user space access functions. This allows the type checker
to check proper usage.

checking, these end up being no-ops, but they get enabled
by the type checker as special address_space attributes.

There is a stunning bug.

Previously, it was done automatically by the `reti' isntruction upon
returning from the kernel, but that doesn't do the correct thing in
various cases, for instance if there's a context switch, or a softirq.

Allows for the non standard cascade

(Steven Cole)