Notes:
Switching between address spaces is another problem. There are no file operations which can be sensibly used for this. ioctl is available, but it isn't sensible.
So, I'm proposing a new system call, switch_to, which takes a file descriptor representing the new address space, and maps directly to switch_mm, causing a memory switch to that address space.
An unresolved question is whether there should also be a register switch. UML doesn't require this, but other users of this may.
Destruction of address spaces is obviously done by closing them. This will decrement the reference count, causing them to be freed if the file descriptor was the last reference.