Fixed some issues:

1) When activating kernel objects, we activate kmem first, then the
capability. If the cap_activation failed, we need to go back and
release the activated kmem page.

2) When deactivate a pgd, only scan the user space range to make sure
no mapping left.

3) When deactivate a cap_cap, set the ref_cnt to 0 AND keep the frozen
flag to avoid any further operation on it.