On Thu, 05 Mar 2026 14:43:38 +0000,
Will Deacon [off-list ref] wrote:

Host kernel accesses to pages that are inaccessible at stage-2 result in
the injection of a translation fault, which is fatal unless an exception
table fixup is registered for the faulting PC (e.g. for user access
routines). This is undesirable, since a get_user_pages() call could be
used to obtain a reference to a donated page and then a subsequent
access via a kernel mapping would lead to a panic().

Rework the spurious fault handler so that stage-2 faults injected back
into the host result in the target page being forcefully reclaimed when
no exception table fixup handler is registered.

Is there any reason why you prefer the 'inject fault' followed by
'gimme that page' dance over a more direct 'unconditionally reclaim
the page on the back of the fault'?

I can't figure out what would go wrong in the latter approach, as you
always have an opportunity to inject a (fatal) fault if you can't
safely reclaim the page.

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.