Ok, so my MMU code was all broken. First I was just using the wrong number of bits in the L2 pages - x86 uses 4K pages with 1K entries, but ARM is only 1K pages with 256 entries, and I can't add up simple 2 digit numbers ... But even that didn't help ... many iterations and hours later ... ahh, I forgot to map the serial port - I was only mapping 16MB of i/o and there's another 1MB to map. Grr. Added that to the Haiku code and suddenly turning on the MMU 'works'.
Well it wasn't all wasted effort, I have a better understanding of the various permission and cache bits now. Better than nothing at least.
So ... ta-da ...
Actually it's nothing to be too excited about - that's all it does, and it's been hacked in very messily.