如何在内核态与用户态之间共享内存？

SysBuffer = ExAllocatePoolWithTag (NonPagedPool,MAXMODNUM*sizeof(*SysBuffer),0x206B6444);
if(!SysBuffer)
KdPrint( ("HookTdi: Allocate SysBuffer fail!\n") );
else
{
//Map into Userspace
pMDL = ExAllocatePoolWithTag(NonPagedPool,
MmSizeOfMdl(SysBuffer,MAXMODNUM*sizeof(*SysBuffer)),
0x206B6444);
if(!pMDL)
           KdPrint( ("HookTdi: No enough Mem for MDL!\n") );
           else
{
pMDL = MmCreateMdl (pMDL,SysBuffer,MAXMODNUM*sizeof(*SysBuffer));
            MmBuildMdlForNonPagedPool(pMDL);
            UserBuffer = MmMapLockedPages(pMDL,1);
}
   
}
地方太窄了，贴不下代码！各位凑活看吧。将SysBuffer映射到用户空间（SysBuffer&UserBuffer系指向同一物理页面，但访问权限不同），前者在2G以上且仅对系统可见，后者则对用户可读写。

请教楼上大虾，用户态程序通过什么函数得到UserBuffer地址。

用DeviceIoControl():
在app里：
unsigned char *Buffer;
HANDLE hDevice;
hDevice = CreateFile("\\\\.\\mapmem",
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

if (hDevice == INVALID_HANDLE_VALUE)
{
printf("Error opening wdj Driver (%d)\n", GetLastError());
return;
}
//取得userbuffer
if (!DeviceIoControl(driver, (DWORD)IOCTL_MEM_MAP,
     NULL, 0, (LPBYTE)&Buffer,sizeof(PVOID),
     &size, NULL))
{
  printf("IOCTL_MEM_MAP, Error %d\n", GetLastError());
  return;
}
............

在sys:
ioBuffer  = Irp->AssociatedIrp.SystemBuffer;
......
case IOCTL_MEM_MAP:
deviceExt->SysAddress = ExAllocatePool(NonPagedPool,1024);

phyaddr = MmGetPhysicalAddress(deviceExt->SysAddress);
deviceExt->Mdl = IoAllocateMdl(deviceExt->SysAddress,
                  1024,
                  FALSE, FALSE, NULL);
if (deviceExt->Mdl == NULL) {
   ExRaiseStatus(STATUS_INSUFFICIENT_RESOURCES);
}
MmBuildMdlForNonPagedPool(deviceExt->Mdl);
VirtualAddress = MmMapLockedPages(deviceExt->Mdl,UserMode);
*(PVOID*)ioBuffer = VirtualAddress;
deviceExt->VirtualAddress = VirtualAddress;
Irp->IoStatus.Information = sizeof(PVOID);

释放资源：
MmUnmapLockedPages(deviceExt->VirtualAddress,deviceExt->Mdl);
IoFreeMdl(deviceExt->Mdl);
ExFreePool(deviceExt->SysAddress);
deviceExt->Mdl = NULL;

dazzy:
DS下可以这样用吗？DS下怎么样用？我在WDM，DS下怎么也不能实现共享。