https://manybutfinite.com/post/page-cache-the-affair-between-memory-and-files/ says "all regular file I/O happens through the page cache" (including for mmapped files). Great!
However, device drivers have the authority to choose the physical page returned by a page fault to an mmapped VMA, by installing a .fault method to the VMA's vm_operations_struct (example).
Let's say a file backed by such a driver is mmapped by a userspace app, and an access to the mapped VA page faults. What physical page ends up in the page cache representing that section of the file? Does the kernel accept the physical page returned by the driver's .fault method as the "kernel-official" page cache entry representing that section of the file? Or does the kernel take the page returned by the driver's .fault, copy it to some other kernel-managed page, and set that other page as the "official" page cache entry? Or does something else happen?
Thanks in advance for your help!