There's a call to cpu_get_pgd() from do_translation_fault() that reads the TTBR to reach the pgd pointer. Why not use pgd_offset(current->mm, addr)? Thanks, -- Bahadir