vm_map_inherit: handle VM_INHERIT_QUARANTINE

Don't allow it to be set (that should only happen when a reservation
becomes fully unmapped) and don't allow map entries leave quarantine
(the entries must be destroyed after revocation is complete).

sys/vm/vm_map.c

@@ -3658,6 +3658,7 @@ vm_map_inherit(vm_map_t map, vm_offset_t start, vm_offset_t end,
  case VM_INHERIT_COPY:
  case VM_INHERIT_SHARE:
  case VM_INHERIT_ZERO:
+ /* Don't allow VM_INHERIT_QUARANTINE */
  break;
  default:
  return (KERN_INVALID_ARGUMENT);
@@ -3674,6 +3675,17 @@ vm_map_inherit(vm_map_t map, vm_offset_t start, vm_offset_t end,
  if (rv != KERN_SUCCESS)
  goto unlock;
  }
+#ifdef CHERI_CAPREVOKE
+ if (quarantine_unmapped_reservations) {
+ for (entry = start_entry; entry->start < end;
+ prev_entry = entry, entry = vm_map_entry_succ(entry)) {
+ if (entry->inheritance == VM_INHERIT_QUARANTINE) {
+ rv = KERN_PROTECTION_FAILURE;
+ goto unlock;
+ }
+ }
+ }
+#endif
  if (new_inheritance == VM_INHERIT_COPY) {
  for (entry = start_entry; entry->start < end;
  prev_entry = entry, entry = vm_map_entry_succ(entry)) {