mm/fork: copy-on-write 2 MB large pages on fork (opt-in)

The per-child COW address space (clone_pt_level<1>) shared any 2 MB large
page verbatim between parent and child instead of copy-on-writing it:

    if (ppte.large()) { child_pt[i] = ppte; continue; } // 2MB: share as-is

so a forked child writing a private large mapping scribbled the parent(s)
too.  This hit large malloc (>= 2 MB, mmap-backed), large MAP_ANON regions,
and any 2 MB-backed private writable mapping in the application slots.

Fix: for a WRITABLE large PD entry, split it to 4 K in the parent in place
(the existing split_large_page primitive) and fall through to the normal 4 K
clone path, which already makes the correct per-page decision -- private
writable -> COW, MAP_SHARED -> stays shared, read-only -> shared as-is.  A
read-only large page can never diverge, so it is still shared verbatim.  This
reuses the whole 4 K COW fault machinery (clone_pt_level0 +
handle_cow_write_fault); the only cost is one 4 K page table per split large
page, acceptable under the opt-in CONF_fork.

Verified on x86-64 (KVM microvm):
  - a standalone musl-PIE fork test now isolates a private >2 MB malloc across
    fork (child write does not change the parent; parent write does not change
    the child), while a MAP_SHARED region stays mutually visible;
  - tst-fork 10/10, tst-fork-cow 6/6, tst-fork-deep and tst-execve all pass
    (no regressions);
  - conf_fork=0 builds clean with the whole fork path (this change included)
    compiled out (clone_address_space absent from loader.elf).

Note: this fixes large-page (application-slot) COW.  OSv's small-object
malloc heap lives in the shared kernel identity map (mem_area::mempool), which
fork() shares by design; isolating that is a separate change.

All gated behind CONF_fork (default off).

Copyright (C) 2026 Greg Burd

Author: gburd

core/mmu.cc

@@ -334,6 +334,8 @@ static void clone_pt_level0(pt_element<0> *parent_pt, pt_element<0> *child_pt,
 // clone_pt_level<N> for N in 1..2, carrying base_virt so leaf pages can be
 // tested against the share-ranges.  (gnu++14: no if constexpr, so explicit
 // specialization.)
+template<int N> void split_large_page(hw_ptep<N> ptep); // defined below
+template<> void split_large_page(hw_ptep<1> ptep);      // defined below
 template<int N>
 static void clone_pt_level(pt_element<N> *parent_pt, pt_element<N> *child_pt,
                            uintptr_t base_virt);
@@ -347,7 +349,19 @@ void clone_pt_level<1>(pt_element<1> *parent_pt, pt_element<1> *child_pt,
     for (unsigned i = 0; i < pte_per_page; i++) {
         pt_element<1> ppte = parent_pt[i];
         if (ppte.empty()) { child_pt[i] = make_empty_pte<1>(); continue; }
-        if (ppte.large()) { child_pt[i] = ppte; continue; } // 2MB: share as-is
+        if (ppte.large()) {
+            // A read-only 2 MB page can never diverge, so share it verbatim.
+            // A WRITABLE 2 MB large page (large malloc, MAP_SHARED, large anon)
+            // must NOT be shared as-is -- that lets a forked child's writes
+            // leak into the parent.  Split it to 4 K in the PARENT in place,
+            // then fall through to the normal 4 K clone path, which makes the
+            // correct per-page decision (private-writable -> COW, MAP_SHARED ->
+            // stays shared, read-only -> shared as-is).  Reuses the whole 4 K
+            // COW machinery; cost is one 4 K page table per split large page.
+            if (!ppte.writable()) { child_pt[i] = ppte; continue; }
+            split_large_page(hw_ptep<1>::force(&parent_pt[i]));
+            ppte = parent_pt[i]; // re-read: now a non-large intermediate pte
+        }
         void *child_sub = memory::alloc_page();
         memset(child_sub, 0, page_size);
         auto parent_sub = phys_cast<pt_element<0>>(ppte.next_pt_addr());