However, QEMU only binds port 0xcf8 and 0xcfc to bus pcie.0. To avoid bus confliction, we should use other port pairs for busses under new domains.
I would skip support for IO based configuration and use only MMCONFIG for extra root buses.
The question remains: how do we assign MMCONFIG space for each PCI domain.
Allocation-wise it would be easiest to place them above 4G. Right after memory, or after etc/reserved-memory-end (if that fw_cfg file is present), where the 64bit pci bars would have been placed. Move the pci bars up in address space to make room.
Only problem is that seabios wouldn't be able to access mmconfig then.
Placing them below 4G would work at least for a few pci domains. q35 mmconfig bar is placed at 0xb0000000 -> 0xbfffffff, basically for historical reasons. Old qemu versions had 2.75G low memory on q35 (up to 0xafffffff), and I think old machine types still have that for live migration compatibility reasons. Modern qemu uses 2G only, to make gigabyte alignment work.
32bit pci bars are placed above 0xc0000000. The address space from 2G to 2.75G (0x8000000 -> 0xafffffff) is unused on new machine types. Enough room for three additional mmconfig bars (full size), so four pci domains total if you add the q35 one.