Protecting io-space from user processes can be implemented many ways, and I've tested 2 of them.

1: Use BRK as a way to set a flip-flop that enables io access. The 6502 has a VPB pin that asserts when a vector is pulled, either BRK/IRQ, RESET or NMI. De-asserting the flip-flop is done via a specific port write. It is really easy to do the hardware for this solution, but great care has to be put into making sure there is an io-access de-assert before returning to user-space.

2: Using SYNC and address decoding to ensure the io-accessing op-code is in kernel-space requires a bit more hardware to pull off, but ensures there are no forgotten io-access de-asserts. Requires fewer cpu cycles as well.

Having implemented both of these, I tend to lean towards #2 as it is easier to get bullet proof. On the other hand, it would be possible to use #1 to CHOOSE io-protection or not depending on the kernel. Hard choices, but I am glad I now understand more about this issue and what the 6502 can be coaxed to do.