diff --git a/pc-bios/bios-pq/0020-qemu-kvm-cfg-maxcpus.patch b/pc-bios/bios-pq/0020-qemu-kvm-cfg-maxcpus.patch
new file mode 100644
index 0000000..50e9b8c
--- /dev/null
+++ b/pc-bios/bios-pq/0020-qemu-kvm-cfg-maxcpus.patch
@@ -0,0 +1,62 @@
+Read max_cpus variable from QEMU_CFG. If not provided, use value of
+smp_cpus.
+
+Signed-off-by: Jes Sorensen <jes@sgi.com>
+
+diff --git a/bios/rombios.h b/bios/rombios.h
+index 8ece2ee..dbf3bd3 100644
+--- a/bios/rombios.h
++++ b/bios/rombios.h
+@@ -65,6 +65,7 @@
+ #define QEMU_CFG_UUID             0x02
+ #define QEMU_CFG_NUMA             0x0d
+ #define QEMU_CFG_BOOT_MENU        0x0e
++#define QEMU_CFG_MAX_CPUS         0x0f
+ #define QEMU_CFG_ARCH_LOCAL       0x8000
+ #define QEMU_CFG_ACPI_TABLES      (QEMU_CFG_ARCH_LOCAL + 0)
+ #define QEMU_CFG_SMBIOS_ENTRIES   (QEMU_CFG_ARCH_LOCAL + 1)
+diff --git a/bios/rombios32.c b/bios/rombios32.c
+index 69e82b1..610fc1f 100644
+--- a/bios/rombios32.c
++++ b/bios/rombios32.c
+@@ -436,6 +436,7 @@ void delay_ms(int n)
+ }
+ 
+ uint16_t smp_cpus;
++uint16_t max_cpus;
+ uint32_t cpuid_signature;
+ uint32_t cpuid_features;
+ uint32_t cpuid_ext_features;
+@@ -526,6 +527,19 @@ static uint16_t smbios_entries(void)
+     return cnt;
+ }
+ 
++static uint16_t get_max_cpus(void)
++{
++    uint16_t cnt;
++
++    qemu_cfg_select(QEMU_CFG_MAX_CPUS);
++    qemu_cfg_read((uint8_t*)&cnt, sizeof(cnt));
++
++    if (!cnt)
++        cnt = smp_cpus;
++
++    return cnt;
++}
++
+ uint64_t qemu_cfg_get64 (void)
+ {
+     uint64_t ret;
+@@ -2689,6 +2703,12 @@ void rombios32_init(uint32_t *s3_resume_vector, uint8_t *shutdown_flag)
+ 
+     smp_probe();
+ 
++#ifdef BX_QEMU
++    max_cpus = get_max_cpus();
++#else
++    max_cpus = smp_cpus;
++#endif
++
+     find_bios_table_area();
+ 
+     if (*shutdown_flag == 0xfe) {
diff --git a/pc-bios/bios-pq/0021-qemu-madt-maxcpus.patch b/pc-bios/bios-pq/0021-qemu-madt-maxcpus.patch
new file mode 100644
index 0000000..49a0fdd
--- /dev/null
+++ b/pc-bios/bios-pq/0021-qemu-madt-maxcpus.patch
@@ -0,0 +1,117 @@
+Use max_cpus when building bios tables.
+
+Signed-off-by: Jes Sorensen <jes@sgi.com>
+
+diff --git a/bios/rombios32.c b/bios/rombios32.c
+index e6bb164..3d15283 100644
+--- a/bios/rombios32.c
++++ b/bios/rombios32.c
+@@ -1145,23 +1145,25 @@ static void mptable_init(void)
+     putle32(&q, 0); /* OEM table ptr */
+     putle16(&q, 0); /* OEM table size */
+ #ifdef BX_QEMU
+-    putle16(&q, smp_cpus + 17); /* entry count */
++    putle16(&q, max_cpus + 17); /* entry count */
+ #else
+-    putle16(&q, smp_cpus + 18); /* entry count */
++    putle16(&q, max_cpus + 18); /* entry count */
+ #endif
+     putle32(&q, 0xfee00000); /* local APIC addr */
+     putle16(&q, 0); /* ext table length */
+     putb(&q, 0); /* ext table checksum */
+     putb(&q, 0); /* reserved */
+ 
+-    for(i = 0; i < smp_cpus; i++) {
++    for(i = 0; i < max_cpus; i++) {
+         putb(&q, 0); /* entry type = processor */
+         putb(&q, i); /* APIC id */
+         putb(&q, 0x11); /* local APIC version number */
+         if (i == 0)
+             putb(&q, 3); /* cpu flags: enabled, bootstrap cpu */
+-        else
++        else if (i < smp_cpus)
+             putb(&q, 1); /* cpu flags: enabled */
++        else
++            putb(&q, 0); /* cpu flags: disabled */
+         putb(&q, 0); /* cpu signature */
+         putb(&q, 6);
+         putb(&q, 0);
+@@ -1181,7 +1183,7 @@ static void mptable_init(void)
+     putstr(&q, "ISA   ");
+ 
