Claude review: lib/test_hmm: add a new testcase for the migrate on fault

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

Adds the `HMM_DMIRROR_MIGRATE_ON_FAULT_TO_DEV` ioctl and a selftest exercising it.

**Issue 1 — IOCTL number insertion breaks existing numbering:**
```c
-#define HMM_DMIRROR_MIGRATE_TO_SYS	_IOWR('H', 0x03, struct hmm_dmirror_cmd)
+#define HMM_DMIRROR_MIGRATE_ON_FAULT_TO_DEV	_IOWR('H', 0x03, struct hmm_dmirror_cmd)
+#define HMM_DMIRROR_MIGRATE_TO_SYS		_IOWR('H', 0x04, struct hmm_dmirror_cmd)
```
Inserting the new ioctl at 0x03 shifts all subsequent numbers. While this is a test-only driver (not a stable ABI), it breaks any existing out-of-tree userspace using these ioctls. Appending as 0x09 would be cleaner and avoids renumbering.

**Issue 2 — Test doesn't exercise the "fault + migrate" path:**
```c
+	/* Initialize buffer in system memory. */
+	for (i = 0, ptr = buffer->ptr; i < size / sizeof(*ptr); ++i)
+		ptr[i] = i;
+
+	/* Fault and migrate memory to device. */
+	ret = hmm_migrate_on_fault_sys_to_dev(self->fd, buffer, npages);
```
The write loop faults in all pages before the migrate-on-fault call. This means the test exercises "migrate already-present pages via the new path" but NOT "fault-in absent pages and migrate them in one walk" — which is the primary optimization this series enables. Consider adding a test that calls `hmm_migrate_on_fault_sys_to_dev` WITHOUT the initialization loop (or after an `madvise(MADV_DONTNEED)`) to exercise the true fault+migrate path.

**Issue 3 — `do_fault_and_migrate` proceeds with migration even on fault error:**
```c
+	ret = dmirror_range_fault(dmirror, range);
+
+	pr_debug("Migrating from sys mem to device mem\n");
+	migrate_hmm_range_setup(range);
+
+	dmirror_migrate_alloc_and_copy(migrate, dmirror);
+	migrate_vma_pages(migrate);
```
If `dmirror_range_fault` fails, the code still proceeds with migration setup and processing. The subsequent functions handle partial state gracefully (skipping entries without `MIGRATE_PFN_MIGRATE`), but it's still doing unnecessary work. An early-return on error with cleanup would be cleaner.

**Issue 4 — Extra blank line:**
```c
+	dmirror_bounce_fini(&bounce);
+
+
+out_mmput:
```
Double blank line.

---
Generated by Claude Code Patch Reviewer