And after fixing some bugs in the QSPI-APB bridge (>2 byte burst transactions on the QSPI were not correctly incrementing the address when translating to consecutive APB transfers), I have the curve25519 accelerator accessible over APB.
There's still some refactoring needed to tidy up the code (I want to do hierarchical APB with multiple levels of decode so I don't have to pass multiple bus segments across hierarchical boundaries, and move some CDCs across module boundaries to reduce duplication in the RTL, etc).
At this point the only registers left on the legacy bus are the IRQ status register, the 10GbE link status register, the SERDES DRPs, and the Ethernet TX/RX FIFOs.
Still another couple evenings probably to finish refactoring all of this to run over APB, then I can start testing direct memory mapping of the registers rather than the indirect access I'm using now.