For zero-copy communication among the processor, I allocated a pool in the kernel. From user space, it may mmap the virtual memory device into user space i.e 0x80000000. the client may send a message to the server, it may request a buffer, kernel will allocate a block for it and register it into the pool. After that, the client(user space) will got an address(that has been translated into user space address) for example: it will be 0x80003ffe4, the kernel will record the offset 0x3ffe4 into pool. But during write the the user space address 0x80003ffe4, I track the memory fault handle process, I got the vmf->virtual_address - vma->start = 0x3f000, I follow the offset 0x3f000 to find the page, in fact, the offset is not right.
So, why is the offset 0x3f000 other than 0x3ffe4?

The call flow:

char *buf = ipczalloc(6); // buf = 0x80003ffe4.
memcpy(buf, "12345", 5); // will enter vma fault handle


The code as below:
static int ipcmem_vm_nopage(struct vm_area_struct* vma, struct vm_fault * vmf)
{
unsigned long offset;
offset = vmf->virtual_address - vma->start;
printk("the offset is %x.\n", offset);
}

---------- Post updated 09-28-09 at 12:52 AM ---------- Previous update was 09-27-09 at 11:23 PM ----------

I got the answer, since the kernel before do the page fault,
the vmf.virtual_address = (void __user *)(address & PAGE_MASK)


PAGE_MASK = ~(0xFFF)

From the kernel source code, there is no way to get the real user address from vm fault handler.

So, are there any better to handle that?