Generalized address-space isolation

I look forward to the article in a few years about how this (or a similar) mechanism is becoming easy enough to work with that it can be enabled in the "enforcement"/"oopsing" mode, rather than just letting any stray accesses through. It'd be a major hardening step for the kernel: out-of-bounds accesses and most ROP gadgets would be much weaker, as will whatever the next big hijacking technique is.