Index: bochs-2.3.7/bios/rombios32.c
===================================================================
--- bochs-2.3.7.orig/bios/rombios32.c	2008-10-24 08:07:00.000000000 -0500
+++ bochs-2.3.7/bios/rombios32.c	2008-10-27 09:36:17.000000000 -0500
@@ -1262,6 +1262,17 @@
 			  * lines start */
 };
 
+#ifdef BX_QEMU
+struct madt_int_override
+{
+	APIC_HEADER_DEF
+	uint8_t                bus;     /* Identifies ISA Bus */
+	uint8_t                source;  /* Bus-relative interrupt source */
+	uint32_t               gsi;     /* GSI that source will signal */
+	uint16_t               flags;   /* MPS INTI flags */
+};
+#endif
+
 #include "acpi-dsdt.hex"
 
 static inline uint16_t cpu_to_le16(uint16_t x)
@@ -1410,7 +1421,11 @@
     madt_addr = addr;
     madt_size = sizeof(*madt) +
         sizeof(struct madt_processor_apic) * smp_cpus +
+#ifdef BX_QEMU
+        sizeof(struct madt_io_apic) + sizeof(struct madt_int_override);
+#else
         sizeof(struct madt_io_apic);
+#endif
     madt = (void *)(addr);
     addr += madt_size;
 
@@ -1480,6 +1495,9 @@
     {
         struct madt_processor_apic *apic;
         struct madt_io_apic *io_apic;
+#ifdef BX_QEMU
+        struct madt_int_override *int_override;
+#endif
 
         memset(madt, 0, madt_size);
         madt->local_apic_address = cpu_to_le32(0xfee00000);
@@ -1499,6 +1517,17 @@
         io_apic->io_apic_id = smp_cpus;
         io_apic->address = cpu_to_le32(0xfec00000);
         io_apic->interrupt = cpu_to_le32(0);
+#ifdef BX_QEMU
+        io_apic++;
+
+        int_override = (void *)io_apic;
+        int_override->type = APIC_XRUPT_OVERRIDE;
+        int_override->length = sizeof(*int_override);
+        int_override->bus = cpu_to_le32(0);
+        int_override->source = cpu_to_le32(0);
+        int_override->gsi = cpu_to_le32(2);
+        int_override->flags = cpu_to_le32(0);
+#endif
 
         acpi_build_table_header((struct acpi_table_header *)madt,
                                 "APIC", madt_size, 1);