Pagefault return path

Hi!
I'm currently looking at the execution path taken by the kernel on a
page fault. It's more or less clear to me how it enters the kernel and
sends a pagefault IPC. However, the return path taken where the user
mode Pager responds is a bit more hidden. I was looking for something
like "if IPC == pagefault answer) then ..." in the IPC code. Maybe
someone could point out the relevant areas?! The places where the book
keeping is done - or more precisely where a mapped/granted page is
inserted into the page dictionary of an address space.

Thanks,

Martin.