[Hedeon]

So in short:

0) I set up the second BAR of the Voodoo to point to PCI memory space of the mediator
1) I set up de EUMB parameters using the PCI configuration registers. The EUMB is an extended configuration block in PCI memory.
2) I tell the card to setup this EUMB using the PCI command register bit 1 (Memory space). A 4096kb block is created in PCI memory
3) Inside the EUMB I then set up the outbound translation window location and size. I point it to a place set inside the memory as set in step 0, which is Voodoo memory
4) The outbound translation window is needed to execute code in PCI memory (or local memory, but I expect the Sonnet cannot access local Amiga memory due to limitations of the DMA of the mediator) instead of Sonnet memory.
5) With above method I tell the Sonnet card to translate any address from 0xFFF00000 (plus 1MB) to the outbound translation window in PCI memory.
6) I copy a simple PPC code piece to outbound translation window location+$100 (which is, as stated above, inside Voodoo memory).
7) The $100 offset is the CPU reset vector of the PPC. Normally, this is at 0xFFF00100. As the sonnet card has no real memory here, the CPU is halted (already during power up of the card)
8) Then I tell the card to start up the PPC CPU again. This is done by setting bit 2 of the PCI command register (Bus master bit) and by setting WP_TRIG0 and WP_TRIG1 in the WP_CONTROL register to negate HRESET
9) It now executes code at 0xFFF00100 which is translated to the PCI memory address where the PPC code resides.
10) The PPC code (for now) invalidates the BATs. Makes a part of the PCI memory cache-inhibited and guarded and initializes the EUMB in this part of the PCI memory through the EUMBBAR register (using CONFIG_ADDR and CONFIG_DAT). This is an extended copy from the one set up in step 2, but this one is accessed by the PPC instead of the 68k processor and has more configuration registers.

Next step is to set up the memory on the Sonnet, and translate it to PCI memory (using the inbound transation window) so the Amiga can access the memory of the Sonnet through PCI memory. Then we are in business. Application is of course limited due to the DMA limitations of the PPC towards the Amiga hardware.

And then I'll clean up the code and place it on Github if needed. For now the 68k side is 250 bytes and the PPC side is 150 bytes (that's what I meant with hack).