balloon: fix stack-like behavior for balloons

We should always remove the last balloon we've created. There are two main
reasons for that:

1) The older balloons are likely to be already in more tenured generations,
and will move less, whereas younger balloons could be in younger generations.
So by removing them like a stack, we'll avoid needless moves

2) The probe, when inserted, should stay for as long as we can.

That was always the intended behavior but I made the small mistake of inserting
them in the wrong order. Fix that.

Signed-off-by: Glauber Costa <glommer@cloudius-systems.com>
Signed-off-by: Pekka Enberg <penberg@cloudius-systems.com>
mmu: give the jvm balloon write permissions

Up until now the JVM balloon explicitly forbade writes to its range, because
we didn't expect the JVM to ever write to it. But with the recently problem
Gleb discovered of double-copying of objects inside the Heap, we will use
writes to figure out when that object is no longer a balloon. But still,
we need to be able to go back to the JVM specific fault handler for that.

Therefore, we need write permissions in the VMA itself.

Signed-off-by: Glauber Costa <glommer@cloudius-systems.com>
[ penberg: use perm_rw as suggested by gleb ]
Signed-off-by: Pekka Enberg <penberg@cloudius-systems.com>
balloon: introduce a conciliation phase

This patch introduces a separate operation, "conciliate", that calculates
the balloon parameters given an arbitrary address

Signed-off-by: Glauber Costa <glommer@cloudius-systems.com>
Signed-off-by: Pekka Enberg <penberg@cloudius-systems.com>
balloon: store flags from original vma when ballooning

To avoid using hard code values for the original anonymous vma that mapped the
region before we ballooned, let's store the original flags in the JVM vma. This
patch does not yet use it, but only lays down the infrastructure. User will
come in the next patch.

Signed-off-by: Glauber Costa <glommer@cloudius-systems.com>
Signed-off-by: Pekka Enberg <penberg@cloudius-systems.com>
balloon: fix the double move problem

As we have recently discovered, some parallel GCs will move an object to two
different locations at times, and later on decide on which one to use. This
breaks our implementation if the final object is the second one to be copied,
because by then the original region is already mapped - so we won't fault, and
the unmapped region will not be the actual balloon, so we will have a bogus
fault

The core of this solution is to keep all the regions unmapped. Because they had
only garbage before, we know Java shouldn't read anything from it before it
writes something new. And when it does that, we declare that to be no longer a
balloon.

Movement is then split in two phases: the normal phase, and the finish phase.
In the finish phase we will remove the old VMA and create the new VMA again,
with heap characteristics.

Special care needs to be taken when "conciliating" the array: because we use
the difference between first faulting address and original array address to
calculate how many bytes we are skipping, we need to store that information
somewhere. We're using an unordered_map (hash) for that. We'll keep track of
all in-flight ballooned regions and hold the original address of the array.

When we detect movement *from* that region, we know it is the new location
and update the balloon object with the new address.

Signed-off-by: Glauber Costa <glommer@cloudius-systems.com>
Signed-off-by: Pekka Enberg <penberg@cloudius-systems.com>