Allow using full io region on q35.

If qemu is new enough to support acpi table loading,
then go move pmbase out of the way.  This allows to
use the whole 0x1000 -> 0xffff io address space on q35.
piix has hotplug ports in the 0xa000 -> 0xafff area,
so we can't do the same there.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
diff --git a/src/fw/paravirt.c b/src/fw/paravirt.c
index 569fd25..db22ae8 100644
--- a/src/fw/paravirt.c
+++ b/src/fw/paravirt.c
@@ -440,4 +440,9 @@
     }
 
     qemu_cfg_e820();
+
+    if (romfile_find("etc/table-loader")) {
+        acpi_pm_base = 0x0600;
+        dprintf(1, "Moving pm_base to 0x%x\n", acpi_pm_base);
+    }
 }
diff --git a/src/fw/pciinit.c b/src/fw/pciinit.c
index 9ffda49..2e6382f 100644
--- a/src/fw/pciinit.c
+++ b/src/fw/pciinit.c
@@ -36,6 +36,7 @@
 u64 pcimem_end     = BUILD_PCIMEM_END;
 u64 pcimem64_start = BUILD_PCIMEM64_START;
 u64 pcimem64_end   = BUILD_PCIMEM64_END;
+u64 pci_io_low_end = 0xa000;
 
 struct pci_region_entry {
     struct pci_device *dev;
@@ -404,6 +405,12 @@
     pcimem_start = addr + size;
 
     pci_slot_get_irq = mch_pci_slot_get_irq;
+
+    /* setup io address space */
+    if (acpi_pm_base < 0x1000)
+        pci_io_low_end = 0x10000;
+    else
+        pci_io_low_end = acpi_pm_base;
 }
 
 static const struct pci_device_id pci_platform_tbl[] = {
@@ -721,16 +728,11 @@
     if (sum < 0x4000) {
         /* traditional region is big enougth, use it */
         r_io->base = 0xc000;
-    } else if (sum < 0x9000) {
+    } else if (sum < pci_io_low_end - 0x1000) {
         /* use the larger region at 0x1000 */
         r_io->base = 0x1000;
     } else {
-        /*
-         * Not enougth io address space -> error out.
-         *
-         * TODO: on q35 we can move PORT_ACPI_PM_BASE out of
-         * the way, then use the whole 1000 -> ffff region.
-         */
+        /* not enouth io address space -> error out */
         return -1;
     }
     dprintf(1, "PCI: IO: %4llx - %4llx\n", r_io->base, r_io->base + sum - 1);