Claude review: lib/test_hmm: add a new testcase for the migrate on fault

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**UAPI and testing concerns.**

1. **UAPI ioctl number renumbering is an ABI break:**
   ```c
   -#define HMM_DMIRROR_MIGRATE_TO_SYS    _IOWR('H', 0x03, ...)
   +#define HMM_DMIRROR_MIGRATE_ON_FAULT_TO_DEV _IOWR('H', 0x03, ...)
   +#define HMM_DMIRROR_MIGRATE_TO_SYS    _IOWR('H', 0x04, ...)
   ```
   All existing ioctls from 0x03 onward are renumbered. While this is a test driver (not general UAPI), any existing test binary compiled against the old headers will silently call the wrong ioctl. The new ioctl should be appended at the end (0x09) rather than inserted in the middle.

2. **`do_fault_and_migrate()` doesn't check `dmirror_range_fault()` return value before proceeding:**
   ```c
   ret = dmirror_range_fault(dmirror, range);
   pr_debug("Migrating from sys mem to device mem\n");
   migrate_hmm_range_setup(range);
   dmirror_migrate_alloc_and_copy(migrate, dmirror);
   ```
   If `dmirror_range_fault()` fails, the code continues to call `migrate_hmm_range_setup()` and the full migration sequence. The `ret` value is captured but not checked before proceeding.

3. **`dmirror_range_fault()` skips `mmap_read_lock` when migrating** but the `mmap_read_lock` is taken in the caller `do_fault_and_migrate()`. In `dmirror_range_fault()`:
   ```c
   if (!migrate) {
       mmap_read_lock(mm);
       ret = hmm_range_fault(range);
       mmap_read_unlock(mm);
   } else {
       ret = hmm_range_fault(range);
   }
   ```
   And in `do_fault_and_migrate()`:
   ```c
   mmap_read_lock(dmirror->notifier.mm);
   ret = dmirror_range_fault(dmirror, range);
   ...
   mmap_read_unlock(dmirror->notifier.mm);
   ```
   This is correct but the v10→v11 changelog says "Fix nested mmap_read_lock in test suite", so this was recently fixed. The fix looks correct — the lock is held across the entire fault+migrate sequence, which is required.

4. **Stack-allocated arrays** with fixed size:
   ```c
   unsigned long src_pfns[PFNS_ARRAY_SIZE] = { 0 };  // 64 entries = 64 * 8 = 512 bytes
   unsigned long dst_pfns[PFNS_ARRAY_SIZE] = { 0 };   // another 512 bytes
   ```
   1KB on the kernel stack is within limits but worth noting. The `range.hmm_pfns = src_pfns` reuses the same array for both HMM pfns and migrate src pfns, which is correct since `migrate_hmm_range_setup()` converts in-place.

5. **The selftest `hmm_migrate_on_fault` only tests the happy path** — anonymous private pages that are already present (initialized before migration). The cover letter's motivation is about migrating *non-present* pages, but the test doesn't cover that case (it writes to pages first, making them present). Adding a test that mmaps but doesn't touch the pages before migrating would better validate the stated goal.

---
Generated by Claude Code Patch Reviewer