diff --git a/src/fw/paravirt.c b/src/fw/paravirt.c
index 569fd25..db22ae8 100644
--- a/src/fw/paravirt.c
+++ b/src/fw/paravirt.c
@@ -440,4 +440,9 @@
     }
 
     qemu_cfg_e820();
+
+    if (romfile_find("etc/table-loader")) {
+        acpi_pm_base = 0x0600;
+        dprintf(1, "Moving pm_base to 0x%x\n", acpi_pm_base);
+    }
 }
diff --git a/src/fw/pciinit.c b/src/fw/pciinit.c
index 9ffda49..2e6382f 100644
--- a/src/fw/pciinit.c
+++ b/src/fw/pciinit.c
@@ -36,6 +36,7 @@
 u64 pcimem_end     = BUILD_PCIMEM_END;
 u64 pcimem64_start = BUILD_PCIMEM64_START;
 u64 pcimem64_end   = BUILD_PCIMEM64_END;
+u64 pci_io_low_end = 0xa000;
 
 struct pci_region_entry {
     struct pci_device *dev;
@@ -404,6 +405,12 @@
     pcimem_start = addr + size;
 
     pci_slot_get_irq = mch_pci_slot_get_irq;
+
+    /* setup io address space */
+    if (acpi_pm_base < 0x1000)
+        pci_io_low_end = 0x10000;
+    else
+        pci_io_low_end = acpi_pm_base;
 }
 
 static const struct pci_device_id pci_platform_tbl[] = {
@@ -721,16 +728,11 @@
     if (sum < 0x4000) {
         /* traditional region is big enougth, use it */
         r_io->base = 0xc000;
-    } else if (sum < 0x9000) {
+    } else if (sum < pci_io_low_end - 0x1000) {
         /* use the larger region at 0x1000 */
         r_io->base = 0x1000;
     } else {
-        /*
-         * Not enougth io address space -> error out.
-         *
-         * TODO: on q35 we can move PORT_ACPI_PM_BASE out of
-         * the way, then use the whole 1000 -> ffff region.
-         */
+        /* not enouth io address space -> error out */
         return -1;
     }
     dprintf(1, "PCI: IO: %4llx - %4llx\n", r_io->base, r_io->base + sum - 1);