What do you mean by "hypervisor can't inject tlb miss to guest kernel?" Is it because virtual psr.ic is off? If so, an OS should not be storing to location that might cause a miss when psr.ic is off unless the location is pinned by a TR. Or is this a Linux bug too? (I'm not looking at the code right now... is the guest backing store on the guest kernel stack (which is pinned by a virtual TR) or the guest's user stack?)

I don't think we should be fixing theoretical architecture bugs that don't occur on any released implementation, nor on the next implementation that isn't even shipping yet (e.g. eager mode). I'd suggest adding a comment, or perhaps a check and warning/error after the pal rse_info call that says eager mode has not been tested. Changing such a fundamental and frequently executed part of the code may introduce other latent difficult bugs, and we already have plenty of bugs to track down that will break real users today.

But that's just my opinion ;-)