[...]
QEMU is emulating a Sabre/Simba based system.
I'll keep that in mind - I never actually worked on one of those systems.
There the values are (from the US-IIi manual) Config: 000001fe.01000000, length 00800000? IO: 000001fe.02000000 length 00100000 mem32: 000001ff.00000000 length f0000000 (4G - PROM) mem64: 000001ff.80000000 length f0000000 (I think)
The ranges property you showed below comes out with:
00000000.00000000.00000000.000001fe.01000000.00000000.01000000. 01000000.00000000.00000000.000001fe.02000000.00000000.01000000. 02000000.00000000.00000000.000001ff.00000000.00000001.00000000. 03000000.00000000.00000000.000001ff.00000000.00000001.00000000
Config space is twice the size of Psycho's, at 01000000 - so supports 256 buses instead of the 128 psycho did (defect in that chip). IO space supports a full 24-bit address as well (length 01000000). And the memory spaces support the full 32 bits (length 1.00000000), although in practice you have to reserve some address space for DMA.