feat(kernel): implement generation-based capability revocation with proofs and tests

crates/kernel/src/lib.rs

@@ -160,16 +160,53 @@ impl<P: Platform> Kernel<P> {
         if !cap.permissions().allows(needed) {
             return Err(KernelError::PermissionDenied { slot, needed });
         }
+        let current_gen = self.resource_generation(cap.resource());
+        if !cap.generation().is_valid_against(&current_gen) {
+            return Err(KernelError::RevokedCapability(slot));
+        }
         Ok(cap)
     }
 
+    fn resource_generation(&self, resource: &Resource) -> Generation {
+        match resource {
+            Resource::Endpoint(id) => self
+                .endpoints
+                .get(*id)
+                .map(|ep| *ep.generation())
+                .unwrap_or_else(|| Generation::initial()),
+            Resource::Memory(id) => self
+                .regions
+                .get(*id)
+                .map(|r| *r.generation())
+                .unwrap_or_else(|| Generation::initial()),
+            _ => Generation::initial(),
+        }
+    }
+
+    pub fn revoke_resource(&mut self, resource: &Resource) {
+        match resource {
+            Resource::Endpoint(id) => {
+                if let Some(ep) = self.endpoints.get_mut(*id) {
+                    ep.revoke();
+                }
+            }
+            Resource::Memory(id) => {
+                if let Some(r) = self.regions.get_mut(*id) {
+                    r.revoke();
+                }
+            }
+            _ => {}
+        }
+    }
+
     fn grant_cap(
         &mut self,
         to: ProcessId,
         resource: Resource,
         permissions: PermissionSet,
     ) -> Result<CapSlot, KernelError> {
-        let cap = Capability::new(resource, permissions, Generation::initial());
+        let generation = self.resource_generation(&resource);
+        let cap = Capability::new(resource, permissions, generation);
         self.processes.get_mut(to)?.capabilities_mut().insert(cap)
     }
 }