drm/msm: Implement .gem_free_object_unlocked

We use a llist and a worker to delay the object cleanup. This avoids
taking mmap_sem and struct mutex in the wrong order when calling
drm_gem_object_put-unlocked() from drm_gem_mmap().

Fixes lockdep problem with copy_from_user() in msm_ioctl_gem_submit().

Change-Id: Idfe54ae8108158b69f3835f26991642d1e21f8ee
Signed-off-by: Kristian H. Kristensen <hoegsberg@chromium.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Git-commit: 48e7f18392c66f9b69ebac11c54f1a2e033ced54
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[samtran@codeaurora.org: resolve trivial merge conflict]
Signed-off-by: Samantha Tran <samtran@codeaurora.org>

msm/msm_gem.h

@@ -125,6 +125,8 @@ struct msm_gem_object {
 
 	struct list_head vmas;    /* list of msm_gem_vma */
 
+	struct llist_node freed;
+
 	/* normally (resv == &_resv) except for imported bo's */
 	struct dma_resv *resv;
 	struct dma_resv _resv;
@@ -182,6 +184,7 @@ enum msm_gem_lock {
 
 void msm_gem_purge(struct drm_gem_object *obj, enum msm_gem_lock subclass);
 void msm_gem_vunmap(struct drm_gem_object *obj, enum msm_gem_lock subclass);
+void msm_gem_free_work(struct work_struct *work);
 
 /* Created per submit-ioctl, to track bo's and cmdstream bufs, etc,
  * associated with the cmdstream submission for synchronization (and