+     /* ioapic */
+-    ioapic_id = smp_cpus;
++    ioapic_id = max_cpus;
+     putb(&q, 2); /* entry type = I/O APIC */
+     putb(&q, ioapic_id); /* apic ID */
+     putb(&q, 0x11); /* I/O APIC version number */
+@@ -1581,7 +1583,7 @@ int acpi_build_processor_ssdt(uint8_t *ssdt)
+ {
+     uint8_t *ssdt_ptr = ssdt;
+     int i, length;
+-    int acpi_cpus = smp_cpus > 0xff ? 0xff : smp_cpus;
++    int acpi_cpus = max_cpus > 0xff ? 0xff : max_cpus;
+ 
+     ssdt_ptr[9] = 0; // checksum;
+     ssdt_ptr += sizeof(struct acpi_table_header);
+@@ -1713,7 +1715,7 @@ void acpi_bios_init(void)
+         addr = (addr + 7) & ~7;
+         srat_addr = addr;
+         srat_size = sizeof(*srat) +
+-            sizeof(struct srat_processor_affinity) * smp_cpus +
++            sizeof(struct srat_processor_affinity) * max_cpus +
+             sizeof(struct srat_memory_affinity) * (nb_numa_nodes + 2);
+         srat = (void *)(addr);
+         addr += srat_size;
+@@ -1726,7 +1728,7 @@ void acpi_bios_init(void)
+     addr = (addr + 7) & ~7;
+     madt_addr = addr;
+     madt_size = sizeof(*madt) +
+-        sizeof(struct madt_processor_apic) * smp_cpus +
++        sizeof(struct madt_processor_apic) * max_cpus +
+ #ifdef BX_QEMU
+         sizeof(struct madt_io_apic) + sizeof(struct madt_int_override);
+ #else
+@@ -1799,18 +1801,21 @@ void acpi_bios_init(void)
+         madt->local_apic_address = cpu_to_le32(0xfee00000);
+         madt->flags = cpu_to_le32(1);
+         apic = (void *)(madt + 1);
+-        for(i=0;i<smp_cpus;i++) {
++        for(i = 0;i < max_cpus; i++) {
+             apic->type = APIC_PROCESSOR;
+             apic->length = sizeof(*apic);
+             apic->processor_id = i;
+             apic->local_apic_id = i;
+-            apic->flags = cpu_to_le32(1);
++            if (i < smp_cpus)
++                apic->flags = cpu_to_le32(1);
++            else
++                apic->flags = 0;
+             apic++;
+         }
+         io_apic = (void *)apic;
+         io_apic->type = APIC_IO;
+         io_apic->length = sizeof(*io_apic);
+-        io_apic->io_apic_id = smp_cpus;
++        io_apic->io_apic_id = max_cpus;
+         io_apic->address = cpu_to_le32(0xfec00000);
+         io_apic->interrupt = cpu_to_le32(0);
+ #ifdef BX_QEMU
+@@ -1844,7 +1849,7 @@ void acpi_bios_init(void)
+         srat->reserved1=1;
+  
+         core = (void*)(srat + 1);
+-        for (i = 0; i < smp_cpus; ++i) {
++        for (i = 0; i < max_cpus; ++i) {
+              core->type = SRAT_PROCESSOR;
+              core->length = sizeof(*core);
+              core->local_apic_id = i;
+@@ -2603,7 +2608,7 @@ void smbios_init(void)
+     add_struct(0, p);
+     add_struct(1, p);
+     add_struct(3, p);
+-    for (cpu_num = 1; cpu_num <= smp_cpus; cpu_num++)
++    for (cpu_num = 1; cpu_num <= max_cpus; cpu_num++)
+         add_struct(4, p, cpu_num);
+ 
+     /* Each 'memory device' covers up to 16GB of address space. */
diff --git a/pc-bios/bios-pq/series b/pc-bios/bios-pq/series
index 695b148..0422dec 100644
--- a/pc-bios/bios-pq/series
+++ b/pc-bios/bios-pq/series
@@ -17,3 +17,5 @@
 0017-bochs-bios-Move-QEMU_CFG-constants-to-rombios.h.patch
 0018-bochs-bios-Make-boot-prompt-optional.patch
 0019-bios-fix-multiple-calls.patch
+0020-qemu-kvm-cfg-maxcpus.patch
+0021-qemu-madt-maxcpus.patch
diff --git a/pc-bios/bios.bin b/pc-bios/bios.bin
index e4323c0..dc7d382 100644
--- a/pc-bios/bios.bin
+++ b/pc-bios/bios.bin
Binary files differ