feat(kernel): add Revoke syscall for generation-based capability revocation

crates/kernel/src/syscall/capability.rs

@@ -44,4 +44,22 @@ impl<P: Platform> Kernel<P> {
             Err(e) => SyscallOutcome::Complete(SyscallResult::Error(e)),
         }
     }
+
+    pub(crate) fn handle_revoke(
+        &mut self,
+        caller_pid: types::id::ProcessId,
+        slot: types::bounded::CapSlot,
+    ) -> SyscallOutcome {
+        let resource = match self.check_cap(
+            caller_pid,
+            slot,
+            types::permission::Permission::Revoke,
+        ) {
+            Ok(cap) => cap.resource().clone(),
+            Err(e) => return SyscallOutcome::Complete(SyscallResult::Error(e)),
+        };
+
+        self.revoke_resource(&resource);
+        SyscallOutcome::Complete(SyscallResult::Ok)
+    }
 }

crates/kernel/src/syscall/mod.rs

@@ -44,6 +44,7 @@ impl<P: Platform> Kernel<P> {
             Syscall::SpawnThread { entry, stack } => self.handle_spawn_thread(pid, entry, stack),
             Syscall::CreateProcess { create_cap, image } => self.handle_create_process(pid, create_cap, image),
             Syscall::Kill { process } => self.handle_kill(pid, process),
+            Syscall::Revoke { slot } => self.handle_revoke(pid, slot),
             Syscall::Delegate { slot, to_endpoint, permissions } => {
                 self.handle_delegate(pid, slot, to_endpoint, permissions)
             }