As of last night, I finished writing the additional VM support routines for mapping and unmapping I/O addresses into the kernel's address space as needed for Nubus support in MkLinux.
In the process, I found that there's a really nasty bug in the pmap system (the bottom half of the VM system, i.e. the part that directly manages page tables and the processor's MMU) in MkLinux. Basically, the specs require that a sync instruction (or sync and tlbsync in 604/604e-based designs) be issued prior to leaving the critical section after a TLB flush. In the MkLinux implementation, the sync and tlbsync instructions occur AFTER releasing the lock, leaving the potential for serious corruption problems in the kernel on SMP systems.
The code basically calls a Mach VM routine to allocate a chunk of virtual address space large enough for the region, then calls pmap routines directly to add the mappings. It then obtains locked access to the PTEs for the region, marks them as WIMG_IO, and invalidates the TLB entries as it goes. It's the most horrible thing I've ever had to do in my life, and I feel dirty for having written it, but the VM system doesn't allow you to freely map and unmap hardware into the kernel's address space.