant_dir="${common_linux_custom_dir}.${linux_variant}"
+  common_qemu_custom_dir="${build_dir}/host-qemu-custom"
+  common_qemu_variant_dir="${common_qemu_custom_dir}.${common_qemu_variant}"
+  common_qemu_guest_custom_dir="${build_dir}/qemu-custom"
+  common_qemu_guest_variant_dir="${common_qemu_custom_dir}.${common_qemu_variant}"
   common_vmlinux="${common_linux_variant_dir}/vmlinux"
   if [ -n "$common_gem5_worktree" ]; then
     common_gem5_src_dir="${common_gem5_non_default_src_root_dir}/${common_gem5_worktree}"
@@ -133,6 +137,7 @@ common_mkdir() (
   ;
 )
 common_linux_variant=default
+common_qemu_variant=default
 root_dir="$(pwd)"
 out_dir="${root_dir}/out"
 common_bench_boot="${out_dir}/bench-boot.txt"
diff --git a/qemu b/qemu
index 68f40a7..f750236 160000
--- a/qemu
+++ b/qemu
@@ -1 +1 @@
-Subproject commit 68f40a70741a312c7e1005cb671df651cd77f891
+Subproject commit f7502360397d291be04bc040e9f96c92ff2d8030