Config.lb. LinuxBIOS doesn't seem to be able to use the new table, though:
Copying IRQ routing tables to 0xf0000...done. Verifing copy of IRQ routing tables at 0xf0000...failed
What does Qemu do when the BIOS attempts to write to that area? Normally this range of memory is write protected.