diff --git a/Toolchain/BuildQemu.sh b/Toolchain/BuildQemu.sh
index f8f5136083..354f619dd6 100755
--- a/Toolchain/BuildQemu.sh
+++ b/Toolchain/BuildQemu.sh
@@ -37,13 +37,19 @@ pushd "$DIR/Tarballs"
         exit 1
     fi
 
-    if [ ! -d "$QEMU_VERSION" ]; then
-        echo "Extracting qemu..."
-        tar -xf "${QEMU_ARCHIVE}"
-    else
-        echo "Skipped extracting qemu"
+    # If the source directory exists, re-extract it again in case the patches have changed.
+    if [ -d "qemu-$QEMU_VERSION" ]; then
+        rm -rf "qemu-$QEMU_VERSION"
     fi
 
+    echo "Extracting qemu..."
+    tar -xf "${QEMU_ARCHIVE}"
+
+    pushd "qemu-$QEMU_VERSION"
+        for patch in "${DIR}"/Patches/qemu/*.patch; do
+            patch -p1 < "${patch}" > /dev/null
+        done
+    popd
 popd
 
 mkdir -p "$PREFIX"
diff --git a/Toolchain/Patches/qemu/raspberry-pi-command-line.patch b/Toolchain/Patches/qemu/raspberry-pi-command-line.patch
new file mode 100644
index 0000000000..1f3873a28f
--- /dev/null
+++ b/Toolchain/Patches/qemu/raspberry-pi-command-line.patch
@@ -0,0 +1,109 @@
+From 8b4eba1d4f41c5e07d2be1de6deb545dee4a2eb1 Mon Sep 17 00:00:00 2001
+From: Daniel Bertalan <dani@danielbertalan.dev>
+Date: Tue, 25 Apr 2023 11:35:52 +0200
+Subject: [PATCH] hw/arm/bcm2835_property: Implement "get command line" message
+
+This query copies the kernel command line into the message buffer. It
+was previously stubbed out to return empty, this commit makes it reflect
+the arguments specified with `-append`.
+
+I observed the following peculiarities on my Pi 3B+:
+- If the buffer is shorter than the string, the response header gives
+  the full length, but no data is actually copied.
+- No NUL terminator is added: even if the buffer is long enough to fit
+  one, the buffer's original contents are preserved past the string's
+  end.
+- The VC firmware adds the following extra parameters beside the
+  user-supplied ones (via /boot/cmdline.txt): `video`, `vc_mem.mem_base`
+  and `vc_mem.mem_size`. This is currently not implemented in qemu.
+
+Signed-off-by: Daniel Bertalan <dani@danielbertalan.dev>
+---
+ hw/arm/bcm2835_peripherals.c       | 2 ++
+ hw/arm/bcm2836.c                   | 2 ++
+ hw/arm/raspi.c                     | 2 ++
+ hw/misc/bcm2835_property.c         | 7 ++++++-
+ include/hw/misc/bcm2835_property.h | 1 +
+ 5 files changed, 13 insertions(+), 1 deletion(-)
+
+This patch has been submitted upstream: https://lists.nongnu.org/archive/html/qemu-arm/2023-04/msg00549
+
+diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
+index 3c2a4160cd..0233038b95 100644
+--- a/hw/arm/bcm2835_peripherals.c
++++ b/hw/arm/bcm2835_peripherals.c
+@@ -90,6 +90,8 @@ static void bcm2835_peripherals_init(Object *obj)
+                             TYPE_BCM2835_PROPERTY);
+     object_property_add_alias(obj, "board-rev", OBJECT(&s->property),
+                               "board-rev");
++    object_property_add_alias(obj, "command-line", OBJECT(&s->property),
++                              "command-line");
+ 
+     object_property_add_const_link(OBJECT(&s->property), "fb",
+                                    OBJECT(&s->fb));
+diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+index f894338fc6..166dc896c0 100644
+--- a/hw/arm/bcm2836.c
++++ b/hw/arm/bcm2836.c
+@@ -55,6 +55,8 @@ static void bcm2836_init(Object *obj)
+                             TYPE_BCM2835_PERIPHERALS);
+     object_property_add_alias(obj, "board-rev", OBJECT(&s->peripherals),
+                               "board-rev");
++    object_property_add_alias(obj, "command-line", OBJECT(&s->peripherals),
++                              "command-line");
+     object_property_add_alias(obj, "vcram-size", OBJECT(&s->peripherals),
+                               "vcram-size");
+ }
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+index 92d068d1f9..7b9221c924 100644
+--- a/hw/arm/raspi.c
++++ b/hw/arm/raspi.c
+@@ -280,6 +280,8 @@ static void raspi_machine_init(MachineState *machine)
+     object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(machine->ram));
+     object_property_set_int(OBJECT(&s->soc), "board-rev", board_rev,
+                             &error_abort);
++    object_property_set_str(OBJECT(&s->soc), "command-line",
++                            machine->kernel_cmdline, &error_abort);
+     qdev_realize(DEVICE(&s->soc), NULL, &error_fatal);
+ 
+     /* Create and plug in the SD cards */
+diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
+index 890ae7bae5..225bce2ba4 100644
+--- a/hw/misc/bcm2835_property.c
++++ b/hw/misc/bcm2835_property.c
+@@ -282,7 +282,11 @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
+             break;
+ 
+         case 0x00050001: /* Get command line */
+-            resplen = 0;
++            resplen = strlen(s->command_line);
++            if (bufsize >= resplen)
++                address_space_write(&s->dma_as, value + 12,
++                                    MEMTXATTRS_UNSPECIFIED, s->command_line,
++                                    resplen);
+             break;
+ 
+         default:
+@@ -413,6 +417,7 @@ static void bcm2835_property_realize(DeviceState *dev, Error **errp)
+ 
+ static Property bcm2835_property_props[] = {
+     DEFINE_PROP_UINT32("board-rev", BCM2835PropertyState, board_rev, 0),
++    DEFINE_PROP_STRING("command-line", BCM2835PropertyState, command_line),
+     DEFINE_PROP_END_OF_LIST()
+ };
+ 
+diff --git a/include/hw/misc/bcm2835_property.h b/include/hw/misc/bcm2835_property.h
+index 712b76b7a3..ba8896610c 100644
+--- a/include/hw/misc/bcm2835_property.h
++++ b/include/hw/misc/bcm2835_property.h
+@@ -30,6 +30,7 @@ struct BCM2835PropertyState {
+     MACAddr macaddr;
+     uint32_t board_rev;
+     uint32_t addr;
++    char *command_line;
+     bool pending;
+ };
+ 
+-- 
+2.40.0
+